371–380 of 458 posts
Earlier quoted context omitted.
Better for the cool down to be managed guaranteed centrally by the package forge rather than ad-hoc by each individual client.
That’s tricky, sometimes you really need the new version to be available right away.
Earlier quoted context omitted.
Cooldowns are passing the buck. These are all caught with security scanning tools, and AI is probably going to be better at this than people going forward, so just turn on the cooldowns server-side. Package updates go into a "quarantine" queue until they are scanned. Only after scanning do they go live.
"Just" is doing a lot of work; most ecosystems are not set up or equipped to do this kind of server-side queuing in 2026. That's not to say that we shouldn't do this, but nobody has committed the value (in monetary and engineering terms) to realizing it. Perhaps someone should. By contrast, a client-side cooldown doesn't require very much ecosystem or index coordination.
This kind of thinking is why I don't trust the security of open source software. Industry standard security practices don't get implemented because no one is being paid to actually care and they are disconnected from the users due to not making income from them.
Earlier quoted context omitted.
> I don't understand how this solves the issue in this case. I'd say since it is a local only tool, you don't really need to update it constantly provided you are a sane person that don't use a browser extension. It makes it easier to audit and yourself less at risk of having your tool compromised. It doesn't have to be keypass though, it can be any local password management tool like pass[1] or its guis or simply a…
Why are browser extensions not sane in your opinion?
Earlier quoted context omitted.
My approach is that for critical sites like banking, I use the site URL stored in the password manager too, I don't navigate via any link clicking. I personally am fine with thinking when my entire net worth is potentially at stake.
It's not only about how you get there, but that the autofill shows/doesn't show, which is the true indicator (beyond the URL) if you're in the right place or not. Rouge browser extensions for example could redirect you away from the bank website (if the bank website has poor security) when you go there, so even if you use the URL from the password manager, if you don't use the autofill feature, you can still get phis…
Earlier quoted context omitted.
Why would you patch a security vuln in a later version? Should be patched in all versions.. that's what semver is for.
A patch updates is a newer version, and they are just as likely to be compromised by supply chain attacks as minor or major updates.
Security patches aren't like bugs or features where you can just roll a new version. Often patches need to be backported to older versions allowing software and libraries to be "upgraded" in place with no other change introduced.
Say you had software that controlled the careful mix of chemicals introduced into a municipal water supply. You just don't move from version 1.4 to 3.2, you fix 1.4 in place.
Earlier quoted context omitted.
Rust and Cargo are, if not inseparable, at least tightly connected. Rust and Rust's stdlib are inseparable. Cargo is modeled after NPM. It works more or less identically, and makes adding thousands of transient dependencies effortless, just like NPM. Rust's stdlib is pretty anemic. It's significantly smaller than node's. These are decisions made by the bodies governing Rust. It has predictable results.
ohh noo, the devs gave users a choice instead of forcing their hand..
Earlier quoted context omitted.
Can someone explain why people struggle with CORS? The full strength of the SOP applies by default. CORS is an in security feature that relaxes the SOP. Unless you need to relax the SOP, you shouldn't be enabling CORS, meaning you shouldn't be sending an Access-Control-Allow-Origin header at all. If your front-end at www.example.com makes calls to api.example.com, then it's simple enough to just add www.example.com t…
That simple prod example isn't where people struggle with CORS. It's during development and I've got assets on Cloudflare and AWS and GCP and localhost:3000 and localhost:8000, and localhost:3001 and then a VM in Hetner at API.example.com because why not, that shit gets complicated and people get confused and lost. I mean, yeah, don't do that, but CORS gets complicated once the project gets enough teams involved.
So I do local dev on https://local.qa.yourappnamehere.com
Earlier quoted context omitted.
I use a separate dev user account (on macOS) for package installations, VSCode extensions, coding agents and various other developer activities. I know it's far from watertight (and it's useless if you're working with bitwarden itself), but I hope it blocks the low hanging fruit sort of attacks.
Check your home folder permissions on macos, last time I checked mine were world readable (until I changed them). I was very surprised by it, and only noticed when adding an new user account for my wife.
I think this is a bad idea, because it means the permissions of any new folders have to be closely guarded, which is easy to forget.
Earlier quoted context omitted.
You don't use a browser extension if you are serious about security anyway.
You do use the browser extension because it's a strong anti-phishing defense. If someone links me to "rnicrosoft.com" with a perfectly cloned login page, my eyes might not notice that it's a phishing link, but my browser extension will refuse to autofill, and that will cause me to notice. Phishing is one of the most common attacks, and also one of the easiest to fall for, so I think using the browser extension is on-…
Sure there may be existence of typosquatting here and there but they tend to be much easier to spot vs the phising url using unicode variants.
Earlier quoted context omitted.
Better for the cool down to be managed guaranteed centrally by the package forge rather than ad-hoc by each individual client.
That’s tricky, sometimes you really need the new version to be available right away.