Readit News logoReadit News
GVRV commented on Tell HN: Announcing tomhow as a public moderator    · Posted by u/dang
GVRV · 9 months ago
Congratulations Tom!

Tom (and Fenn) had rockstar status back when I was involved in university CS+Entrepreneurship clubs in Melbourne around 2009/2010 (mostly led by fine students at UniMelb, but I was helping spread the word at Monash) because they were the first(maybe one of the first?) Aussies to be accepted by YC. They always generously gave their time and advice at these student events, even dropped by the SiliconBeach networking meets to share their experiences and turned out to be exceptionally kind human beings in person. Definitely the right choice for moding this community!

GVRV commented on Laid off for the first time in my career, and twice in one year   dillonshook.com/laid-off/... · Posted by u/luu
OnionBlender · a year ago
How are people searching for programming jobs? LinkedIn is garbage because it keeps showing jobs that don't even contain the word I searched for. I go directly to the big company's career pages, but it is hard to discover new jobs or new companies.
GVRV · a year ago
I miss StackOverflow jobs – it showed that jobs were probably published there because someone technical advocated for the platform.
GVRV commented on Procrastination and the fear of not being good enough   swapnilchauhan.com/blog/p... · Posted by u/swapxstar
GVRV · a year ago
Just like the author, I wanted to read and write more. As I'm taking a year long sabbatical, I just started writing (badly) at https://www.gaurav.io/blog/. The idea is to write a post every weekday (excuse the last 2 weeks – it was Diwali) even if I think it's a terrible post. The value is in getting the post published, not publishing something great, at least for now.

I'm doing something similar with reading – 50 pages minimum everyday. I've read more books in the last 4 months than in the last 4 years by just keeping the streak alive.

GVRV commented on Gaining access to anyones Arc browser without them even visiting a website   kibty.town/blog/arc/... · Posted by u/xyzeva
kfarr · a year ago
Unclear if they had these rules in place already but I'm curious... If the rule permits writing when the userid matches, presumably there is nothing stopping the write operation to change the userid value, to your point.

Which then leads me to the next question, what is the practical way to write rules against that operation?

GVRV · a year ago
In my limited experience, I've seen it handled by adding the user's ID in the path of any resource that belongs to a particular user, so that the user ID from the resource path can be compared with the authenticated user ID as a security rule condition.

But as expected, you can validate the incoming data as well https://firebase.google.com/docs/firestore/security/rules-co... but this would need to be done for any attribute that might lead to a change of ownership.

GVRV commented on Gaining access to anyones Arc browser without them even visiting a website   kibty.town/blog/arc/... · Posted by u/xyzeva
kfarr · a year ago
Agreed, if I understand correctly the fix to this issue would be the following rules inside of a "match" statement in firestore.rules which is plainly documented as firebase firestore security 101:

```

// Allow create new object if user is authenticated

allow create: if request.auth != null;

// Allow update or delete document if user is owner of document

allow update, delete: if request.auth.uid == resource.data.ownerUID

```

GVRV · a year ago
Didn't they already have these rules in place? And the vulnerability was when the owner was updating the resource to have a new owner?
GVRV commented on Laravel has raised a $57M Series A in partnership with Accel   twitter.com/taylorotwell/... · Posted by u/davidgomes
GVRV · a year ago
Congrats to the Laravel team, and Accel too! I feel they've got a winner on their hands.

Laravel has single handedly made PHP development cool again, and the way they did that was offering an integrated developer experience focused on ease of starting and quick productivity.

They flattened the learning curve of other "full" frameworks (like Django/Rails) by offering recommended (and official) tools and services out of the box. This cuts down a lot of the analysis paralysis faced by junior developers and they have an easy way to start adopting necessary complex tooling when it becomes relevant for them.

Have a look at the `Ecosystem` mentioned at https://laravel.com/ – Django doesn't have an official local development GUI or Rails doesn't have an official APM – which is a boon for power users that know how they want to setup their local development environment or what they want in an APM service, but they're exhaustingly complex choices for a web developer just getting started.

I've observed Laravel gain a tremendous following with developers here in India, I believe because of this ease of getting started and being productive quickly.

I don't even feel like the funding amount is ridiculous. For comparison, have a look at some of the funding raised by smaller frameworks/libraries (CMSes, "JAM Stack", etc) without such an extensive set of revenue making services, in the JS world.

If they continue to pour the money on expanding their ecosystem while staying true to their value proposition to developers, they will do great. I, for one, am looking forward to this next generation of PHP/Laravel-powered web (maybe even mobile with this funding?) products.

GVRV commented on NASA investigation finds Boeing hindering Americans' return to moon   flyingmag.com/modern/nasa... · Posted by u/hobermallow
dandellion · a year ago
If anyone else is curious this article has close-up photos of the joints: https://arstechnica.com/science/2013/04/how-nasa-brought-the...
GVRV · a year ago
Can someone please explain why this is a high quality welding job? In India, welders are not paid handsomely and are rarely rigorously trained but I'm unable to distinguish between a welding job done by them compared to these photos.
GVRV commented on Ask HN: Alternatives to Gumroad for "software licenses"?    · Posted by u/grodriguez100
GVRV · 2 years ago
Long term HN user @ezekg also runs this https://keygen.sh/ if that might suit your needs (i.e. if you want to separate out licensing logic from the payment logic)
GVRV commented on Tell HN: Merry Christmas    · Posted by u/LorenDB
linsomniac · 2 years ago
May your pagers be silent.
GVRV · 2 years ago
I work for a globally remote organisation, so I voluntarily took the on-call rota for the last week of the year. This way, my colleagues can enjoy Xmas with their families without any pager anxiety, and they made sure I could have the same experience this past month over Diwali ;)

u/GVRV

KarmaCake day2674April 15, 2009
About
Keyboard masher.

We should be friends!

gaurav AT dadhania.in

@GVRV // https://www.gaurav.io

View Original