Aaron Parecki

Arif Yayalar 💛❤️🦁 https://twitter.com/ayayalar • May 30
@aaronpk little disappointed that you sell pdf/ePub editions of OAuth 2.0 Simplified separately.

Yeah it's mainly a technical limitation of the platform we used for publishing it. If you send me a receipt, I'll send you the other format!

Portland, Oregon • 54°F

Sun, May 31, 2020 6:05am -07:00
Barbara Schachner https://twitter.com/barschachner • May 31
I feel logical bugs around OAuth/OIDC/JWT handling are on the rise - and they are like the login form SQL injections of the past („be whoever you want to be“).
Love those standards and their capabilities - but are they getting too complicated?

Nah this is more a demonstration of why sticking to standards is a good idea, and why building an authorization server isn't a project that should be taken lightly.

Portland, Oregon • 54°F

1 like 12 replies

Sun, May 31, 2020 5:59am -07:00
Aaron Parecki https://aaronparecki.com/ • May 31
It's the handler that responds to the "Continue" form post on this screen. Instead of a Boolean, the client sent back the actual email address and the server accepted arbitrary values.

Now that I'm writing this out, I realize that the client also sends back the "name" here, intentionally, since the name is user-editable. So I can see how this happened. It's just extremely poor coding practice to essentially also allow the email to be editable here.

Portland, Oregon • 54°F

2 likes

Sun, May 31, 2020 5:45am -07:00
Torsten Lodderstedt https://twitter.com/tlodderstedt • May 31
But it’s exposed to the client and did accept arbitrary values, right?

It's the handler that responds to the "Continue" form post on this screen. Instead of a Boolean, the client sent back the actual email address and the server accepted arbitrary values.

Portland, Oregon • 54°F

1 reply

Sun, May 31, 2020 5:42am -07:00
Torsten Lodderstedt https://twitter.com/tlodderstedt • May 31
But it’s exposed to the client and did accept arbitrary values, right?

Yea, it's just not part of the OAuth API. It's more like bad logic on the internal implementation of the AS.

Portland, Oregon • 54°F

2 likes 17 replies

Sun, May 31, 2020 5:39am -07:00
Torsten Lodderstedt https://twitter.com/tlodderstedt • May 31
if I understand correctly, the token request accepted an alternative email claim value and used it to override the value on Apple’s IDP. Really?

If I'm reading it right it's not the token endpoint, it's their internal API for accepting the request that let the user choose which email to share with the app. So it's a form validation problem.

Portland, Oregon • 54°F

22 replies

Sun, May 31, 2020 5:36am -07:00
Josh Long (龙之春, जोश, Джош Лонг, جوش لونق) https://twitter.com/starbuxman • May 31
2020 has been a bumpy ride over here in America.

* a global pandemic killing 100,000+ Americans? Check.
* race-wars spilling into the streets? Check.

And it's not even June.

Don't worry, there's still time for the earthquake

Portland, Oregon • 54°F

Sat, May 30, 2020 11:51pm -07:00
Adam Avenir https://twitter.com/adamavenir • May 31
Still *somehow* I’m hopeful that the 2030s will be better than we can ever imagine them right now. Lots of pain between now and then and lots more work to be done.

Not even 6 months into the 2020s and we've already written off the entire decade 😂😭 is that the point we're at right now

Portland, Oregon • 54°F

1 like

Sat, May 30, 2020 10:34pm -07:00
sonicrocketman https://pine.blog/u/sonicrocketman • May 30
Oh Aaron! It is done!

oh awesome!!

Portland, Oregon • 63°F

1 reply

Sat, May 30, 2020 2:03pm -07:00
Steve Ivy • May 30
Calling all blog/CMS nerds: many of our systems have an idea of a “day” worth of content: archives, dialy digests, etc. My question is: what defines the current “day”? Is it from my perspective as the author? The reader’s? What about email digests?

I've decided a "day" is my day, local time. That means if I travel to another timezone, the day might change in weird ways. You can see some of the side effects of this on my day archive pages when I've traveled across the date line. Some days are super long, others have almost no posts.

Portland, Oregon • 65°F

Sat, May 30, 2020 1:48pm -07:00
Ben Werdmuller https://twitter.com/benwerd • May 30
Oh I’m sorted for the non “e” whisky - got a Lagavulin 16 I’m slowly working through. Thank you for the recommendation! Will try Fighting Cock!

Caveat: I mainly use fighting cock in mixed drinks. It's not that great on its own.

Portland, Oregon • 66°F

1 like

Fri, May 29, 2020 10:49pm -07:00
Ben Werdmuller https://twitter.com/benwerd • May 30
Recommend me a bourbon? (Not Bulleit.)

I've been drinking Kings County Distillery straight bourbon, which has been lovely to drink over ice or in cocktails. I'd gladly buy it again. But what else do you think is fantastic?

Cheap but good: Fighting Cock
Good but not too expensive: Macallan 12 Year

Portland, Oregon • 66°F

1 like 1 reply

Fri, May 29, 2020 10:27pm -07:00
Darius Kazemi https://twitter.com/tinysubversions • May 29
Although if you are whispering like a dolphin I recommend my other social network, https://dolphin.town, the only social network where you can only use the letter e

I think you win the internet for today

Portland, Oregon • 72°F

3 likes 1 reply

Thu, May 28, 2020 11:12pm -07:00
Matthew Kobach https://twitter.com/mkobach • May 29
You can only keep three:

Twitter
Instagram
Linkedin
Facebook
TikTok
Snapchat
Pinterest
YouTube

None of the above. I'll keep my website.

Portland, Oregon • 73°F

8 likes

Thu, May 28, 2020 11:09pm -07:00
Rap Payne https://twitter.com/Rap_Payne • May 28
Hey @aaronparecki look what you got me to do. Going to up my video game. @Blackmagic_News

woo congrats! should be fun!

Portland, Oregon • 79°F

Thu, May 28, 2020 11:48am -07:00
Annika Backstrom https://xoxo.zone/@annika • May 27
@aaronpk I found this while searching for tiny steno keyboards! Did you end up sticking with it? https://aaronparecki.com/2018/08/01/25/steno-gherkin

I haven't had time to dedicate to learning, my job ramped up pretty quick right after I was getting into it. I'd love to set aside some time to practice again but I can't seem to make the time for it!

Portland, Oregon • 79°F

Wed, May 27, 2020 4:00pm -07:00
Jacky Alciné https://v2.jacky.wtf • May 27
Email me again about linking to your blog post from my older ones and I’ll put it in every porn comment section I see.

omg do it

Portland, Oregon • 79°F

Wed, May 27, 2020 3:36pm -07:00
Sara 🍑y https://twitter.com/saradietschy • May 27
actually it's only $400
Manhattan is where it is just BONKERS. $1500-$2500 and i'm just like .... WHY

oh whoa, that's not bad then! Yeah it's the $1500+ ones where it's pretty much the worst of both renting and buying.

Portland, Oregon • 70°F

2 likes

Wed, May 27, 2020 12:12pm -07:00
Sara 🍑y https://twitter.com/saradietschy • May 27
For some context i'm currently obsessed with a brooklyn apt with a PRIVATE roof top, it's under 1 million and was built last year. So if everyone is leaving NYC and a rona discount comes into play I just might be tempted??? But I'm almost asking ppl to talk me out of it 😂

the HOA on that must be out of control though! That's money you don't get back if you sell it later

Portland, Oregon • 69°F

3 likes 2 replies

Wed, May 27, 2020 11:48am -07:00
Christopher Lemmer Webber https://octodon.social/@cwebber • May 27
fire in the disco

Fire in the...Taco Bell

Portland, Oregon • 69°F

1 like

Wed, May 27, 2020 11:26am -07:00

older