lil5 :golang: 🌱

I try to keep a productive/helpful tone. Also I prefer tabs, sized at 3 😈 My favorite languages/frameworks are Tailwind, GoLang & SQL

Website: https://li.last.nl/
Github: https://github.com/lil5
Codeberg: https://codeberg.org/lil5
Pronouns: He/him

Public Key

npub13mf5xspvn2elj6cnmvc6x4r3fv53ecpgysjlgjwkuq7f7mxwfuxqv6tkv8

NIP-05 Address

lil5_at_fosstodon.org@momostr.pink

Profile Code

nprofile1qqsga56rgqkf4vledvfakvdr23c5k2guuq5zgf05f8twq0yldn8y7rq5xjs3s

Author Public Key

npub13mf5xspvn2elj6cnmvc6x4r3fv53ecpgysjlgjwkuq7f7mxwfuxqv6tkv8

Show more details

Last Notes

2024-10-09 05:08:47

- reply

okay boomer

2024-10-08 17:39:00

https://answers.microsoft.com/en-us/windows/forum/all/cant-use-hybrid-transport-passkeys-on-windows-11/a6af27b3-2379-4adc-b027-eb54309a6afe
#Windows + #Passkeys
✅ Windows Hello
❌ Via Qr-Code from android
✅ Security stick

2024-10-07 15:33:41

- reply

Heres the full package: https://gist.github.com/lil5/91e9a719afc5fc6e97716e76602ef267

2024-10-07 15:21:36

[@axel_steier](https://mastodon.social/@axel_steier )
here's an example of my ContentDelivery script using #systemd run
For large projects I suggest going with #coolify
https://cdn.fosstodon.org/media_attachments/files/113/266/806/323/304/232/original/4fd84442399fe16b.png

2024-10-07 05:50:16

- reply

Being able to write good maintainable css is an art best left for when it’s needed, the fancy stuff. In _all_ other cases #tailwindcss will give you better results in maintainability and teamwork.
Tailwind is enjoyed by so many I’m not worried about it dieing out.

2024-10-06 08:37:53

https://github.com/stupidwebauthn/server
https://stupidwebauthn.site/
My project is so small the example email template is 40% of the code
This is thanks to these great projects:
https://www.npmjs.com/package/jose
https://hono.dev/
https://simplewebauthn.dev/
#Passkeys #webauthn

2024-10-05 11:26:42

- reply

For those confused saying but Firefox does support passkeys: yes but also no
Unless you have a physical security key (yubico feitian) on Linux, or without Windows Hello you are out of luck, no sign-in via phone QR code
Meanwhile in apple’s garden: It just works™

2024-10-05 10:59:18

Firefox’s password manager should support passkeys out of the box, much like bitwarden does.
Website are able to limit the type of passkeys allowed, but people should be able to create less secure passkeys if allowed.
Passwords are a plague that needs to be eradicated.
#passkeys #linux #Firefox #webauthn

2024-10-05 10:22:34

- reply

Here's my commit fixing this
https://github.com/stupidwebauthn/server/commit/843a2968dc6d64a21f72886b3f11ededf11b6fd5#diff-a2a171449d862fe29692ce031981047d7ab755ae7f84c707aef80701b3ea0c80R347

2024-10-05 09:54:00

alias ghrel="gh release create --generate-notes"
$ git push origin main
$ ghrel v1.5.0
Creating releases quickly without going to github.com
#github #bashrc #zshrc #programming

2024-10-05 09:03:06

- reply

read up on it a bit more I suggest adding samesite=strict to your csrf cookie

2024-10-04 17:01:21

- reply

then a 30second jwt cookie will probably do you fine

2024-10-04 15:23:33

- reply

just so we’re on the same page here
https://www.cloudflare.com/learning/security/threats/cross-site-request-forgery/
https://cdn.fosstodon.org/media_attachments/files/113/249/837/873/533/390/original/5a933bed04f848ae.png

2024-10-04 15:11:59

- reply

cookies are inherently vulnerable to crcf attacks even if you make the cookie lifetime 30s, it gives a window where technically, a forged request elsewhere could be triggered by the user.
The options at that point is to:
1. Shorten the crcf cookie lifetime (accept the vulnerability window)
2. Have the crcf call return the token in the resp body the return it in the secure request as a header using JS

2024-10-04 14:14:09

CRCF attacks are a limitation to cookie authentication, but that shouldn’t mean we should only use localstorage for our tokens, it should be a mix, cookies for session, localstorage for api/form requests

2024-10-03 07:51:51

- reply

I like your point on that the jwt might be signed but the cookie is not allowing for an attacker to steal the jwt and mitm it with their own cookie

2024-10-03 07:50:50

- reply

As this number only is changed when invalidation is required, I'm not too worried about *what if multinode db*
It can only be changed by someone with access to the database 🤷
https://github.com/stupidwebauthn/server/blob/dca8833a6e22d26dc43555c731f50c37df9969c0/src/index.ts#L98-L99

2024-10-03 07:23:20

How to Properly Type Window | Total TypeScript
#vite #typescript Keep coming back to this
https://www.totaltypescript.com/how-to-properly-type-window#solution-2-a-dts-file

2024-10-03 06:44:11

- reply

Essentially the only reason it needs to check into a database on every request is to validate a per user integer, allowing for backend cookie invalidation per user
Without, signed jwt’s arent able to be invalidated per user
JWT’s are not encrypted, JWE’s are:
https://stackoverflow.com/questions/454048/what-is-the-difference-between-encrypting-and-signing-in-asymmetric-encryption#454069
Use the word encrypted for a jwt miss informs newcomers

2024-10-03 06:09:01

- reply

Unless I’m not mistaken, encrypted cookie/jwt are only handy when you give the client sensitive data that they shouldn’t have access to, I do use them for validating session challenges — but for authentication, the jwt signature is the validation.

2024-10-03 05:44:00

Even when building a small web service it’s important to add support for #gdpr data and deletion requests
https://example.stupidwebauthn.site
Even for a passwordless passkey auth website
Now with a #GoLang sdk (the blue button)
#buildinpublic #programming #bunjs
https://cdn.fosstodon.org/media_attachments/files/113/241/869/052/641/860/original/6d5e7ddb11a50564.png

2024-10-02 16:42:28

- reply

assuming what you’re showing to me is a Firefox only css, should we just use
html[lang=“jp”] h1 {}

2024-10-02 05:51:46

- reply

while this is true, touching grass and coming back to it after a week/month would have resulted in a better outcome for everyone.

2024-10-02 04:38:24

- reply

Talk about doing something rash out of spite.
Yes the reviewer didn’t know what they were doing, but saying that replying back is too much of a hassle is peak social anxiety.

2024-09-29 13:28:32

- reply

password managers aren’t even necessary for passkeys as your device holds onto it instead, making the barrier to entry much lower

2024-09-29 13:22:44

- reply

I prefer it not to break, mpa & spa can be great or terrible either way

2024-09-29 13:19:56

- reply

I started with google login too, but instead of going back to passwords I’ve doubled down and moving the passkeys with email verification
https://fosstodon.org/@lil5/113213991971138277
I’m trying to make it easier for others to use as I go along
:ablobcathappypaws:

2024-09-28 18:10:09

- reply

interesting project PwdLess this works a bit the same (nonce sent to email -> cookie stores auth jwt) Inspired by this I’ll change my auth flow so you can be logged in without registering a passkey, but with the option to register one for easier access
PwdLess might not have a database but this removes the ability to add cookie invalidation
Say someone has a device stolen, you’d what to force a re-login

2024-09-28 14:30:05

- reply

PC windows has “windows hello” to enable passkey, I thought Firefox supported passkeys just fine. Android Firefox should work fine as well.
https://www.passkeys.io/compatible-devices
https://passkeys.dev/device-support/
Linux is the only outlier, but that should still work via a phone with a QR code

2024-09-28 08:14:21

- reply

Emails aren’t sending atm I’ll update this post when they are.
In the meantime it’s also possible to run this locally see the GitHub link for details

2024-09-28 07:33:31

- reply

as a go programmer I found the second last the most readable.
The last one is over engineered

2024-09-28 07:27:02

I’m attempting to make passwordless authentication accessible for developers
Here’s a working example you can try:
https://example.stupidwebauthn.site
- Email is used for verification
- Passkeys are used for authentication
- Sqlite is used for database
- Api calls and JWT secrets are used for internal connections
- JWT & JWE is used for session security
GitHub if you want to run it locally:
https://github.com/stupidwebauthn/example
#programming #Passkeys #webauthn #WebDev
https://cdn.fosstodon.org/media_attachments/files/113/213/988/431/540/644/original/d4d90d431b315450.mp4

2024-09-24 09:00:04

useIsSSR – React Aria
https://react-spectrum.adobe.com/react-aria/useIsSSR.html
useIsSSR returns true during server rendering and hydration, and updates to false immediately after hydration

2024-09-24 05:55:55

- reply

my worry is that of cookie dns hijacking - iirc that’s reasonably defended against with hsts headers https & secure http-only cookies
I’m also planning to add a flow for double checks with a shorter expiry time say 1 hour (logged in, but requires to authenticate with their passkey again, for super important tasks)

2024-09-23 09:48:47

https://github.com/lil5/passwordless_fd/tree/main/server#flows
Building an authentication server for passwordless authentication NO PASSWORDS INCLUDED!!!
Registration: Sends email for account creation, then requests a passkey
Login: Client asks first for an email, then lists connected passkeys to login with
Work in progress... please let me know what you think
#passkey #webauth #passwordless

2024-08-27 22:13:27

- reply

Who knows I might migrate to a smaller server in the future, it was fun but now I feel lost in a sea of boosts.

2024-08-27 22:10:20

I’m more active on #lemmy at this point:
#mastodon fells more like a influencer-subscriber media.
Where the most active users are also the most popular & get an absurd large comment count
While all other posts from the less popular accounts never get commented on

2024-08-24 09:14:38

- reply

I’m confused, you don’t need to open your ports to ssh into GitHub’s, unless this is a restriction in your network.
You can always test your ssh connection with “ssh -T git@github.com”

2024-08-23 18:44:22

- reply

I’m not sure this is The Guardian’s issue, even if you login to The Guardian, if this is an embedded YouTube video, google is primarily responsible, only able to view this if your logged in to google.
Hear me out The Guardian should be hosting videos on their site themselves, (Peertube instance?)

2024-08-19 18:55:48

Just deleted my #lemmy account
https://github.com/LemmyNet/lemmy/issues/4967
Currently votes are setup in a way setup for abuse.

2024-08-19 14:38:05

- reply

The onus is not on the EU, that we currently have these horrible cookies banners, if you write your websites correctly you don’t even need them.
These banners are so annoying because websites attempt to force you into compliance, making it difficult to reject.
E.g.: A website is full capable to hide the banner if the browser sends a “do not track”
#analytics is still possible look at https://umami.is/ for example.
If you do not like these banners complain to the websites.

2024-08-19 13:15:10

- reply

> Using len() on a string in Go returns the number of bytes, not the number of runes.
This is wild to me when working with runes.
But then again when working with file contents “string([]byte{})” it starts to make more sense.

2024-08-19 12:22:40

- reply

Ghost emoji in #golang has a length of 4
Whilst in #javascipt it length is 2

2024-08-19 12:04:58

- reply

https://github.com/cdfmlr/ellipsis
fixes this and does not break emojis

2024-08-19 11:55:39

Emoji's are great to test if your code works well with strings
#golang
https://cdn.fosstodon.org/media_attachments/files/112/988/551/091/827/163/original/451869fcefc9bc30.png

2024-08-19 10:50:56

- reply

personally I prefer Bruno
Based on a collection of plain text files
With vim bindings, multi editor support, cli & gui
#bruno
https://www.usebruno.com/

2024-08-12 13:10:26

- reply

if err != nil { return nil, err }

2024-08-11 18:57:33

- reply

days off help

2024-08-11 10:57:24

- reply

that was beautiful, thank you

2024-08-10 15:52:32

- reply

this is the single reason I will only use matrix[dot]org. Federation was obviously a marketing ploy rather than a base component.

2024-08-07 13:48:54

- reply

https://cdn.segmentnextimages.com/wp-content/uploads/2024/02/image-179.jpg
2nd and 3rd checkbox

2024-08-07 13:17:43

- reply

First 2 are already there, virtual box gives a poor example for how LM will work on your system.
3rd you just need to flip a switch in the steam settings to: enable proton on unverified games

2024-06-07 03:14:57

- reply

Looks like it needs a second coat of stickers.
Don’t worry you’ll get there.

2024-06-02 11:35:17

#HSTS #coolifyio #infosec
Here's a good explanation on what HSTS is and why it's important. https://www.maxivanov.io/http-strict-transport-security/ (there's a lot of bad explanations on the net)
I noticed the coolify.io website doesn't have these HSTS headers
https://github.com/coollabsio/coolify/discussions/2341