katelynsills

Joined 13 years ago

Karma

145

Submissions

34

Member since

Feb 25

"a bizarre mish-mash of hippie anarchism and economic liberalism beefed up with lots of technological determinism"

Software Engineer @agoric

View on Hacker News

Recent submissions

Comment · 10 days ago

Very cool! I did something similar for the Stanford Hackathon in April: https://bsky.app/profile/katelynsills.com/post/3mjdtm27jvc2j

Comment · 1 year ago

Yes, I know. You don't need to tell me that.

Comment · 1 year ago

I suspect this is related to what Nikhil Rajpal was doing at NOAA. He was originally reported to be asking about Google sites. https://www.wired.com/story/doge-engineer-noaa-data-google-m...

@nikrdc, if this is you, why are you doing something so destructive and stupid?

Preventing Reentrancy Attacks in Smart Contracts medium.com

3 katelynsills 7 years ago 0 comments

Comment · 8 years ago

Sorry, [1] should be https://github.com/tc39/proposal-realms

Comment · 8 years ago

This is a really good question. You would want to ensure that the templating library cannot get access to the http request library unless the templating library is explicitly given a reference to it. So even though both libraries are imported, they can't access each other by default. Realms (the standards track proposal [1]) lets you do this, and Salesforce uses it right now as the security kernel that ensures that their third party apps can't view or mess with other apps [2].

The best way to enforce POLA, and especially this particular problem of not allowing libraries to have access to each other, is object capabilities (ocaps) [3]. An object capability combines designation with authority -- if you have access to a capability, you can use it. If you don't have access, you can't use it. You can think of this (very roughly) as a key to a car as opposed to your name being on a guest list for a party. I didn't really touch on ocaps in this piece, but it's a necessary component for being able to enforce POLA well.

[1] https://developers.google.com/caja/

[2] https://www.youtube.com/watch?v=3ME7oHHQbuM

[3] http://habitatchronicles.com/2017/05/what-are-capabilities/

POLA Would Have Prevented the Event-Stream Incident medium.com

38 katelynsills 8 years ago 10 comments

Comment · 9 years ago

Great list! I noticed Tastypie wasn't included. I've really liked it, but are there reasons I shouldn't be using it?

Comment · 9 years ago

Thanks for the book recommendation! Just bought it. Agreed that smart contracts and technology in general could be used to reduce transaction costs.

Comment · 9 years ago

I wasn't until this week, so apparently I'm projecting just the right amount of knowledge :D Thanks for the link! I've been looking for opportunities to learn more.

Comment · 9 years ago

This is really interesting. I've lately become more curious about theories of transaction costs - how traditional firms might have an advantage because they don't have to bargain over every decision and have understood lines of decision-making. I'm wondering if decentralized organizations might have a transaction cost problem.

Comment · 9 years ago

Comment · 9 years ago

Very cool! Thanks!

Comment · 9 years ago

Can you expand on your process for using TLA+ in web development?

Comment · 9 years ago

What kinds of libraries did you use to build this? I see you have a webpack bundle.