Readit News logoReadit News
Tomuus commented on Deno Sandbox   deno.com/blog/introducing... · Posted by u/johnspurlock
ryanrasti · a month ago
> It doesn't prevent bad code from USING those secrets to do nasty things, but it does at least make it impossible for them to steal the secret permanently.

Agreed, and this points to two deeper issues: 1. Fine-grained data access (e.g., sandboxed code can only issue SQL queries scoped to particular tenants) 2. Policy enforced on data (e.g., sandboxed code shouldn't be able to send PII even to APIs it has access to)

Object-capabilities can help directly with both #1 and #2.

I've been working on this problem -- happy to discuss if anyone is interested in the approach.

Tomuus · a month ago
Object capabilities, like capnweb/capnproto?
Tomuus commented on RCE Vulnerability in React and Next.js   github.com/vercel/next.js... · Posted by u/rayhaanj
z3ratul163071 · 3 months ago
there can be no React RCE. if it is on the frontend, it is a browser RCE. if it is on the backend, then, as in this case it is a Next.js RCE.
Tomuus · 3 months ago
The vulnerable code exists inside of the React Flight wire protocol that is used by Next.js but also Vite, Parcel, Waku and any other custom RSC implementation that exists. Your comment was accurate circa 2019 but not since React released server components.
Tomuus commented on RCE Vulnerability in React and Next.js   github.com/vercel/next.js... · Posted by u/rayhaanj
cowsandmilk · 3 months ago
Tomuus · 3 months ago
This POC is not realistic and doesn't work against production builds of Next.js. It requires explicit exposure of gadgets by the user (eg. vm.runInContext) so is invalid as noted on https://react2shell.com
Tomuus commented on Critical RCE Vulnerabilities in React and Next.js   wiz.io/blog/critical-vuln... · Posted by u/gonepivoting
tinco · 3 months ago
Unsafe deserialization is a very 2010 Ruby on Rails sort of vulnerability. It is strangely interesting that such a vulnerability was introduced so late in the lifetime of these frameworks. It must be a very sneaky vulnerability given how cautious we have become around deserialization since then.
Tomuus · 3 months ago
The React Server Components wire format (Flight) is relatively novel and very new (it has existed in React stable for just a year). This is not a simple JSON parsing bug.
Tomuus commented on Where it's at://   overreacted.io/where-its-... · Posted by u/steveklabnik
angerson · 5 months ago
This is a nice write-up. I recently added post-to-bluesky support to my ongoing social-media-scheduler project [1], thinking it would be the simplest of the services to work on, but I ended up getting really confused instead.

DID and handle resolution was the easiest part of ATProto---as the author says, a library can do the job easily. For Ruby it's DIDKit [2]. Where ATProto really threw me was the seeming non-ownership of record types. Bluesky uses "app.bsky.feed.post" for its records, as seen in the article; there seem to be a lot of these record types, but there doesn't seem to be a central index of these like there are for DIDs, or a standard way of documenting them... and as far as I've been able to find, there's no standard method of turning an at:// URI into an http:// URL.

When my app makes a post on behalf of a user, Bluesky only sends an at:// URI back, which I have to convert myself into an http:// URL to Bluesky. I can only do that with string manipulation, and only because I know, externally, what format the URL should be in. There's no canonical resolution.

[1]: https://toucanpost.com [2]: https://github.com/mackuba/didkit

Tomuus · 5 months ago
Record types are now "on protocol", you resolve them via a similar mechanism as in the article. https://atproto.com/specs/lexicon#lexicon-publication-and-re...
Tomuus commented on SpacetimeDB   spacetimedb.com/... · Posted by u/matthewfcarlson
anentropic · a year ago
Doesn't Snowflake do something similar though?
Tomuus · a year ago
And Vercel's "compute units"
Tomuus commented on Zigbee and Z-Wave are the best part of my smart home   arstechnica.com/gadgets/2... · Posted by u/mfiguiere
bhaney · 2 years ago
Apparently I'm one of the rare few people who fell on the WiFi side of the WiFi/Zigbee smart home war.

All of my lightbulbs, occupancy sensors, etc just connect directly to WiFi, and run custom firmware that I wrote so I know exactly what they're doing and how to control them. They make no attempt to access the wider Internet, but they're all on a vlan without Internet access anyway.

It feels like introducing Zigbee to this would just be an extra hub device taking up space, acting as an extra point of failure, and making it more complicated to develop against my devices. As it stands now I can easily manually control devices by piping crap into netcat if I need to for some reason, since they're all just normal IP networked devices. I think I would have to jump though extra hoops to do similar things with Zigbee.

Is the main aspect driving people to Zigbee just that off the shelf consumer smart devices that use WiFi tend to be annoying dogshit, and Zigbee keeps manufacturers in line better? I don't see any reliability or simplicity benefits to it, just the market poisoning WiFi and Zigbee being the only worthwhile alternative.

Tomuus · 2 years ago
ZigBee is a mesh network, this is very important in many situations eg. battery powered or large area
Tomuus commented on Bun v1.0.0   bun.sh/blog/bun-v1.0... · Posted by u/tuananh
vasergen · 3 years ago
I think the version is actually closer to `1.0.0-beta` than to `1.0.0`. I just installed v 1.0.0 and run `bun repl` and it failed with exit status code 1, it turns out the repl wants to use port 3000, which was used in my case already. There are probably a lot of other small things like that, look on reported bugs in github. So, I also should be 'skeptical' about all claims they did.

Nevertheless I am super impressed with their speed and exited with the result. Didn't expect this project to grow so quickly to this state, I though it will take them much more time. For comparison, deno was started way earlier and now they are miles behind (personal feeling). I am considering to use it for my pet projects

Tomuus · 3 years ago
1.0.0 means the API and semantics are stable, not that there are no bugs.
Tomuus commented on Internals of async / await in JavaScript   akashhamirwasia.com/blog/... · Posted by u/spacebuffer
roggenilsson · 3 years ago
You can also think of generators as a native implementation of Observables from rx (except you can't replay a generator), especially async generators.

You can implement basic operators like map, filter, take, etc. over generators to create pipelines of operations. Very neat abstraction to work with, but like rx, can quickly get hard to reason about.

Recently I wrote some tooling to read, do some operations, and write hundreds of thousands of files locally. Using generators solved having to think about not loading too much stuff into memory since it only yields files when consumed. Also allows you simply implement stuff like batching, like running X requests to a server at a time, and only starting the next batch once the first one is done.

Tomuus · 3 years ago
Observables and Generators (iterators) are fundamentally different. Observables are push-based (like a promise) whereas iterators are pull-based (like a function).

Glossing over this fact leads to a flawed understanding, not a deeper one.

Tomuus commented on Deno 1.27   deno.com/blog/v1.27... · Posted by u/Mikkel-T
nerdponx · 3 years ago
Maybe this is a weird question, but how does Deno compare to Node when it comes to the various "languages that compile to JS"? For example Purescript, Fable, Elm, etc. does everything mostly just work, or should one stick to Node for those?
Tomuus · 3 years ago
Things mostly just work. Remember Node.js is mostly APIs on top of JS the language. If those tools compile to JS in the browser, they can compile to Deno. Deno is a more stabdards-based runtime than Node, it's closer to how the browser works.

u/Tomuus

KarmaCake day46June 7, 2021View Original