31–40 of 88 posts
All due respect, this is a neat advertisment for the "storytelling" Javascript library she is using, but I learn much more by reading W R Stevens' books. There is more to TCP/IP than what one can do through Berkeley sockets. Plus reading Stevens' books does not require Javascript.
Her pronouns are she/her.
Earlier quoted context omitted.
How would using curl -d make the problem obvious?
It wouldn't have split the request over separate sends. That's what flushHeaders() is doing; it does a separate send for headers vs the body of the request. https://nodejs.org/api/http.html#http_request_flushheaders
This hints to a possible XSS and/or code injection (not completely quoted input). Input was "strace -s128 -f -p " , as an answer to "how do you strace server process"
To me this seems pretty obscure and you debug pretty deep into and outside of your application. One part of me thinks of this as Somebody Else's Problem, but definitively makes me rethink it as a SEP and something devs should know about. Specially in time critical/real time systems.
Earlier quoted context omitted.
It’s stateful. You can visit the same location with different states.
Thats what cookies are for.
What's next, a bunch of complaining that electron apps are slow? That people are writing video games in managed languages?
The best job interview I ever had was framed like this. The interviewer told me there was a bug in the system and had a stack of pages he'd printed out that would provide successive clues as to what caused it. I could ask them questions, in effect using the interviewer as a search engine/debugger.
It was the closest an interview has ever come to simulating the day-to-day of a web developer.
JavaScript is required. Please enable it to continue. No
I very much understand your frustration. Hate JS web page as well, but this kinda game multipage logic type of thing SPA is better. Just wish I can only give authorization to certain JS api.
This is already implemented in any browser I know, but for some reason it is available only to some functionality (microphone, camera etc.) but not for eg. Ajax, Cross-Origin Things, Websockets, Canvas2D, WebGL etc.
Also before executing any Javascript browsers should ask if you want this website to execute (potentially malicious) code on your computer!
A few months ago there had been multiple articles about this behaviour but i really don‘t remember the details anymore. Does anyone know a writeup with a detailled explanation to understand how it is happening and tests to see whether your systems are affected?