Notices by Andrew Golding (huronbikes@cyberplace.social)

@thomasfuchs MANSPLAIN ANALYZE always goes on about how I'm computing wrong whenever I run it.

@thomasfuchs ok, I got all the various tech references except for the Apple Pippin, so kudos.

@thomasfuchs how did I miss that Apple tried to make a game console.

@GossiTheDog really looking forward to the next batch of corporate financial thrillers such as "Margin Call 2: 2 Margin 2 Call" and "The Big Shart".

@GossiTheDog I remember your earlier writings on this subject and I have been extremely paranoid about the VSCode extensions I've put on my work-owned machine.

I've also switched away from VSCode-based editors on my personal machines, partially because of this and also because of all the other happy horseshit MS has been pulling.

@cR0w "Oh, I've been doing it totes secure, just tossing all these sensitive configurations and secrets into this Private-CISA repository. Don't worry about it."

@cR0w

@GossiTheDog

@thomasfuchs what is that machine, an old Dell?

@thomasfuchs also really jealous of the 122 key, People want crazy money for the IBM versions and I don't know if the Unicomp has the same sort of satisfying sound.

@thomasfuchs More keys=more better

@GossiTheDog this particular defect-leading-to-vulnerability according to F5 can be mitigated by using named parameters instead of numbered in the rewrite regex replace expressions.

I don't think the conditions are to terribly unusual as this is the sort of thing that would be done if one wanted to, say, wrap an older HTTP API with semantics that use path parameters.

The defect also impacts the NginX Kubernetes Ingress Controller.

@GossiTheDog imagine an orange that you eat like a grape.

@thomasfuchs ok, so the API provider has an auth provider then?

Yeah, I think because of the way an oauth flow works, there's a general dance that the handshake follows and probably even a general implementation for the user token flow, but for various reasons a general purpose command line tool is not an easy thing.

@thomasfuchs at a higher level what are you trying to do? I think a large part of the issue will be grabbing the final issued token at the flow because it's the consuming app that has the responsibility of resolving any sort of one-time-token from the auth provider into an ID token or Auth token.

@thomasfuchs following this one. I think our QA engineer wound up implementing the idea of what you are saying as a Playwright script and it's something where I saw it and thought that there had to be a better way...

@GossiTheDog I appreciate your write-ups and I feel like I am learning about things I would have otherwise not. I'm in a similar place in terms of how I feel about my career, and it definitely sucks and I wish I had a way to make things suck less.

@thomasfuchs I can't count the number of times driving aids have saved my bacon, that they aren't ubiquitous across all new vehicles now is really something.

@da_667 I feel like I haven't gotten enough mileage out of my stamp...

@GossiTheDog putting "Superbowel 2036" on my calendar.