8organicbits
Joined 6 years ago
Karma
7,238
Submissions
2,219
Member since
Jun 10
Recent submissions
Comment · 21 hours ago
I think this is a clever happy path solution, but it isn't very defensive against problems. If the cloud cron doesn't fire on time or the consumer fails then the queue won't be drained in time. That will cause the events to be batched in the wrong hour.
I don't see how you are building the batches, but there's a lot of complexity around batch sizes, acknowledging that the messages were consumed, etc. Having a single dataset.json.gz per hour feels like a hint this isn't done safely. I'd double check that carefully to avoid losing data.
One tip about compression, I've been really pleased with zstd compression of json/jsonl data.
Comment · 3 days ago
This looks clever. I've seen PPT to web tools before (https://sparkslides.com/publish/, https://slidehtml5.com/), but I think the slide synchronization idea is new. I can't evaluate more than that as I don't use these.
In the past I have liked marp (https://marp.app/) for technical slides as you write in markdown, can use version control, etc. Powerpoint always felt odd as a developer.
To share public slides I've published to GitHub pages (https://github.com/robalexdev/marp-to-pages). I've seen professors use it for all their slides. But that doesn't synchronize slides, last I checked.
Comment · 5 days ago
Correct, this is a very specific attack where an attacker can generate UUIDv5 collisions but cannot force a collision of a chosen UUID. If your usage doesn't serve any security functions then its fine to use an insecure hash function.
One thing I find interesting is that we seem to be at the end of the road for secure hash-based UUIDs. SHA-1 was already truncated (I.E. weakened) from 160 bits to 122 bits to fit the UUID width. To fit a SHA-256 hash you'd need to throw away a majority of the bits!
Comment · 6 days ago
I remember seeing a request to add nip.io to the PSL (they don't approve requests where the subdomains are IP addresses). What do you think the future of these sorts of services are now that Let's Encrypt offers free IP certificates?
Comment · 6 days ago
The cookie use case is just one use case. Another PSL use case is helping browsers decide what part of the FQDN is most important for the user to notice. On firefox I see "ycombinator.com" in bold, with normal font weight on the news subdomain. On smaller screens the URL bar isn't left aligned, it adjusts the view to prioritize showing the relevant domain name. You don't want an attacker to control how the URL is displayed in that security context.
Comment · 7 days ago
One of the complications that gets discussed is that there are way too many use cases with different requirements on what it means for domains to be related. The cookie problem is something browsers need to solve, so its perhaps reasonable that Mozilla (and volunteers) manage a list that focuses on that user case. But that's poorly suited for other use cases.
There's a lot of people thinking about this though. One somewhat related example is https://datatracker.ietf.org/doc/draft-manelidis-dnsop-domai..., which has a double-opt-in DNS TXT record mechanism. That draft and forthcoming discussions on the mailing list are a good place to understand the complexities here.
Comment · 7 days ago
I've used FreeDNS on occasion for test domain names, one-off experiments, and similar. I'm very appreciative this exists, but there are some pain points that similar services handle better.
The domains are missing from the public suffix list. This impacts how cookies are handled by the domain names, with concerns the browser will allow software to set the cookie on the shared domain name instead of the subdomain. This can be a security problem. Getting added to the PSL may not happen: https://github.com/publicsuffix/list/pull/79
It can be difficult to get a free HTTPS certificate for your subdomain. Let's Encrypt applies per-domain name rate limits and these domain names see lots of issuance requests. There's a process to lift those limits, but last I checked FreeDNS didn't use it. You can still, of course, pay for a certificate.
There's tons of abuse on free domains so you may find that your domain is blocked on various lists.
Here are some compelling alternatives I use now, which manage these issues better:
- https://messwithdns.net/ - Exceptionally well-made DNS console for learning DNS
- https://open-domains.com/ - Uses Cloudflare, great Discord group
- Even more: https://free.hrsn.dev/#/?id=domains
Comment · 8 days ago
Hey author here, thanks for reading the post. I haven't seen UUIDv5 used very often but I'll have to think about the idempotency angle more.
One thing that concerns me is that UUIDv5 is based on SHA1, which is an insecure hashing algorithm. I generated a pair of colliding UUIDv5s in an earlier post in this series (https://alexsci.com/blog/uuid-oops/#insecure-hash-functions). So I don't think you can use UUIDv5 for security critical functions.
Comment · 1 month ago
This is a really good time to do a head-to-head comparison of different search engines. The last time I checked Google does not provide search results above the fold, instead showing AI overview, ads, and YouTube search results. Try a different search engine to see which one is giving you the highest signal results and what other junk they put on the page. Personally I use duckduckgo with AI turned off in settings, but it's best to try the experiment for yourself.
Comment · 1 month ago
One concern about accuracy of the diagrams. In the example, there is a transition back to the session service labelled "wait for release" after the "no" decision. I'm not seeing that in the shown diff.
Looking at the code the "no" seems to relate to the context expiring, so you wouldn't want to wait more if the context already expired, you'd want to stop. Is there a reason that label exists?
I'm pretty wary of LLM development tools hallucinating and wasting my time, is that whats happening in the lease broker example?
Comment · 1 month ago
The Kanopy model is fascinating. Library members get free views but there are limits as the library has to pay for those views. Our county library system has a Kanopy subscription at each library and county residents are eligible to become members at every location. Kanopy supports adding multiple library cards, so you can boost your limit.
Comment · 1 month ago
The platform is quite open, so you can build whichever tests you want. Personally I run a dockerized ooni via scheduled GitHub actions, which shows blocks impacting GitHub runners. You should be able to see logs from that here, which shows three blocked websites https://github.com/robalexdev/ooni-unattended-action/actions...
You can build your own lists and share them using ooni run: https://run.ooni.org/
Comment · 1 month ago
Many of the partners are country focused but the Tor Project, Citizen Lab, and Internet Society are well known to me.
Comment · 1 month ago
For some of that, you don't need to crawl. Wikipedia offers database dumps which you can download in one go. Lots of programming docs are managed in repos, so you can clone the repo instead. Even stackoverflow seems to have a snapshot dump (https://archive.org/details/stackexchange).
I blog at https://alexsci.com/blog/
I socialize on Mastodon at https://indieweb.social/@robalex
Email is a great way to reach me, if our interests align, reach out at robert [at] robalexdev (dot) com
I do freelance DevSecOps at https://foxloopsoftware.com/
Statements are my own and do not represent the positions or opinions of my employer/client.