81–90 of 111 posts
This site is subject to severe XSS via the post mechanism. Just entering alert(1) works. So be careful when going to links. See https://hacker.thoughts.page for a demo
Hey! I'm the person who made this — I don't believe there's an actual problem here, since login cookies are set on the top-level domain (and thus are inaccessible to content on subdomains), and are HTTPOnly as well. I do notice that Stripe sets a tracking cookie (which only happens for people who pay for the service, since I don't load the Stripe JS elsewhere), so you could track pageviews with that or something. Tha…
Google will penalize your domain strongly as soon as anyone used your service for malicious content. You might even get blocked entirely if you are particularly unlucky.
That's also the reason why GitHub pages is hosted under github.io instead of GitHub.com for example.
Earlier quoted context omitted.
It's a shame because its pricing structure works like how many people misunderstand taxes to work. If you earn $39,990/year and then get a $30/year raise, then you'll actually be set back to $39,960/year after you pay the new price for this service. You might have to awkwardly explain to your boss that you don't want that $0.015/hour raise. If instead the service worked like taxes by charging a percent of the money y…
From the pricing page: it obviously isn't perfect — there are people making more than $40,000/year for whom $5/month is an undue burden, and there are people making less than $40,000/year who can easily afford $5/month. but it's not like i'm checking, it's basically pay-what-you-want with $40,000 as a suggested cutoff for paying.
Meh, GitHub pages is free
True, but GitHub Pages requires more time to set up your website: Create a new GitHub account (If you don't have one already), create a repo for your website, create your website, push that website to your repo, and then even that, you still have to set up your website for blogging, which is going to take you from a few minutes to a few days depends on what you use to create the website and how lazy you are.
I can edit in the browser using VS Code. I clicked two buttons to set up Jekyll.
Earlier quoted context omitted.
> ...is tweeting into the void kinda sad? No, I think it's brilliant. I think we'd see more interesting writing on the internet if it didn't always start with the goal of acquiring and maintaining an audience.
Really? I don't know many authors who are motivated to write interesting content and then hide it / have zero idea if anyone is reading it.
EDIT: A 'zine isn't a perfect analogy, since someone who published it would know how many they printed. A freely copyable newsletter would probably be a stronger analog.
Earlier quoted context omitted.
It used to be public; the news papers had databases where you could look up individuals or list by location/birthyear/gender. Some even made maps, but they were a bit unpopular as it was suspected to be used by criminals. But knowing what politicians earned was nice and important, and news papers still report on "people of public interest" Today, you have to login online and the person you look up can see your name i…
> Today, you have to login online and the person you look up can see your name in the log I really don't see a problem with that and would still consider it public information.
So - there has been changes that resulted in less transparency or better privacy, depending on point of view
Earlier quoted context omitted.
Hey! I'm the person who made this — I don't believe there's an actual problem here, since login cookies are set on the top-level domain (and thus are inaccessible to content on subdomains), and are HTTPOnly as well. I do notice that Stripe sets a tracking cookie (which only happens for people who pay for the service, since I don't load the Stripe JS elsewhere), so you could track pageviews with that or something. Tha…
Just a heads up, a sister comment already pointed out the biggest "danger", but not what that means for your webapp: Google will penalize your domain strongly as soon as anyone used your service for malicious content. You might even get blocked entirely if you are particularly unlucky. That's also the reason why GitHub pages is hosted under github.io instead of GitHub.com for example.
Earlier quoted context omitted.
>allowing people to use arbitrary HTML and JS was an intentional choice Oh, you'll be reversing this choice VERY quickly if your product gets any traction, I assure you...
I don't actually see a problem. It goes against my gut reaction but given the pages that are published are entirely isolated there is no more of a threat than someone publishing whatever they want on another web host. There is no user information to hijack, no cookies, no login buttons, no local storage, no auth etc. Yes, the pages can publish illegal information, be set up as phishing hubs, but none of that is as a…
Earlier quoted context omitted.
In Norway, everyone's income is public information. Other countries could do the same to make things more transparent.
> In Norway, everyone's income is public information. > Other countries could do the same to make things more transparent. What verifiable tangible benefits does this have?
Earlier quoted context omitted.
I think that can be accomplished with wordpress (or a similar blogging platform)...i suppose it would simply take tweaking the template/site settings to not expose features like comments, post titles, etc. Maybe wordpress might be overkill, but i think what you desire is achievable with an existing blogging platform out there.
But it would still be hard to discover. As a reader I imagine going to a specific website, choosing a topic and immediately seeing a stream of genuine thoughts of many different people on it. As a writer I would rather go to GitHub pages with a tweaked theme. WordPress is a huge overkill with a huge pile of problems.
I see your point. I made an assumption that the separate websites would in fact be separate, and not living under a singular umbrella of discoverable content. What you described is still achievable - either via walled gardens (where content is centralized and more easily discoverable), or through looser connections such as web rings, and even search engines. Also acknowledged that wordpress is total overkill...it was just an example that the tech exists to achieve what is desired. ;-)