anulman
Joined 17 years ago
Karma
203
Submissions
70
Member since
Feb 17
Recent submissions
Comment · 8 months ago
Author here; live demos within.
The core issue: Stripe's Payment Intent pattern (server gets token → passes to client → client opens iframe) is safe because the blast radius is bounded; worst case, someone pays your invoice. But the same pattern applied to admin embeds (payroll, HR, financial controls) means a single XSS or compromised npm dependency can exfiltrate full admin access.
The fix I'm proposing (RequestRequest) routes every iframe API call through the host page for server-side JWT signing. The iframe never holds a persistent credential. There are three interactive demos in the post, including a real race condition demo against a Durable Object.
I disclosed this to two vendors in Jan 2024. Both classified it as informational. Neither has changed their architecture.
Comment · 7 years ago
Hi HN! Reddit has been a promising source of early users for us at chef Connie; for example a single response on a post with lift can easily generate 10+ signups, most of whom finish activation.
We didn't want to miss out on any action—showing up late to the conversation really dampens results!—so we whipped up a microservice to notify us of relevant posts.
Enough friends and founders have asked us to share; thought I would post it here to help you improve your startup or project's odds of success :)
Hope you like it! How can we make this easier to install, or better fit your inbound marketing practices?
Comment · 10 years ago
Fun fact: the "disconnected mini-graphs" the author mentions toward the end could also be attributed to Clinton being included via cc / bcc.
Source: I've built & reviewed email graphs from IMAP & POP dumps too
Comment · 10 years ago
Notably, the bit.ly link directs you to Facebook.
Nice play, FB Video team.
Comment · 11 years ago
You're likely right, but they could always get crafty with Braintree APIs: https://developers.braintreepayments.com/ios+ruby/reference/...
Comment · 11 years ago
Not sure they would either, though perhaps a use case for git_commit_amend [1]?
Regardless, sounds fairly implementation-specific. Think I just followed you on Twitter, happy to discuss further offline.
[1] https://libgit2.github.com/libgit2/#HEAD/group/commit/git_co...
Comment · 11 years ago
Did you consider leveraging the refdb to offer immutable primary keys?
I had been hacking together a Kyoto Tycoon-backed implementation for a project (since dropped); our design exposed the ref id to the user (e.g. 'master', 'master/mhodgson', etc) and branch/merge as necessary. This way, our primary keys remained a constant refName that pointed to the HEAD of a commit chain, each of which referenced immutable commits/trees/blobjects.
Although my days of libgit2 hacking are long past, I'm very curious if/how our design could have been improved; immutable pkeys were important for us as well.
Github: https://github.com/anulman/libgit2/tree/kyoto/src/backends/k...
Comment · 11 years ago
Comment · 13 years ago
Definitely understand the concern—I set the minimum permissions, but obviously friends list is among them. All the code looks for is user_id; I'm not even storing the access_token generated.
This will be clearer as the readme shapes up, but it's for a private messaging repository, accessible only to folks whose user ID you save in a Redis hash.
For example, assume authed_user_ids = {1: '', 2: ''}. If, after authenticating with Facebook, we determine your user_id is 1, today's date gets stored as your value (authed_user_ids = {1: 'DATE', 2: ''}). The card will then open with Day 0's message, and will display a new one for every subsequent day until the sequence has expired (you will need to auth every time, as the only session variable stored is the OAuth nonce).
If Facebook returns with user_id = 3, the card will open and display some generic "no message for you" content.
Comment · 13 years ago
+1.
If you want to see the sexy CSS3 animations + whatnot, the callback's at http://probablythemostromanticthingever.com/open
Recent work includes:
- Jam.dev Recording Links (magic links you can send users to record their screens and receive full bug report details, incl network and console logs) - Nmbr Embedded Payroll (built the components suite, to embed a fully-featured payroll suite into any SaaS app in < 15 mins) - Mighty Productivity (suite of tools in Mighty's browser-in-the-cloud to supercharge the internet and make you more productive)
Personal email: [email protected]