Aaron Parecki

59°F

Aaron Parecki https://aaronparecki.com/ • May 31
It's the handler that responds to the "Continue" form post on this screen. Instead of a Boolean, the client sent back the actual email address and the server accepted arbitrary values.

Now that I'm writing this out, I realize that the client also sends back the "name" here, intentionally, since the name is user-editable. So I can see how this happened. It's just extremely poor coding practice to essentially also allow the email to be editable here.

Portland, Oregon • 54°F

2 likes

Sun, May 31, 2020 5:45am -07:00
Torsten Lodderstedt https://twitter.com/tlodderstedt • May 31
But it’s exposed to the client and did accept arbitrary values, right?

It's the handler that responds to the "Continue" form post on this screen. Instead of a Boolean, the client sent back the actual email address and the server accepted arbitrary values.

Portland, Oregon • 54°F

1 reply

Sun, May 31, 2020 5:42am -07:00
Torsten Lodderstedt https://twitter.com/tlodderstedt • May 31
But it’s exposed to the client and did accept arbitrary values, right?

Yea, it's just not part of the OAuth API. It's more like bad logic on the internal implementation of the AS.

Portland, Oregon • 54°F

2 likes 17 replies

Sun, May 31, 2020 5:39am -07:00
Torsten Lodderstedt https://twitter.com/tlodderstedt • May 31
if I understand correctly, the token request accepted an alternative email claim value and used it to override the value on Apple’s IDP. Really?

If I'm reading it right it's not the token endpoint, it's their internal API for accepting the request that let the user choose which email to share with the app. So it's a form validation problem.

Portland, Oregon • 54°F

22 replies

Sun, May 31, 2020 5:36am -07:00
Josh Long (龙之春, जोश, Джош Лонг, جوش لونق) https://twitter.com/starbuxman • May 31
2020 has been a bumpy ride over here in America.

* a global pandemic killing 100,000+ Americans? Check.
* race-wars spilling into the streets? Check.

And it's not even June.

Don't worry, there's still time for the earthquake

Portland, Oregon • 54°F

Sat, May 30, 2020 11:51pm -07:00
All we need is the big earthquake to really round out 2020

Portland, Oregon • 54°F

22 likes 3 reposts 5 replies 1 mention

Sat, May 30, 2020 11:30pm -07:00
Adam Avenir https://twitter.com/adamavenir • May 31
Still *somehow* I’m hopeful that the 2030s will be better than we can ever imagine them right now. Lots of pain between now and then and lots more work to be done.

Not even 6 months into the 2020s and we've already written off the entire decade 😂😭 is that the point we're at right now

Portland, Oregon • 54°F

1 like

Sat, May 30, 2020 10:34pm -07:00
Marco Arment https://twitter.com/marcoarment

Agreed. I feel deeply sad and infuriated, yet paralyzed by how broken my country’s culture is. I want to help, but I also don’t want to inadvertently help “wrong”.

Tweeting isn’t much, and my votes in NY mostly don’t count. What ELSE should I do? Good organizations to donate to?

Portland, Oregon • 54°F

Sat, May 30, 2020 3:07pm +00:00 (liked on Sat, May 30, 2020 10:26pm -07:00)
This is by far the most thoughtful social media release request I've seen on Twitter. 👏 https://twitter.com/kare11/status/1266932143927721984

Portland, Oregon • 54°F

8 likes 1 repost

Sat, May 30, 2020 9:34pm -07:00
Jeff Bercovici https://twitter.com/jeffbercovici

Boy you’d think a country that can equip every cop like a soldier could equip every doctor like a doctor

1 like

Sun, May 31, 2020 4:00am +00:00 (reposted on Sat, May 30, 2020 9:34pm -07:00)
shereen https://twitter.com/shereeny

why is the active voice used for protestors (“protestors struck a journalist”) but not for police (“a photographer was shot,” “a reporter was hit”)?

1 like

Sun, May 31, 2020 3:39am +00:00 (reposted on Sat, May 30, 2020 9:33pm -07:00)
shereen https://twitter.com/shereeny

why is the active voice used for protestors (“protestors struck a journalist”) but not for police (“a photographer was shot,” “a reporter was hit”)?

Portland, Oregon • 54°F

Sun, May 31, 2020 3:39am +00:00 (liked on Sat, May 30, 2020 9:29pm -07:00)
Jeff Bercovici https://twitter.com/jeffbercovici

Boy you’d think a country that can equip every cop like a soldier could equip every doctor like a doctor

Portland, Oregon • 54°F

Sun, May 31, 2020 4:00am +00:00 (liked on Sat, May 30, 2020 9:25pm -07:00)
Not Fake Adam Kalsey https://twitter.com/akalsey

When I was a kid, my mom said she was going to slap me into next year.

I called her and asked if the offer was still available.

Portland, Oregon • 54°F

Sun, May 31, 2020 4:18am +00:00 (liked on Sat, May 30, 2020 9:22pm -07:00)
Akasha of Thorne https://twitter.com/AkashaThorne

HOT TAKE: the tooth fairy myth teaches children that it’s normal to give away pieces of themselves for money.

Portland, Oregon • 54°F

Sun, May 31, 2020 3:56am +00:00 (liked on Sat, May 30, 2020 9:15pm -07:00)
jk https://twitter.com/karabaic

Yeah, there it is, in print. @ohmydollar @anomalily

Portland, Oregon • 62°F

Sat, May 30, 2020 9:21pm +00:00 (liked on Sat, May 30, 2020 2:43pm -07:00)
This is fantastic! Pine.blog can now receive webmentions for you, and it'll show them to you in the timeline! This is probably the best option for static sites now! https://blog.pine.blog/2020/05/bring-us-your-static-sites-yearning-to-breathe-free/

Portland, Oregon • 63°F

4 likes 2 reposts 3 replies

Sat, May 30, 2020 2:08pm -07:00 #webmention #indieweb
Bring Us Your Static Sites, Yearning to Breathe Free – Pine.blog (blog.pine.blog)

Sat, May 30, 2020 2:04pm -07:00 #indieweb #webmention
Andrew G. https://twitter.com/marginoferror

oh my god, i looked at these and thought, "that's a weird absurdist joke" before it dawned on me after reading the entire thing that the point is that it is real

Portland, Oregon • 59°F

Fri, May 29, 2020 10:53pm +00:00 (liked on Sat, May 30, 2020 9:30am -07:00)
Karen Attiah https://twitter.com/KarenAttiah

My latest: A dispatch from the Failing States of America.

How Western media would cover Minneapolis if it happened in another country https://www.washingtonpost.com/opinions/2020/05/29/how-western-media-would-cover-minneapolis-if-it-happened-another-country/

Portland, Oregon • 58°F

Fri, May 29, 2020 9:53pm +00:00 (liked on Sat, May 30, 2020 9:04am -07:00)

older