Stop using JSON Web Tokens for user sessions(ds-security.com)

63 points by Moneysac 2 years ago | 98 comments

WebAuthn.wtf(webauthn.wtf)

17 points by mooreds 3 years ago | 1 comments

Visual explanation of SAML authentication (2020)(sheshbabu.com)

70 points by rkwz 2 years ago | 27 comments

Why are banks still getting authentication so wrong?(jamal.haba.sh)

222 points by kamikazee 1 year ago | 290 comments

I close SSH port 22 (and what I use instead)(michelebologna.net)

42 points by speckx 2 months ago | 45 comments

Blogging Like a Hacker (2008)(tom.preston-werner.com)

78 points by tipiirai 2 years ago | 33 comments

Stop Using JWTs(gist.github.com)

455 points by dzonga 4 months ago | 265 comments

A GitHub Gist arguing that JWTs should not be used for keeping users logged in and that regular cookie sessions are a better, more secure choice.

API Shouldn't Redirect HTTP to HTTPS(jviide.iki.fi)

584 points by oherrala 2 years ago | 252 comments

Blog post arguing that APIs should fail visibly on plain HTTP requests instead of redirecting to HTTPS, noting many major API providers don't.

TODOs aren't for doing(sophiebits.com)

380 points by todsacerdoti 1 year ago | 218 comments

A blog post by Sophie Alpert arguing that TODO comments are valuable as documentation of known issues even if never acted on, and shouldn't be auto-deleted or tracked.

So you want to parse a PDF?(eliot-jones.com)

369 points by UglyToad 1 year ago | 199 comments

Blog post by Eliot Jones explaining how PDF parsing should work per the spec, covering headers, cross-reference tables, object offsets and trailers, and its real-world pitfalls.

AI will make formal verification go mainstream(martin.kleppmann.com)

782 points by evankhoury 10 months ago | 394 comments

Martin Kleppmann blog post predicting that AI will bring formal verification with proof assistants like Rocq, Isabelle and Lean into mainstream software engineering.

The path to ubiquitous AI (17k tokens/sec)(taalas.com)

804 points by sidnarsipur 8 months ago | 436 comments

Taalas blog post by Ljubisa Bajic arguing that latency and cost limit AI adoption and presenting its approach to very fast (17k tokens/sec) inference hardware.