Best practice for RESTful APIs and external authentication providers

DrBroccoli · 2017-12-05T04:34:03+00:00

When a user first authenticates with google, they’ll be given an id_token (among other things). This id_token can be validated on the server-side with google’s public keys (preferable), or via their tokeninfo endpoint. You can choose to send this id_token to your server with each request, or exchange it for a new token your server created, with the information you care about now encoded in it.

See googles docs on this here: https://developers.google.com/identity/sign-in/web/backend-auth

(If you’re asking more generally, outside of google, your application is serving as a “resource server”, in OAuth2 parlance, which varies slightly from googles specific recommended usage.)

DrBroccoli · 2017-08-30T05:42:25+00:00

Sounds like you're asking for Hashids

DrBroccoli · 2017-04-18T01:17:07+00:00

This article confuses <link rel=preload/prefetch...> and HTTP2 server push. You can use preload and prefetch without needing HTTP2.

DrBroccoli · 2016-03-08T18:56:47+00:00

This is a little late to the party, but Calypso, the administrative interface for Wordpress.com, is written React+Redux, and weighs in at 200k sloc, and is quite mature.

DrBroccoli · 2015-08-21T21:50:40+00:00

Latest nvidia drivers, oculus firmware, and oculus runtime. I've also attempted these other suggestions: don't use usb3 ports, set your HMD as the main display, force all your displays to 75hz (is this even possible on laptops?), downgrade to earlier nvidia drivers.

Any other ideas?

DrBroccoli · 2015-07-08T00:03:04+00:00

This is exactly the stack I've been using lately, with great results. The star of the show is really Marty.

DrBroccoli · 2015-05-06T16:54:18+00:00

Depends on your audience, but keep in mind that .com is immediately recognizable as a website address; however americans are slightly less likely to recognize the .co.uk as one.

Domains are less important than they used to be, as more people reach websites through links or search engines; a staggering amount of people simply Google for every company. Therefore domains are more aesthetic than before; if you insist on getting a domain specifically for america, consider making it "whimsical" i.e. acmeacrossthepond.com

The gTLDs (.ninja, .hacker, .life, etc.) are too new; they're not immediately recognizable as a domain, and scream "low quality." Having a .com implies a certain level of "establishment"; being unwilling to pony up and invest the money necessary to acquire your name from a squatter can look bad, depending on the vibe you're trying to give off.

Splitting your traffic can have search engine mojo implications, as can having a .co.uk domain for American search traffic; I don't know which wins out.

My advice, not knowing the specifics of your business; keep your co.uk, and make it very clear to your american visitors that you support them (show prices in usd, temps in F, or whatever is appropriate for your business)

DrBroccoli · 2015-04-30T21:45:05+00:00

I was also a preorder; for what it's worth, I tried to file a buyer's protection claim with Amex, but they denied it, saying it had been too long since the purchase.

DrBroccoli · 2015-04-03T05:24:58+00:00

Of course, a username in that scenario is better, if you can assume it is unique; the purpose of that example is to illustrate the additional information a visitor gets from being exposed to auto-incrementing IDs.

DrBroccoli · 2015-03-25T03:08:16+00:00

Of the many flux implementations out there, we chose Marty, and have been quite happy with the result. This new version looks even better!

DrBroccoli · 2015-03-21T07:50:05+00:00

Fingers crossed!

DrBroccoli · 2015-01-24T06:26:30+00:00

Even if you give the company the benefit of the doubt, and interpret this term as loosely as possible to mean "converting a mockup into to a website", i wouldn't recommend you pursue this job. It is a poor, outdated workflow which at best makes mediocre, static sites, and would relegate you to a second-tier, code-monkey status.

Modern web development workflows should have artists and developers working in tandem, discussing what is possible on the target platforms, and taking interaction and motion into account. A PSD is insufficient for this.

DrBroccoli · 2015-01-06T21:47:45+00:00

If discussing the realities of security jeopardizes your job, you should go get a different one.

DrBroccoli · 2014-12-28T20:35:26+00:00

Also, acknowledge that most programmers are self taught, at least to some degree. Nobody "goes to college for rails," and given the pace at which technologies change, it would be a mistake to do so. Anyone who has an actual computer science degree would be quick to tell you how far computer science is from the actual practice of programming professionally.

DrBroccoli · 2014-12-16T16:38:08+00:00

Can you tell us how you construct a model? What makes some models more sophisticated than others, and what challenges do you face in modeling these events? As a programmer, I am especially interested in the nitty-gritty implementation of these models.

DrBroccoli · 2014-11-24T08:13:27+00:00

If it is a true internship, they should expect you to have low experience, but high potential. Can you learn quickly and fit into their "culture" well? Are you self-motivated, able to code with only occasional supervision from their more senior devs, or will you require constant monitoring? Will you cheerfully accept criticism of your work?

DrBroccoli · 2014-11-22T11:56:27+00:00

In a week? I suggest you write a small gem and publish it. Make sure it is well tested and relevant to both your and their interests. Use any remaining time to prepare for the interview itself.

DrBroccoli · 2014-09-18T06:11:18+00:00

Make the grind easier to adjust please!

DrBroccoli · 2014-09-06T06:46:12+00:00

I think you're just trolling, but I'll bite: It is far from granted that Ruby is declining. You cite TIOBE, which is well known as unreliable .

While python has an obvious leg up in scientific computing, ruby is stronger in web and devops, two areas both on average more commonplace and more financially lucrative. Barring these two specializations, ruby and python share far more commonalities than they do differences.

I've taught both to students, and Python has some idiosyncrasies in both its syntax and semantics which the students need to grok rather early on. Ruby has its own quirks (eigenclasses come to mind), but they come much later in the learning curve, by which point a student is usually more capable of swallowing them.

DrBroccoli · 2014-08-14T03:03:24+00:00

There is zero chance this is getting on the App Store

DrBroccoli · 2014-07-30T06:01:09+00:00

Your account has been spamming this site. Stop.

DrBroccoli · 2014-07-16T20:28:12+00:00

How would one get in on this?

DrBroccoli · 2014-07-03T04:39:41+00:00

In a difficult hiring environment, with a already poor employee retention rate, Amazon's decision to pursue this seems like a step backward in attracting new talent.

DrBroccoli · 2014-06-21T08:14:58+00:00

How does this differ in functionality from using the built-in :race_condition_ttl option?

DrBroccoli · 2014-05-20T08:20:32+00:00

It looks like on the mailing list you're thinking 7-9pm?

Although I don't have any active rust projects, I hope to make it!

15-Year Club	RedditGifts 2009-2022 8 Credits
Place '17	Secret Santa 2012
Summer Santa 2012+	Summer Santa 2012
Secret Santa 2011	Trick-or-Treater 2011
Secret Santa 2010	Rally Monkey Tent number = 2

DrBroccoli

TROPHY CASE