skysight-inc/HackerNews huggingface dataset:
TLDR: You can split the JWT into 3 parts and store them differently in cookies to keep the _payload_ accessible in JavaScript and make the _signature_ inaccessible from the web app.

In the following Stackoverflow thread (https://stackoverflow.com/a/60941643) I described a way to store a JWT in Cookies while keeping convenient to use payload from the Javascript stack (for instance to display the user name).

This is achieved by splitting the JWT in 3 parts (header, payload and signature) and storing it into 3 different Cookies which have different properties. The _header_ and _payload_ would be accessible from the web application while the _signature_ is configured with HttpOnly and therefore unaccessible from the web app. The inconvenient of this method is that you have to reconstruct/concat the 3 parts server side.

Disclaimer: it's actually an experiment which has for purpose to get the better of both world and it has not been tested from security standpoint.
Curious about your experience finding right CBD dose. I’ve dabbled and don’t have conclusive evidence that it helps. But maybe I’m taking way less than is ideal to notice an effect. Any insights to share?
as much as i hate the overhead of frameworks & all the tooling that is (seemingly) required for simple things nowadays, the analogy that is attempted to be made, doesn't really fit well. The author seems to have been too focused on writing a "classic analogy" that has it's own URL rather than writing a good & fitting one for the case he/she dislikes – and especially, putting real thought into the analogy to make it a really good one.
Also the foundation for MAUI, the native bindings for .NET are incomplete and broken. Back in the Xamarin days the promise was that "everything you can do natively you can do in .NET" - this hasn't been true for a long time. Most of the new frameworks, especially on the iOS side don't have a binding and Microsoft doesn't have a story for Swift based libraries at all
Thanks. Really. This attitude of "if it's not perfect in face of some ridiculous scenario, it's useless" is why people go full "one password for everything, hanging on my screen". Each time someone falls into one of these absurd usability hazards there's a risk you loose them for everything security-related. And when something bad happens security professionals go "oh, but it is YOUR fault" .. yeah, thanks for nothing.

Your job is to solve problems. In the real world. For real people. Start doing it.
You do NOT need a cookie banner to store a session ID or a JWT.
I am no JWT expert, but I have found them useful for APIs rather than web apps accessed from the browser.

If the user is expected to use a programming language and hit the API many times a second, then even a short expiration and moderate refresh really help (might fully authenticate every 5 mins, which could be thousands of requests for some APIs).
Short lived access token, and long lived refresh token.

Upon access token refresh and login, refresh token is also rotated.

Refresh token expiry is tens of days, access token some hours.

Their opinion is that this is enough security.

IMO refresh token is vulnerable being stored in localStorage, and relying on users logging in and/or triggering token refresh to rotate refresh token is not really that great.
There has been work to get ebiten running with tinygo, which will yield smaller and maybe faster wasm. Not sure about status, just try yourself with tinygo command instead of go.
Yeah, fair point, maybe could get some wins if serving assets from same domain, but probably should use a CDN for that on different domain
But again, what's the difference between that and just having a moderately-long access token if you'll still be handing out access tokens for the lifetime of the refresh token?
But now that they are heavily invested in Linux, it would be a good time to make them contribute.

I mean isn't this the exact same tactic they use with their as-a-service offerings all the time?
Kinda strange considering its movie that turned him away from making big movies. He hates the final version, was not allowed to the cutting room and the studio basically tried to make very different much more pop shorter vision with material Lynch shot.

I think there are still rumors about him having/making directors cut that could happen. That would surely be very dofferent movie.
The point OP makes that building distroless containers isn't hard is quite true. I put together a script (~350 lines) that uses multi-stage builds on Gentoo. It doesn't take much effort to match small alpine-based "official" containers. On top of that Gentoo provides excellent customisability. Things like nginx or php that have a huge amount of build options allow me building as small or as big ontainers as I need. My script also allows arbitrary combinations of packages so if you want a shell, a debugger, or whatever else you can easily add them in.

The point is it was a weekend experiment. It's by no mean ideal but it's absolutely functional and viable. With a starting investment of a half engineer-weeks it's affordable to pretty much any org.
Did you check out the clang vector extensions? And before "but that's not standard C!": in the C world, the interesting stuff happens outside the standard in language extensions, the standard is mostly irrelevant for real world code. What counts is what specific compilers have to offer.
Won't light heat things up by bouncing around anyway?
What is that referring to? All I get is baseball.
No it's a great idea
It's still a bit weird how there's no universal gold standard way to handle authentication with websites. JWT is the closest there is, and there are still enough open ends with it for there to be as many ways to implement it as there are developers.
The access tokens go everywhere, to all services and are much more likely to be accidentally leaked / misappropriated. Refresh tokens are only used when talking (infrequently) to the access token minting service, so the scope of use is much much narrower.
Bogodyne Metatechnics – Fine Purveyors of Lisp Machines
This post rings a bell for me. I fell in the same trap and saw teams falling in the trap that one might take Docker as a tool to do dependency management since it is very easy to use a FROM statement.

So the trap for me is: mixing up dependency management with Docker, which is just a wrapper for your runtime in 2023™ .

There are already tried and proven tools out there (Deb, rpm) which solve the dependency management problem. Better publish your artifacts as a package backed by a dependency manager and then use the managers tools to make an OCI image as a target.

Using docker images for dependency management does not work. Your FROM will explode with all the combinations you will have to keep in the registry (I.e. „I need nodejs with a C++ image library“)

Docker multistage builds on top seem to confuse people, and they mistake Docker as a CI system to copy artifacts between their multistage builds and maybe start implementing their own caching behavior.

Therefore I suggest to clearly separate the reaonbilities of Docker from a CI runner and from a dependency manager. Otherwise patch management or dependency resolution does not scale for multiple teams.
Do you think that the 20% productivity boost might be solely because you now just have one language to work with? That's what I'm thinking, and that's why I'm personally keen to learn and use Blazor instead of the usual JS frontend.

After looking around at the current popular solutions, I've yet to find something that is as ergonomic and productive as the .NET stack in regards to creating a web-based product. You have one of the most solid backend frameworks (ASP.NET) with lots of great tools like EF Core for ORM, SignalR for real-time, now Blazor for frontend, easy authentication and authorization, etc. That just makes everything so performant.

However, that is a very high level focused development path, while I feel Go is slightly lower level where you still have pointers and such. I see it as great for CLI apps and very specific server needs where you'd want great performance and CSP threading in combination with a very easy syntax for new developers, but I don't think that's a very common use case to be honest. Even though I love Go for its focus on simplicity, it just isn't the most suitable lang for high-level work, nor is it very suitable for low-level work at the same time.

Regarding your switch from C# to TS, I understand it made sense in the last couple of years. It simplified the stack via reducing language context switching, which can be a good productivity boost depending on your team and team size. However, if you would've tested Blazor today and found it would have satisfied your frontend needs, I actually think a full C# stack will be better than TypeScript to be honest, due to the better tooling and better runtime that exists for C# compared to Node.js/Bun/Deno. I still think TS is better in the frontend department than Blazor, but that's simply because JS/TS has been the only language for frontend in a long time. I hope Blazor will gain traction as a real alternative.
Adding `busybox` and `bashInteractive` to the container contents gives you enough of a comfortable environment to work in without losing too much space.
Electron is owned by Github which is owned by Microsoft tho. They also own npm and typescript. So Microsoft themselves has been moving away from native apps a long time so your main point is still valid.
> HTTPOnly cookies are safe from XSS attacks.

Not completely true - the attacker can not exfiltrate the token but they can still make malicious requests right there in the victim's browser via XSS.
And ovens.
Dry stone walling is also very common in the UK. It's a complex and now expensive skill, but a properly-built (this bit is key) wall will stay put for well over a hundred years because the rocks can shift a little rather then cracking the structure as temperatures change and water drains right out of them.

It's also very locally distinctive because the shape of the stones and therefore the wall layout and texture depends on the stones you naturally have nearby.

https://en.wikipedia.org/wiki/Dry_stone#/media/File%3ADry_st...
I was 100% sure, heck figuratively speaking I was even more certain that my very serious and slightly unconventional opinion will get me downvoted. You see, the world is dominated by imbeciles who feel threatened of anything that's not regurgitated platitude and the HN crowd apart from not being that statistically different from "the world" as much as they'd like to believe, it's also "trigger happy".

More or less I adhere to Neil deGrasse Tyson's opinion that plants are live beings too: https://www.youtube.com/watch?v=Fh_3gH7l6Dw

Intelligence and consciousness seem quite plausibly interrelated based on observed samples across the animal world, like there's more intelligent behavior displayed by magpies (who appear to pass the mirror test) than say crocodiles. And since with all it's flaws, we humans have the IQ scale to try quantify our species and within this IQ we observe that the high IQ seems to be generally more capable of intelligent behavior than the very low tail, I don't see why we couldn't use it as a rough extrapolator.

Why limit IQ scale to only humans and not extend it across animal world? Would it be a linear or log-scale (I'd bet on log). Having an universal scale would certainly require it re-imagined it at least to some degree since you can't ask a fish to solve systems of differential equations, at least not in Leibniz notation. What tests would apply universally? That's a good question not just comparing humans with crocodiles but even addressing the complaints that IQ tests tend to favor people who can access a formal education. Like an Amazon forest tribe or the Sentinelese surely have never taken formal school lessons but are very capable of intelligent behavior and statistics says some of them would be very smart. How do you measure that?

But nooo. Show the idiots a smart dilemma and them monkeys start throwing their feces at you (i.e. downvote).
Well, if you want to actually spend your ill gotten gains, you pretty much need it in fiat currency. I don't see the point you are making.
This is bizarre to me.

What applications are they actually using the framework for?

Is it because it's easier to make cross platform?

Reminds a bit of when i used Angular back in the day and it seemed Google of all people didn't use it for any of their many web services.
I'm not making any judgement calls here in terms of how things are _actually_ done, or what the _actual_ risk exposure is, but...

The design philosophy seems to be, use short-lived security credential A (the jwt) for all of your requests, which (again, _theoretically_) risks its exposure, and have a Security Credential B that you keep very secure, and use that to create new instances of Security Credential A.

If SC-A were a cookie and SC-B were kept in a hardware store, then I think this might be logical, but where they're both basically cookies, it seems kind of crazy to me, too. Maybe there are some details in how the actual storage of the cookies varies, but I think it's Hopium all the way down.
> for the lifetime of the refresh token

Not guaranteed for the lifetime of refresh tokens, which is the case for access tokens.

> whats the difference?

A 5 min access token is valid for 5 minutes. A 5 minute refresh token can be revoked before its even used.
So if I get this correctly, this is mostly useful for microservices and would be kinda pointless for a monolithic architecture?
Cryptocurrency (abbreviated 'crypto') is made possible by cryptography (also abbreviated 'crypto', but few call it that nowadays). Cryptography is from the Greek for secret because it involves doing various things with 'secret keys'. What you use it for may or may not involve secrecy - here are just a few of the most prominent examples:

- Authentication to prove your identity (no secrecy)

- Encryption to keep information private except to certain keyholders (secrecy)

- Signing to prove that information is as originally published (no secrecy)
Bayonet charges were done with magazine fed rifles in WW2 and the Korean war.
"This would make functions second-class. [...] Is that really much of a loss?" Yes! A huge loss. The cons of live programming don't even come close to outweighing the pros. You can always fallback to edit-compile-restart if you need to.
PASETO?
I agree so much. The new dune is expertly made but it washed of so much of the trippy stuff from books. Even the aesthetics are playing it on the very safe side.

Then again this is the directors style. It would be probably end up worse if they would bend too much out of their comfort zone.
few months ago I tried to wrap up a MAUI PoC app from a more junior coworker, who failed to deliver anything working after weeks of trying.

Then I spent two weeks on trivial shit and stuff you expect to work by default (pull to refresh, video streaming, video in list view etc.)

After two weeks of stress, failure and dozen of known issues on GitHub with tons of frustrated developers [1], I rewrote the whole poc in flutter in 3 days.

Keep in mind this was a simple app with two screens and sign in/sign up - the only thing mildly technicall was a list view with videos (video feed).

Literally nothing in MAUI worked as advertised and their showoff apps are ridiculous. The build process takes forever and breaks randomly, iteration is slow and debugging breaks all the time.

This is the exact same experience I've had with Xamarin 5-6 years ago.

Any imaginary gain you think you'll have by being able to share code between client and server will be offset many times by having a sane/working dev environment like flutter (working framework, fast iteration) and the language isn't that far off from c#.

[1] https://github.com/dotnet/maui/issues/8926#issuecomment-1563...
Don't they also have BRA - BRanch Always, PHX PHY PLX PLY - PusH or PulL X or Y register, STZ - STore Zero, TRB - Test and Reset Bits, TSB - Test and Set Bits?
Another comment mentioned it, but:

1. You can check for user changes when the refresh token is used and a new access token is requested (user deleted, permissions changed, access revoked)

2. Refreshes can go to a different endpoint, whereas access tokens could be used with services that don’t even have access to user auth services.

Edit: There is something to be said for ditching the refresh token and just re-authenticating when the access token expires. The benefit is that you don’t need to store the username/password in the client code to re-auth, and you might avoid some relatively expensive password checking on the server, but that is probably pretty minor.
> "It seems to me that this is the end for Microsoft's mobile team. They do not fix own bugs, they do not respond to the tickets, the even do not review PRs made a year ago"

That's always been the case with all of their frameworks.

Even if the entire userbase is spitting fire the default position is to double down on whatever stupid thing they're doing or ignoring it. Only time I ever got anything fixed was when I was working for an MS partner and we threatened to become an Oracle partner.

Then again the OSS community is only slightly better and Apple is definitely worse!
i really don’t understand how the article assumes jwt s are not stored in http only cookies. Jwts are an encoding method you can use them to implement a wide array of usecase and if they are used for sessions of course the security best practices for session cookies have to be met, that has nothing to do with jwts except that they require special thought compared to server side sessions when it comes to things like invalidation.
There always that person on Windows shops. :)
I guess you could have a centralized removeable unit that costs a fuck ton to replace and jacks your insurance rate up once it auto-alerts them when you've removed it. If you can prove exigent circumstances than its replaced for a smaller cost or free and your rates are ok but I don't see what insurance company is ever gonna be sitting pretty knowing you now have a history of removing the anti-drunk-driving enforcement mechanism and that you must have logically been dabbling or moonlighting in drunk driving :/
What? A multibilion corporation does not listen to user feedback on GitHub? That's so crazy and unusual. Take some lessons from Google here, when users complained on quality of software and bugs in it, Google just archived OSS repos and moved development to private repo. Opensource and issues on repos are close to worthless (sometimes somebody else in comments will find a solution or work on a fork, but that's it), might as well be not available at all.
I think most people the US and europe have switched over to chinese manufacturers like jlcpcb or similar for small batch-size PCBs, since they're cheaper and more user friendly. I would've expected them to ship to most of the world, is that not the case?
Quantum AI is a crypto trading platform that claims to use AI and quantum computing to generate high profits. But is it a scam or a legit app? Read this article to find out the truth.
Yeah avoid all ms made UI libraries
Life expectancy can increase up to 10 years by shifting towards healthier diets
Let me use a metaphor. You don't fix a leaking boat by pouring out water while sailing. You rather bring it ashore and repair the holes.
I might be wrong about it, but my understanding is as follows:

You're getting refresh token using credentials (e.g. login/password). Refresh token is long-lived and basically allows you to use service without typing login/password every 5 minutes. How much refresh token should live depends on your security requirements to how long user can user your service without typing his password.

You're getting access token using refresh token. This allows server to check whether you've been banned or something like that. If you encode access permissions into access token, it also allows to adjust those permissions. So your access token lifetime is a balance between performance and security.

If your API already uses some kind of service key, then refresh token does not make much sense (may be it does to provide uniform implementation for web clients and service clients, but not from security perspective).

My opinion is that all those things are more complicated than necessary. You could use the same token both for access and refresh purposes (if token is outdated, check it using database and return new token, then client will use new token for subsequent requests).
Yeah, I'm not sure if I fully agree with the method here either - it feels like it was helped by law enforcement a bit too much.

But I did want to make a point about why such paragraph exists and why it's not acceptable for EU to delegate CA policing to non-governmental industry bodies.
The preference for non-copyleft licenses and SaaS kind of makes their point.

It is no surprise that none of new FOSS OSes for IoT use the GPL, including Zephyr, ironically hosted by the Linux Foundation.
According to the article:

To make this palatable to the American public, those whistleblower rewards are not courtesy of the taxpayer; they’re courtesy of money seized from previous Bond villains. A portion of Binance’s settlement(s) will go to pay the whistleblowers at the next Bond villain. It’s a circle of life.
> Your users and counterparties understand it to be a lie the entire time, of course.

I'm not sure users feel that way. Maybe users just believe they live in a free world and do nothing wrong by buying $100 USD of Solana or Shiba coins.

The evil, evil, evil person, outside of government's reach, who sneakily installed the crypto.com app (oh, the horror!): surely he needs to be send to some re-education camp to be taught the merits of the state and why we need less options and more state?

> We are a nation of laws. I’d support reforming some of them; a lot of the AML/KYC regulatory apparatus harms individuals who have done no wrong

Yup. It is insane. It is the bane of my existence. I'm not a drug dealer, I'm not selling firearms, I'm not kidnapping kids to sell their organs, I'm not funding terrorism. Leave me the FUCK alone.

> However, in the interim, one cannot simply gleefully ignore the laws because the opportunity to do so allows you to become wealthy beyond the dreams of avarice.

But is it unthinkable, for state lovers, to imagine a world where people would be free to decide if they buy or not cryptocurrencies?

I know it's a very ugly word: freedom. But shouldn't people have more of it and not less?
> so all it takes is a little injected script

If you can inject javascript, it's game over anyway.

> HTTPOnly cookies are safe from XSS attacks.

No, you can still do pretty much anything that cookie enables you to do. You just can't get the actual cookie string.
“Your IP has been blocked”. I’m using Apple’s private relay
Are you claiming that production isn't being moved to cheaper labor countries all the time? Also small businesses, though usually through buyouts by bigger companies. Very small companies, which are essentially self-employment (and thus worker owned) not so much.

Yes, the legal framework of liberalism typically does allow for a wide variety of contractual associations. Some are more conducive to capitalism, i.e. extracting profits from work (typically by others) by the sole virtue of ownership.
Wouldn't SameSite=Lax work just as well to prevent CSRF? It prevents things like malicious forms and image links from other sites.
Also turbo charged engines can greatly benefit from running idle for a minute. I learned the hard way. (Had to replace the turbo.)
Not even necessarily microservers. If you want a common authentication system used by lots of disparate services, token based Auth is a reasonable approach.

If you've just got one service endpoint, it doesn't buy you very much. Just mint a session token and be done with it.