WeChat ID
aaronpk_tv
-
Updated my post to add the video too - you can see slides, video, and resources all in one place! https://sia.codes/posts/webmentions-eleventy-talk/
-
Huzaifa Muhammad
https://twitter.com/huzayyfah
•
Dec 23
In situations where introspection endpoint is left open and un-throttled, how can a researcher exploit such vulnerability ? I could not find such stuff with google search.
The main threat is token scanning attacks, but there isn't much difference between scanning the introspection endpoint or a resource server at that point. That said, the introspection endpoint is supposed to require authentication according to https://tools.ietf.org/html/rfc7662#section-4 -
Over the last year, I've helped thousands of software developers learn about web security and OAuth by hosting live and virtual workshops, and all this knowledge is now available as an on-demand video course!
📺 ➡ http://oauth.wtf/course -
SeaLife
https://github.com/SeaLife
•
Dec 23
Hey, i dont see, how this helps to identify a stream. Especially this Service is not a public well-known service and is mostly developed by yourself (u didnt mentioned that in your text)
I think, a Streamer also has some more social media channels were they could link back to their stream they own. I would not trust such a service but i would trust their Twitter-Accounts or Facebook-Accounts... 🤔
Yeah @SeaLife is right, most people are going to not know what keyoxide is, or not care, and instead will just look for a link to Twitter and look at the Twitter account for a link back to the streaming site.
This is also related to #511 which lets websites mark up these links between each other in a way that can be parsed if you really want to have that be machine-readable. But in reality a human-visible link between each profile is going to provide a better user experience for most people anyway.
-
Hotwire aka NEW MAGIC is finally here: An alternative approach to building modern web applications without using much JavaScript by sending HTML instead of JSON over the wire. This includes our brand-new Turbo framework and pairs with Stimulus 2.0 😍🎉🥂 https://hotwire.dev
-
"The price for pursuing JavaScript for everything has been a monstrosity of modern complexity. Yes, it’s far more powerful than it ever was. But it’s also far more convoluted and time-consuming than is anywhere close to reasonable most web applications." https://m.signalvnoise.com/html-over-the-wire/
-
Huzaifa Muhammad
https://twitter.com/huzayyfah
•
Dec 23
Hi @aaronpk . I just got some questions to ask. I am currently in the last part of chapter 14, please can you reply me here or you got an email meant for questions ?
I can try to reply here!
-
I'm confused, are people saying this is bad? I've been doing this for ages, just never given it a fancy name.
-
Aaron Ogle :linux: :manjaro:
https://fosstodon.org/@geekgonecrazy
•
Dec 23
@aaronpk curious did that work for you?
Sure did! Vouch can sit in front of anything and I've used it to add login to a bunch of different kinds of things. The login page I set up is a super minimal OAuth-compatible page so that Vouch only has to speak OAuth to it but that proxy just accepts a single password to let people thru. I might do a blog post about it cause it was kind of cool!
