Viewing profile — derekprior

GitHub Sponsors is out of beta for developers with a bank account in any of the 30 countries supported by Stripe. For folks with bank accounts outside of that list, GitHub Sponsors…

You can't set an HTTP Header with an HTML link. Would be nice to set a body though, wouldn't it? Also, not allowed by HTML.

I think people are looking to closely at the first degree attack -- a trusted partner is pwned. If this is the case, there's far more interesting things an attacker could do. It's …

In my experience, password reset tokens are not single use. They are good for both loading the form and submitting the form. They are not invalidated until the form is submitted wi…

https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_A... I might not be using the right term here, but the general idea is that you create an encrypted token out of some dat…

This has been suggested numerous time since I published. I had not previously considered this solution and I think it's a fine solution for people to make if they know the tradeoff…

Depends on how the reset behaves. Some resets log you in immediately after providing a new password. Some require you to log in after resetting the password. I feel like I've seen …

I'd certainly consider this for some applications. It depends on the value of what you are protecting. For some sites and users, the error rate introduced by this method would be u…

It's covered in the article, but this is not supported by IE11. That's pretty modern...

Author here. I completely agree that it's unlikely to be exploited but also think fixes are mostly simple enough that it should be addressed.

This requires non-idempotent get requests as you must invalidate the token on get. I did consider this approach for Clearance and intended to go with it, but was discouraged from d…

The manual verification steps are basically impossible for any non-trivial gem. I wonder if it would be possible to re-build (from git) the impacted gem versions and check their ch…

homebrew-built vim worked fine for me. I followed the manual steps.

Huh? A bulleted list of release notes with a pot shot at Safari and some mighty large leaps of faith. "Since most Mac users use Google Chrome as their primary browsers (sic)..." --…

Okay, I won't tell you to enable JavaScript. Can I tell you to bump up your blog's font size?

Agree. I want to read this, but I haven't a damn clue as to how to go about that.

How about a nested hash of attributes? class PostsController attr_accessible: :title, :body, :related_links => { :href, :title } end This would accept the attributes: post_title, p…

Until recently the GMail web interface was simply unmatched. When GMail first shipped, their conversation view was so far ahead of what anyone was doing on the web or in a fat clie…

Done right? Sorry, you bored me to death as soon as you started blabbering about Pascal's Triangle. I'm sure I learned about that at some point, but I've forgotten it. You asking m…

This seems like it would work in environments that aren't super competitive for top talent or if you are offering a dream job, but in the face of multiple offers this is going to b…