kangabru (u/kangabru)

kangabru commented on Ask HN: Who wants to be hired? (July 2024) · Posted by u/whoishiring

kangabru · a year ago

Location: Hamburg, Germany

Remote: Remote/Hybrid/Office

Willing to relocate: No

Technologies: Typescript, Javascript, React, Node.js, Next.js, C#, Python, Django, Java, PostgresSQL, AWS, CSS, Tailwind

Résumé/CV: https://scottgibbs.me/resume

Email: Please see resume

Hey I'm Scotty - a full stack Software Engineer looking to work on exciting, challenging, and impactful products based in Europe. For the past few years I've been remote contracting for various US startups and have worked on products with millions of users. I like to work on all parts of the stack from creating rich interactive frontends, to wiring up an API layer, to working on data heavy backend processes. Check out my website to see examples of projects I've worked on. I'm an English native speaker who's recently moved to Europe and I’m looking to work with a larger team and on a more established product. If that sounds like you then please get in touch!

kangabru commented on We hacked Google A.I. landh.tech/blog/20240304-... · Posted by u/EvgeniyZh

vizzah · 2 years ago

yeah, sounds like a "weird" vulnerability assuming it comes from a malicious text payload someone must deliberately insert into the own chat.

Hard to fathom $20k prize for that, to us old-schoolers, used to at least expect exploit delivery from an innocently-looking link.

kangabru · 2 years ago

With all the hype around AI I'm sure people are trying out all sorts of products that could have vulnerabilities like this. For example, imagine a recruiter hooks up an AI product to auto-read their LinkedIn messages and evaluate candidates. An attacker would just have to contact them, get the AI to read something of theirs, and this prompt attack could expose private information about the recruiter and/or company. The attacker would just need the recruiter to view the image (or better yet, have the service prefetch the image) to expose the data.

kangabru commented on Over 100k Infected Repos Found on GitHub apiiro.com/blog/malicious... · Posted by u/gnabgib

kangabru · 2 years ago

I've been gradually improving my dev setup security over the past few months based on continuous reports like this. Here are things I'm trying out to improve my setup: - Use VSCode dev containers for development [1a]. Once you've created one once then they're quite easy to use and you don't need much Docker knowledge - it just needs to be installed. It's perfect for spinning up web/console apps but I had trouble with other stuff like Flutter and Electron. - Similarly I got familiar with GitHub Codespaces for smaller projects [1b]. I've done live coding in an interview before (where I had to modify a simple Node project) and I would absolutely use containers/codespaces for anything like that these days [2]. You can spin one up straight from any GitHub repo page and they're easy to work with. - Read the OWASP guidelines regularly for things like npm, Node, and Docker best practises. e.g. for Docker use the smallest image you can (Alpine) and use explicit Docker image tags [3]. - Review npm/python packages before installing them using socket.dev - it shows a full dependency security overview for things like env variable access, network calls, supply chain attacks, recent code ownership changes etc. You can also disable postinstall scripts globally as suggested by OWASP [4].

[1a] https://code.visualstudio.com/docs/devcontainers/create-dev-... [1b] https://github.com/codespaces [2] https://www.welivesecurity.com/en/eset-research/lazarus-luri... [3] https://cheatsheetseries.owasp.org/cheatsheets/NodeJS_Docker... [4] https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_...

kangabru commented on End of Life for Twilio Authy Desktop App help.twilio.com/articles/... · Posted by u/tempestn

polyvisual · 2 years ago

I use Authy. I've read a few comments about how migrating away is difficult. What do you use instead?

I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

kangabru · 2 years ago

I had the same problem and didn't want to keep all of my eggs in the same basket, plus I lost faith in these backup apps after Google Auth lost user codes at some point.

I decided to create a private backup which I control and so I built a client-side web app that encrypts QR codes (like 2FA codes). It was inspired by a similar CLI based project I saw here on HN. I still use Authy (for now) but now I have encrypted images that I can decrypt and rescan easily. And since they're just images I saved them in various places and even printed out copies should I lose my phone or Authy access.

To 'migrate' my codes out of Authy I just went through each site and regenerated the codes (plus encrypted them). It's annoying that they force you to do this but doesn't take too long.

I'm still polishing it up but it works well and I would love some feedback if there's anyone who finds it useful - https://encrypt-qr-codes.netlify.app/

kangabru commented on Tailwind CSS: From Side-Project Byproduct to Multi-Million Dollar Business adamwathan.me/tailwindcss... · Posted by u/adamwathan

_AzMoo · 5 years ago

See this is the thing that gets me though.

bg:white is exactly the problem. What if I want to change all my white backgrounds to #FCFCFC? I've got the option of going through and updating all my components individually or updating bg:white to be a non-white value.

kangabru · 5 years ago

Everything is generated through a config file which you can completely customise. So you could literally change the colour of bg-white if you wanted to.

It's part of the selling point, that config file becomes your design system. They provide a decent one but you are free to overhaul it as you see fit. It works really well.

kangabru commented on I recorded vlogs to show how I built side projects indielog.com/user/damon... · Posted by u/damechen

webosdude · 5 years ago

Yeah even I thought it would be concise demos or screen recordings of everyday progress but it’s just person talking. Is there a blog or Youtube channel which slowly builds a project which you can follow too?

kangabru · 5 years ago

I started doing something like that this month! I'm still finding my style but I code stuff, demo it, and explain how the code works.

I would love any constructive feedback if you want more content like this.

Here's today's vid - https://youtu.be/KI4Hv3uBjVY

kangabru commented on Svelte and TypeScript svelte.dev/blog/svelte-an... · Posted by u/kevinak

_zllx · 5 years ago

From what I can tell, Parcel v1 does not have linting, but I rely on linting and typechecking in my editor anyway, so I didn't notice. It's actually pretty handy to bypass typechecking and write untyped JS to quickly check if something will work then add types to it gradually. VS Code yells at me until I fix it, so it doesn't go unfixed.

https://parceljs.org/ is the homepage. Run the command (or put the command in an npm script) like `parcel whatever.ts` and it will output your bundle with all dependencies transpiled to JS and CSS. The simplicity does come at a cost; it's not as readily customizable as something like Rollup. I've been eagerly tracking v2 and it appears they are adding linting and much more into Parcel.

kangabru · 5 years ago

Yeah I had the same issue and have been following the Typescript thread on GH for a while now [1]. But I agree, I actually like using untyped JS for development.

What I do now is throw a "tsc --noEmit" call before tests/prod build to type everything before parcel runs. Works well enough.

[1] https://github.com/parcel-bundler/parcel/issues/4022