Aaron Parecki

Between the 3 Sept and 10 Sept, secure env vars of *all* public @travisci repositories were injected into PR builds. Signing keys, access creds, API tokens.

Anyone could exfiltrate these and gain lateral movement into 1000s of orgs. #security 1/4

https://travis-ci.community/t/security-bulletin/12081

@vibronet on stage: BROWSER FEATURES VS. IDENTITY PROTOCOLS: AN ARMS RACE?
#eic2019

We need permissionless innovation. No to pay pilgrimage to browser vendors to sacrifice the first born. #EIC2021 by @vibronet

Contacted @Teradek about this backdoor in their IP video device firmwares in 2020. They were not interested in it (stopped replying at a point), released an updated firmware in 2021 but without a fix.

Ok, then here is the full disclosure: https://an0n-r0.medium.com/full-disclosure-0-day-rce-backdoor-in-teradek-ip-video-device-firmwares-85a16f346e15

I do know who needs to hear this: good field data and bad lab data might mean that you’ve built a web site targeted specifically at a wealthy audience

this has been your monthly web performance subtweet ok bye

I'd kind of forgotten what it's like to be a daily Windows user, but the amount of 0-day security patches from Apple lately is making me remember.

I can tell how hard the problem I'm working on is based on my inability to pick a codename that doesn't conflict with prior art and the stream of dead bodies before it :)

😬

Struggling to understand how an email/martech platform fits into Intuit’s “fintech for shit that should actually be free or not even exist” go to market

Wheels barely touched the ground, and 70% of my Google results are already in Dutch language. How does that make any sense, as a feature? 🤔

Love NFTs but this is going to go down as one of the stupidest bubbles of all time. Two things can be true at the same time.
Artists getting 💰💰 is good.
Wild JPEG speculation is bad.

Worried that a brand will think you're too expensive? Or too cheap?

Send them a bunch of tiers/packages and see what happens.

This is my biggest criticism about the way many sites are using SPAs today: I do most of my browsing on my phone where I follow a link to a page, wait for it to load (with a cold cache), spend a minute or two reading it and then leave - often with no in-site navigation at all

As you think about stack/framework choice, keep session depth front-and-center. SPA tech weight can only be justified through *high interaction amortization*.

That's not a marketing site. Or a blog. Or a news site. Probably not even a shopping site.

It seems having a YT video as “members only” then releasing it public is a BAD strategy. It feels like it’s being treated like a week old video with the few members views it had, instead of a new video.

In a different world, XOXO 2021 would be starting today. Two years of my life feeling askew without it, and I know I'm not the only one feeling that today. Miss y'all so much! 💛