Viewing profile — smagin

in light of zipcodefirst site

https://smagin.fyi/ That's my blog. I have opinions on software, make a couple of apps and patch other people programs when I like them enough. People here liked https://smagin.fyi…

This feels like April 1st joke made in October. Like the Enter dial in particular.

Like the take that we need to authentificate more often nowadays. AWS makes it extreme — it resets login each 12 hours I reckon, and each time I need to click like 10 times, touch …

Thanks for the information hierarchy / conceptual boundaries distinction, makes sense. I didn't know the latter term but tried to describe it in the last section of the post, nice …

yup, that's a good part of the page to stand out, when I've seen all the landing page can show and now it nudges me to try the app out

hm, I sort of agree with the train of thoughts but not with the conclusion. Maybe it's "is my blue your blue" situation. I talked to people while working on this post and some said…

author here (not super educated either). That's part of the idea — when cards are removed it becomes obvious that tags become the most noticeable part while not being the most (or …

Unrelated but I have the easiest design improvement for your website: change background color to #4285f4 (same as in topbar) so it looks like a sheet of paper on a blue base

Gwern wrote a post about his everyday improvements in 2018, I thought I'd write a follow-up.

oh god you're right https://stackoverflow.com/a/57206146/1685746 yeah sure what can go wrong, let's listen to fetch and modify requests in a service worker.

I asked that in the post but nobody answered still, let's try here. Why are CSRF tokens rotated? OWASP says it's somehow more secure but I don't really see why.

not even you don't need to, you shouldn't. Sessions shouldn't be accessible to js at all

mitm means you can control users network, doesn't it? Another question, does this work with https? And the third one, if this was the thing some dishonest governments or vpn provid…

You shouldn't need your session token in JS, you can specify your fetch requests to include cookies, and you can setup CORS to allow that.

> How does server know the cookie is valid if it doesn't store it depending on why you'are asking the question, * because it decrypts correctly * because it contains some user iden…

Why would you need that? Also, one thing I can speculate that phishing would become even easier if such things were allowed