Client side verification is just security by obscurity, which gains you very little.
If someone is capable of MITM attacking a user and fetching a password mid-transit to the server over HTTPS, they are surely capable of popping open devtools and reverse engineering your cryptographic code to either a) uncover the original password, or b) just using the encrypted credentials directly to authenticate with your server without ever having known the password in the first place
deleted by creator
You are acting like someone checked off a “log passwords” box, as if that’s a thing that even exists
Someone configured a logger to write HTTP bodies and headers, not realizing they needed to build a custom handler to iterate through every body and header anonymizing any fields that may plausibly contain sensitive information. It’s something that literally every dev has done at some point before they knew better.
It’s not uncommon to see certain sites to only work on chromium because the dev used the filesystem APIs that don’t exist on FF
Yes but if it’s first instinct is “go left” on 1-2, it’s pretty apparent the reward function could use some tuning
More, but not way more - they would be licensing window IoT, not a full blown OS, and they wouldn’t be paying OTC retail rates for it.
deleted by creator
lol. Did this in my old building - the dryer was on an improperly rated circuit and the breaker would trip half the time, eating my money and leaving wet clothes.
It was one of the old, “insert coin, push metal chute in” types. Turns out you could bend a coat hanger and fish it through a hole in the back to engage the lever that the push-mechanism was supposed to engage. Showed everyone in the building.
The landlord came by the building a month later and asked why there was no money in the machines, I told him “we all started going to the laundromat down the street because it was cheaper”
Too bad it still can’t figure out how to do dead ass simple things the old assistant had no problem with, like setting a reminder or alarm
You can just point your domain at your local IP, e.g. 192.168.0.100
Maybe a riff on lutris? Not sure why though
The feature is explicit sync, which is a brand new graphics stack API that would fix some issues with nvidia rendering under Wayland.
It’s not a big deal, canonical basically said ‘this isn’t a bug fix or security patch, it’s not getting backported into our LTS release’ - so if you want it you have to install GNOME/mutter from source, switch operating systems, or just wait a few months for the next Ubuntu release
GNOME said this update is a minor bug fix (point release)
Canonical said this is actually a major feature update, and doesn’t want to backport it into its LTS repositories
Not with 64gb ram and 16+ cores on that budget
English is not my native language, and I don’t understand what “Have taken up farming.”
It means they aren’t developing software anymore because they are growing vegetables instead
Actually, I‘m just excluding companies like yours because they are making way too much revenue on the basis of FOSS without giving back
You don’t know anything about my company? You don’t know what proportion of FOSS vs proprietary software we use, nor how much we give back lol.
It would completely break the locked down proprietary software model and break walled gardens wide open.
This is very pie in the sky. Your license idea only penalizes small to medium sized businesses. Alphabet’s 1% would just go to Chromium/AOSP, and Meta’s 1% would just go to React/Torch
You are probably better off setting up a non-profit and running traditional license fees through it into your payment union then. I can’t emphasize how much of a non-starter 1% of revenues is for any business (it’s my company’s entire IT budget, including salary) - you are basically just saying “personal use only” with more words.
1% is an exorbitant amount of money, and more than most businesses would be able to donate via credit card, so they would still have to reach out to repository owners for banking info
They would have to get in touch to figure out how to pay 1% either way, no?
No it doesn’t, if they intercept an encrypted password over HTTPS they can resend the request from their own browser to get access to your account
What is the problem with that? The password is secure and only shared between you and the site you are intending to communicate with. Even if you sent an encrypted password, they wrote the client side code used to generate it, so they can revert it back to its plaintext state server side anyways
How would you verify it then?
If not sending plaintext passwords was best practice then why do no sites follow this? You are literally posting to a site (Lemmy) that sends plaintext passwords in its request bodies to log-in