Client side verification is just security by obscurity, which gains you very little.
If someone is capable of MITM attacking a user and fetching a password mid-transit to the server over HTTPS, they are surely capable of popping open devtools and reverse engineering your cryptographic code to either a) uncover the original password, or b) just using the encrypted credentials directly to authenticate with your server without ever having known the password in the first place
deleted by creator
You are acting like someone checked off a “log passwords” box, as if that’s a thing that even exists
Someone configured a logger to write HTTP bodies and headers, not realizing they needed to build a custom handler to iterate through every body and header anonymizing any fields that may plausibly contain sensitive information. It’s something that literally every dev has done at some point before they knew better.
What (widely popular) race could possibly be a better metric of endurance than the marathon?
It’s not uncommon to see certain sites to only work on chromium because the dev used the filesystem APIs that don’t exist on FF
It’s not necessary but there is no reason not to.
Pros:
Cons:
venv/bin/python3 instead of just python3 in the run line of your dockerfile
COVID has long lasting effects across your entire body, it impacts your immune and cardiovascular systems for years after you get it.
Risks of heart attack, stroke, etc are increased 2.5x in the year after infection, increasing exponentially with the number of times you have been infected. In fact, the risk of pretty much ANY health problem skyrockets following a COVID infection.
Yes, but if someone trips over the cord there is a 50% chance the wrong side comes unplugged and potentially kills them, hence why they don’t make these cords
More, but not way more - they would be licensing window IoT, not a full blown OS, and they wouldn’t be paying OTC retail rates for it.
These people aren’t placing bets on who they want to win, they are placing bets where the house odds differ from the actual expected outcome. The people throwing big money on this are doing it based on actual data (amalgamating polls, etc), not just gut feelings.
If I think Kamala has a 45% chance of winning the election and the bookie is giving her implied odds of 40%, I should take that bet, because even though I think she will lose, I stand to make a 12.5% ROI on my bet. I can then hedge that bet on another bookmaker giving a 48% implied odds, and if enough people do this the bookmakers odds will converge on 44%
but either way I don’t think this “market” knew more than the mainstream media was telling us.
No, but it is a culmination of all the available public information (and some private information you won’t find elsewhere) in a single metric. If you read a single article you would assume there is either a 100% Biden drops out or a 0% chance - if you read every single news article in existence, aggregated all social media buzz, polls, etc, into a statistical likelihood, you would likely come out with a number that closely matches the odds.
Biden was only going to drop out once, so you can’t say how closely these odds matched the actual likelihood on this specific measure, but if you analyze hundreds of predictive markets like this, the implied odds pretty strongly correlate with the actual binomial outcomes
It’s unavoidable - once the cheese gets hot enough the steam will either force the liquid cheese out of existing holes, or it will make its own holes.
Make sure they are fresh out of the freezer when you put them in, as this lets the outside crisp up more before the inside becomes lava. Once you get close to the prescribed cooking time, you need to just sit in front of the oven door and watch them, and as soon as 2-3 break open, take the whole tray out
You can just point your domain at your local IP, e.g. 192.168.0.100
10 days without food hits differently when you are hiking through mountains 16 hours a day vs sitting on your couch
Right? it screams wayyyy pre-y2k but MySQL was only release in 95
will it become a relic of the past?
Probably
why YEAR in the first place, who would actually make use of it?
Accounting systems in the 90s that needed to squeeze out every drop of performance imaginable
I expect it won’t
The year datatype is a 1 byte integer, but the engine adds/subtracts 1900 to the value under the hood and has special handling for zero.
If you need to store more than 255 years range, you can use a 2 byte integer, which doesn’t need that special handling under the hood, because with 2 bytes you can store 65000+ years
Especially because a 15% tip is almost twice as good as it was 10 years ago due to rising food costs
There are like 10,000 different solutions, but I would just recommend using what’s built in to python
If you have multiple versions installed you should be able to call python3.12 to use 3.12, etc
Best practice is to use a different virtual environment for every project, which is basically a copy of an existing installed python version with its own packages folder. Calling pip with the system python installs it for the entire OS. Calling it with sudo puts the packages in a separate package directory reserved for the operating system and can create conflicts and break stuff (as far as I remember, this could have changed in recent versions)
Make a virtual environment with python3.13 -m venv venv the 2nd one is the directory name. Instead of calling the system python, call the executable at venv/bin/python3
If you do source venv/bin/activate it will temporarily replace all your bash commands to point to the executables in your venv instead of the system python install (for pip, etc). deactivate to revert. IDEs should detect the virtual environment in your project folder and automatically activate it
No it doesn’t, if they intercept an encrypted password over HTTPS they can resend the request from their own browser to get access to your account
What is the problem with that? The password is secure and only shared between you and the site you are intending to communicate with. Even if you sent an encrypted password, they wrote the client side code used to generate it, so they can revert it back to its plaintext state server side anyways
How would you verify it then?
If not sending plaintext passwords was best practice then why do no sites follow this? You are literally posting to a site (Lemmy) that sends plaintext passwords in its request bodies to log-in