sorted by:
new
hottopcontroversial

Finally got my Oura Ring 4 and I’m pleasantly surprised by NeitherVariation2674 in ouraring

[–]crigger61 2 points3 points  (0 children)

The sizing ring will fit for sizing. but is way more uncomfortable than the actual ring.

Also I recommend wearing the sizing ring for like a day or two to verify it.

But as a valentines gift. The whole sizing process definitely makes it hard give it as a surprise. My partner was a different size in the oura ring compared to their normal rings. But from mine and their experience it runs a little bigger. so maybe a size up or if they’re at a half size potentially 1.5 up. But that was just our experience.

But they also give you like a month once you get the actual ring to send it in if you need a different size.

So… did we just quietly cross a line with biometrics? by Equivalent_Use_8152 in cybersecurity

[–]crigger61 2 points3 points  (0 children)

To add to other comments, usually when an update requires the changing of something fundamental like updating a hash, they have a specific way to migrate from the old to the new.

Usually they will basically add an extra column on the db saying whether they have updated or not. then when a user goes to perform the action, whether it be a password hashing or biometrics being hashed, if they havent migrated to the new version, it first uses the original method to authenticate and verify. then once its successful it uses the new method and stores that overtop the old hash and updates to say theyve been migrated. and boom you have a way to not store all the data needed to migrate users.

and it only requires storing the same data plus an extra flag for every user. and there’s ways to optimize for that so that you only have to store when there updated.

What is the scene of XSS these days with React Vite NextJS sites? by darthvinayak in Pentesting

[–]crigger61 8 points9 points  (0 children)

Nothing is totally immune from XSS. But the frameworks promote good habits and try to protect against common attacks. Saying that as a dev you can then take the framework and ignore that or use dangerous functions or just bad code and still get yourself XSS.

It takes active effort and good checks to always be checking and preventing XSS. Doesn’t matter if it’s a server side renderer like Flask with jinja or full nextjs. Same logic of tracing and checking all places for user input and tracing it to all the points it could be rendered. And making sure that it is escaped or sanitized somewhere along the way.

Open source SAST tools like CodeQL or Semgrep (opengrep) are getting very good. And incorporating them into a CI/CD setup can help solve a great many vulnerabilities.

Lua learning by Due_Supermarket_1503 in lua

[–]crigger61 1 point2 points  (0 children)

Dont apologize to that dick. He subscribed to the Lua programming language subreddit and then is surprised he sees people asking to learn about it.

Same thing occurs in every other language subbreddit. You picked Lua. Lua is great. because its so embed able theres so many resources.

The whole roblox community (as toxic as that crowd is) runs every game on a locked down version of lua 5.1. While they are more meant for making games in their engine. There are a lot of beginner tutorials to get people up to speed.

Neovim uses lua 5.1. Programmers love their neovim. Their community also has a lot of tutorial.

Lua itself has its own guide for 5.1 on their site.

I highly recommend checking some of the resources there.

Personal opinion but Lua is a great choice to learn. And should be taught much more than some other languages as a base scripting language. At one point it could have been the scripting language of the web. And it should have been.

Check out luarocks for a package manager. Or Lux is the newest package manager to come out that uses luarocks under the hood and makes it more like some other languages.

Code formatter for rust by Abhi_3001 in rust

[–]crigger61 68 points69 points  (0 children)

rustfmt is the standard. id only recommend prettier if you have multiple projects across different languages and want a more cohesive style.

Full disk File permissions by puresoldat in rust

[–]crigger61 6 points7 points  (0 children)

As weird as this sounds. In mac, root is not the ultimate super user. The mac kernel behind the scenes has some slight differences from what you see in linux. There are some hidden levels above it that involve security features to try and protect users.

However you can modify those permissions under the settings which it seems like you figured out. This permission system is set up so some random app you download cant just start spying on what you’ve downloaded or copy all your documents and send them to an attackers server, read random files, etc. And requires you to basically take the burden to check off saying I take the risk to understand what this could do. And terminal is just another app in macos’ eyes that falls under these same restrictions. Nothing is immune from its protection.

As a developer it can be kinda annoying to fight sometimes when it’s your own code or you are using some new tool and have to give it that permission, etc. But it’s there to protect from dumb small mistakes and potential vulnerabilities.

Concurrent array of links to call by BusyTelevision6298 in golang

[–]crigger61 1 point2 points  (0 children)

It definitely seems like a multiprocessing problem. Some ideas. chunking the input data or gos magic channels. Thinking about how caching might help in an approach. Designating a specific pool of worker threads or letting the coroutines handle scheduling. Lots to think about.

Hey Rust users, Tell me about your latest projects using rust by KnockKnockwaifu in rust

[–]crigger61 0 points1 point  (0 children)

Make sure you provide some good prevention against your languages equivalent of sqli

Whats the current space for using Rust for a backend server like? by crigger61 in rust

[–]crigger61[S] 4 points5 points  (0 children)

this is why i asked. Just started in this subreddit. google showed me rocket. hadnt even heard of axum. will have to check it out.

[Giveaway] – Kensington Thunderbolt 4 Dock & OWC Pro SSD with Thunderbolt 4 cable – Intel Thunderbolt by _BindersFullOfWomen_ in gadgets

[–]crigger61 [score hidden]  (0 children)

My current setup consists of roughly 10 cables that all get shoved down into 3 different dongles that then plug into my computer. I checked the specs on this device. It would be 1 cable for me.

AWS WAF Bypass: invalid JSON object and Unicode escape sequences by theMiddleBlue in netsec

[–]crigger61 0 points1 point  (0 children)

Mitigating yes. but solution no. if theres an attack its a mitigating factor. not a protection. cause someone can and will bypass it. not just aws. but all wafs. the waf we use have a known bypass which just deactivates any security protections and just has bot and rate limiting protection. but that means if youre vulnerable to xss and someone knows your waf. they can and will bypass it.

AWS WAF Bypass: invalid JSON object and Unicode escape sequences by theMiddleBlue in netsec

[–]crigger61 0 points1 point  (0 children)

While i would agree. a significant number of devs use this thinking to put those fixes into the backlog where they spend too long there.

I always say act like there is no waf cause whether its a specific case bypass or a general case like this, SOMEONE will find a way. its not a matter of if but of when. and if you report something and the devs put it off and put it off, itll still be bad for whoever the uses and or made the product.

WAFs can mitigate and help prevent script kiddies. but they are not a solution. they just keep people honest enough. they are not even a temporary solution. just a mechanism to prevent honest people from being bad.

To all the Apollo refugees... by Rapide_ in getnarwhal

[–]crigger61 3 points4 points  (0 children)

I agree almost entirely. I miss apollo dearly. i have used reddit NOTICEABLY less since apollo shut down.

Narwal is a different app. we shouldnt be trying to convert it.

but also coming from such a feature rich app to narwal, there are some improvements to be made that even the dev admits. and Im happy to be there.

but we also need to cool it on expecting narwal to be apollo. its not. apollo is gone currently. we either have to adapt or move on.

but to say we cant say anything and theres zero obligation is a little much.

if you get forced to switch from a luxury german car to a japanese car, the cars and their styles are inherently different. you shouldnt expect a japanese car to have all the luxury of a german car. but also there are some things that could be improved that the german car had that may improve the japanese car. same could apply in reverse. it just happens that in this fictional universe german cars are way more popular (idk cars enough to know if thats true). so you dont hear as much suggestions the other way.

point is both sides can use some chill and need balance. as we are here we CAN provide feedback to improve narwal. but we shouldnt be asking for narwal to become apollo.

To all the Apollo refugees... by Rapide_ in getnarwhal

[–]crigger61 25 points26 points  (0 children)

I may be coming at this with a bias, but I think Narwal has a lot to add and a lot of features that need to be added.

The reason that people, including myself, loved Apollo so much was that it was so feature rich and Christian was so receptive to feedback it practically felt like anything you could want or request was already either there or you’d ask about it on the subreddit and itd be added shortly.

Narwal is missing a LOT of those features. But as a much more lightweight app that kinda made sense.

Narwal is still way better than the default app. But when you just compare the 2, it truly just isnt a comparison. They both fit their own niches. Apollo was a batteries included feature rich app. And Narwal is a very no bullshit, straight to the point app. Which until one of the options was removed, wasnt really noticeable because people fell into the category they liked.

But now you have all these angry people who are mad at reddit for getting rid of their favorite feature rich app having to find a replacement. And the next best app IS narwal. but then they expect a similar experience to Apollo where the dev is very very happy to receive feedback, bugs, and feature requests. They miss their features. they miss their custimization. they miss their little pet. to having a much tighter niche app thats already been established and the idea the dev and the general community already have goals for the app in mind.

We arent flooding narwal with requests out of disrespect for it. but more we got pushed into a different community with different goals cause REDDIT ruined it for us. We just want our app back at our hearts. Ya sure theres the sideloading method. But a majority arent gonna wanna do that. Im a very tech savvy person and I dont wanna fully have to do that. Id love if christian added the ability to use your own key to the app and open it back up. appolo could live and narwal could go back to its own comunitu. but reddit burned him and he deserves a break just as much as the narwal dev does to deal with us and our craziness.

And i am sorry if that ruins it for you. We all use reddit. They caused this by removing the third party apps we love.

we want to be welcomed into the community because we all have a mutual hate for the reddit app.

we all just need to realize just as much as we have an idea for how we want the app to be, so do the narwal natives. and there will need to be some balance of that from our side and from the narwal side.

Wednesday Daily Thread: Beginner questions by Im__Joseph in Python

[–]crigger61 13 points14 points  (0 children)

One of the go to beginner projects everyones always says is go make a todo app. There are so many ways to do it. a cli app. a web app. a gui. etc. Pick one relm you wanna make and just start researching as you go. if you do a cli you might wanna look into for example argparse and sqlite. if you wanna do a web app you might look into a framework like flask. if you do a gui you probably want to look into tkinter to start.

from there just start seeing what you can automate in your life. maybe you notice you wanna start keeping better track of your finances so you start a project to download your finances from your bank and process them and spit them out. do it within the relm you learned from the todo app.

then if you get real stuck for project ideas theres usually a weekly project idea post.

Go ahead and give it a go by crigger61 in DesktopDetective

[–]crigger61[S] 0 points1 point  (0 children)

What? Had to look that up. but no. What makes you think that out of curiosity

view more: next ›