https://xitter.cf/t.co/ZYftmuBai7 https://xitter.cf/t.co/iUqEggIdKE
Bellingham, Washington
Joined January 2021
- Tweets692
- Following256
- Followers49
- Likes1.8K
I guess it's security vulnerabilities all around lately.. PHP got PHP2Shell. I had a gap in my refresh token flow. Now Rust isn't guaranteeing memory safety. Wat the crap
github.com/rust-lang/rust/is…
Everyone's patching PHP2Shell today, so here's a security hole I made myself. Smaller and dumber but..
I gave my app's session refresh a 10 second grace window and I guess it could possibly hand sessions to whoever stole the token..
zwipe.net
After:
-> client refreshes one at a time
-> two requests on one token can only mean a second holder
-> any replay kills the family. No grace
/3
...aaaand Cairn is already getting an update
Apple approved it tonight and 1.1.0 is right behind it with a new splash and logo
- the logo shows up as noise, then decodes into the wordmark left to right
- it leaves the same way, back to noise and gone
- the app stays hidden until its styles load, so there's no flash of a raw page first
- the numbers on home roll in as random digits that settle on the real count
It all lives in orangui, so zwipe and my site have it too
apps.apple.com/us/app/cairn-…
Told you it was right behind it. 1.1.0 is live
Two updates in two days, and 1.1.1 is already waiting on Apple
scottyfermo.com/projects/cai…
I think the internal conflict about AI writing my code is slowly dying
For years I've tried all sorts of flavors of agent-driven engineering. And as fast as any agent could spit out tokens, I felt like I was watching chances to deeply learn slip away
It's always felt defeating. And I can't lie, typing this it still does a bit
But hey, everything's a trade off
The speed agents work at usually demolishes my capacity to take in every detail, think through every approach and actually learn the concepts we're exploring. So my pace stretches and contracts to meet my understanding, stamina, interest, time frame, etc.
The epiphany is that I never have to stop learning. Use the tool, take the trade off, and with the time I save, go read a paper and hand write something too. I have more things than I know what to do with and I'm gradually getting the time to do them
As my "vibe" infrastructure gets better at producing code I'm actually happy with, I get *more* time for exactly what I want to learn. Less learning by accident, more on purpose
Cairn is on the App Store, free!!
Wanted my lifetime pull-up count, but a lifetime total by itself is kinda lame and there's a million apps for it. So Cairn breaks it down by year
- this year's total
- average per day
- set a goal and it tells you if you're ahead or behind
- and what today needs to be to catch up
Counts anything in whole numbers. Pull-ups, pages, miles
- everything stays on the phone in SQLite
- no account, no server
- export is a CSV with two columns, day and count, because that's all the data is
- 50 themes, each in dark and light, built on orangui
apps.apple.com/us/app/cairn-…
scottyfermo.com/projects/cai…
scottyfermo.com/projects/ora…
Somebody tell me how JavaScript is not just foot gun city like what the. Everything is "well just don't do it that way and you won't break everything"
orangui went from 31 themes to 50 today. All. about. the. themes
- Darcula, Xcode, Visual Studio, Neovim, Nightfox, Material and a few more, each one pulled from the editor's own published colors
- the backgrounds are little squares now and they drop in when the page loads
- the apps open on a splash where they drop in under the logo
Live on both sites now, zwipe and cairn get them next update
github.com/scadoshi/orangui
scottyfermo.com
zwipe.net
