That's an interesting find thanks. I was not aware of no-cors mode.
It seems though that a browser would not allow 'non-simple' headers in no-cors mode[0].
Authorization headers for example would not be allowed (if i'm reading correctly). So any API using that header would not be affected by this issue right?
Two old friends riffing off each other about the world.
I've listened all the way through twice and both times have found myself laughing out loud and deep in thought simultaneously.
I look forward to seeing how Eric Weinstein will continue to evolve The Portal in 2021. No doubt he will continue to deliver outstanding content in his own uncompromising style.
I'd be interested to hear how Slack patched this. Hopefully by removing the ability to apply settings from URLs altogether, rather than attempting any sort of sanitisation on the download settings.
The Christchurch shooter amassed a cache of weapons, and also posted a copy of his manifesto and a link to his real Facebook account to 4chan.
The censorship/Facebook algorithms amplifying abhorrent content debate is one thing but I'm surprised by the lack of scrutiny of the security services over this. Especially for a member of the 5 Eyes. I can't help but feel this could have been prevented without any of the changes being proposed.
I'm a fan of liquibase. It's a very mature tool which allows you to run it every time the application starts, useful for development to create in-memory dbs. Or you can just call it as part of the build process if you don't want to check the DB changelog tables on startup.
It tracks changes that have been applied in changelog tables so you don't apply them multiple times.
Common operations such as adding a column are defined in a supported markup language but for more complicated things, such as migrating data, you can reference ad-hoc SQL files. All of which can be checked-in to your codebase.
The only real downside is because you are applying the entire development history of the database, you can sometimes be caught doing illogical things like adding and then removing something later on. This can be mitigated by rewriting history if needed though.
Flyway was not as good for me because it lacked a domain language, raw SQL makes it less easy to interpret but I know developers who preferred that.
Could you not apply the same logic to any occupation?
I get out of bed, head to an office and build software on the orders of those who pay me, I get summoned to meetings at their behest, I work long hours, only stopping to go to the toilet, I too get home and collapse into bed to repeat the next day.
Permissions to read text messages is another one that gets me. I know not many people use SMS as their primary communication but how can you be so astonishingly blasé about your data to save typing in a code?
Not my screw up but working for a fairly large e-commerce site we had a cron job to pick up 'stuck' orders and push them down to the warehouse every 30 minutes.
For a combination of reasons there was one order which was picked up every time the job ran.
This went on for a very long time and nobody in the company realised. The warehouse staff were all agency workers who dispatched B2B and B2C so sending a pallet wasn't unusual for them. It was only when the customer got in touch asking us to please stop sending the same thing that we were alerted.
Apparently she had ordered the items to her friend's office and they were getting very frustrated having to deal with them.
Even worse the customer was in China and the company had to order a shipping container to retrieve the stock.
Agreed. From their actions in the last couple of days it would appear these governments can hardly take the moral high ground.
I'm sure I'll get downvoted for discounting China's concentration camps and social credit programs but it would seem we aren't exactly the bastion of freedom we like to portray.
It seems though that a browser would not allow 'non-simple' headers in no-cors mode[0].
Authorization headers for example would not be allowed (if i'm reading correctly). So any API using that header would not be affected by this issue right?
[0] https://developer.mozilla.org/en-US/docs/Web/API/Request/mod...