Forest @forestjohnson@pixie.town
- member of
- https://cyberia.club
- webmaster @
- https://capsul.org/
I am a web technologist who is interested in supporting and building enjoyable ways for individuals, organizations, and communities to set up and maintain their own server infrastructure, including the hardware part.
I am currently working full time as an SRE 😫, but I am also heavily involved with Cyberia Computer Club and Layer Zero
Joined Feb 2021
@zens@merveilles.town not exactly. React doesn't deal with template or html strings at all at runtime, it compiles to "hyperscript", aka, 1000s of "document.createElement()"s in a trenchcoat. And the hyperscript it generates is always fundamentally xss-proof unless you use the " danger" functions.
Other frameworks like angular 1.4 that used string templates were never fundamentally xss-proof... They were like input sanitizers, so it was always a cat and mouse game between attacker and defender.
There is a fundamental difference between trying to sanitize inputs vs explicit separation of code vs data. Similar to the difference between parameterized SQL queries and special "SQL template" tools that would try to sanitize inputs. There was a similar cat and mouse game w/ those.
@zens@merveilles.town I think the ppl saying "Dev experience" actually mean "corpo manager experience".
The frameworks do have benefits; they allow us to shed legacy and rename / deprecate things that have been named wrong for decades. For example, in react, `element.innerHTML` was renamed to `dangerouslySetInnerHTML`. Honestly this is the single best feature of react.
None of this matters if you are just trying to make a single user web tool or a blog. But if you're a corporate manager and you want to throw whatever programmers you can manage to retain at a problem, react is the obvious choice. Chances are you arent gonna get the budget it would take to hire ppl who have the 2-5 years of in-depth web platform experience that it seems to take to be able to really do complex web apps in vanilla js without accidentally creating arbitrary code execution from user-provided content.
I've helped a few folks with their first frontend projects outside of work, and I've found trivial xss every single time.
Yes there are tons of ways to mitigate xss, but none of them really shut the door on it with an ultimate eternal sealing spell like react does.
@vladh Probably anything you can do to help people avoid buying a new computer would have much more impact than changes focused on reducing the CPU consumption of software
@zens@merveilles.town I've heard this take a lot too, that usability is inherently exploitative in some way. That ez to use software is necessarily going to be serving a purpose other than offering utility to the user.
IMO its one of those things that is obviously not true, but might as well be true in the world that we live in.
I think its more accurate to say that software development is difficult and expensive, but some people manage to do it as a hobby or for the public good. HOWEVER, software development *including usability testing* is at least 10X MORE expensive, and practically no one has ever managed to come up with the scratch to do it outside of a commercial context. So all the effort tends to go into making it intuitive to buy loot boxes
> How do you give a novice user information like "This violated an SELinux policy"
1. disable SELinux
2. If you want to enable SELinux, you have to make a GUI for it -- you have to actually go into the SELinux source code and add the parts that will enable actual usability. Not to create a shitty error message like "This violated an SELinux policy", but to create an error message that contains the word "because".
------------------------
.. nobody has ever even TRIED to fix it.
Nobody ever tried to fix climate change either... But if we don't fix it, it's all over real quick.
I believe in an interpretation of what we observe about the universe that says that "what we observe is generally what was most likely to happen". aka "many worlds"
In a thousand years, the only likely outcome that anyone will be around to observe, is the outcome where we got thru it...
I took a heroic dose of psychedelics and saw the Golden Path, so I'm trying to walk it. Succeed or fail, don't care, at least I tried and did my best. Sue me.
@hp Yeah, that's what I'm saying, nobody has done it yet. But that doesn't mean its impossible. Windows is absolutely not the way, but I do believe that a well-documented HTTP-based UI for linux, systemd, and docker, could potentially be a home run.
It would have to include the linux installer too, including managing the installation from a phone, so you don't have to plug a kbd and mouse into the server.
The GNU suite of userland applications that we rely on for linux server administration, plus Systemd. They're great, buuuutt... They dont have any affordances, so they are a major no-go for the general public.
I think a replacement is in order. -- something that is readily available on every platform (iOS, Android, Windows, Mac), something that can list processes, list systemd service units, list docker containers.. do all the other CRUD operations on those, all the while offering commonly-legible affordances (not a manual that starts with "how to read this manual", but instead an explore-able UI that "shows and tells" instead of demanding that the user already becomes an expert before they use it)
We won't get anywhere until this kind of thing exists.. People aren't going to, en masse, wake up on day, find a $30,000 gold nugget under their couch to support themselves for the next year, and then think, hmm, you know what I should really spend my time on??? Reading through the linux man pages 10 times.
Yeah I hate that. Those people have a serious lack of imagination, creativity, and community spirit. But here's the thing.
They aren't wrong.
IT IS a massive pain in the ass. I know because I do it. I've been doing it for over 10 years, and now support services for 100+ people.
IMO tutorials and walkthroughs are great because they are part of building a new experience where it can be easier and it can be understandable in a shorter period of time.
But I'm not sure it's enough, I think we also need to take a critical look at, for example, the UI/UX of linux servers, and try to do better.
I agree with what the person said about NixOS and having techie folks create recipes that can be instantiated by others without the same amount of time investment. IMO something like that, plus usability testing, could make a huge difference.
Usability testing is basically impossible without $$$$ investment and business involvement, simply because of how labor-intensive, un-fun, it is, etc. But the good news is it only takes one -- it only takes one group to break through that barrier and produce a gem, and it can be copied the world over.
libde265 WASM embedded into go app, portable and cross platform
https://sequentialread.com/simple-windows-app-to-convert-heic-to-jpeg/
Now my mom can access her photos again 😤😤😤
@mjg59 not to mention that with LUKS, you don't lose access to the disk encryption key, because if you did, you wouldn't be able to use the computer anymore. You have to type it in every single time it boot.
IMO the real problem is that everyone has been giving up ownership of "their" computer, and are just now realizing that hmm, this might be a problem -- if its not yours, you won't have access to fix it in the event something does go wrong. And we all know Linux has its own fair share of ways to brick its boot process.
Forest
boosted
We specialise in Linux infrastructure and clients.
If you're looking to migrate away from Windows, reach out!
@genevieve thank goodness no hip replacement is needed 🥲
Forest
boosted
[object Object]
@zens@merveilles.town I think this is such a problem because most of the tools developers and power users use was developed in a commercial context and the bosses would only allow work to continue until the tool was able to perform its function, no more than that. So all of these things never had UIs made for them.
I feel like this is the great struggle of our time. I really believe if we got some of these critical missing UIs built, started unwinding this paradigm, the world could start to change pretty quickly
Forest
boosted
if mozilla is really serious about privacy they should hire the ublock origin creator and make him ceo
Forest
boosted
- member of
- https://cyberia.club
- webmaster @
- https://capsul.org/
I am a web technologist who is interested in supporting and building enjoyable ways for individuals, organizations, and communities to set up and maintain their own server infrastructure, including the hardware part.
I am currently working full time as an SRE 😫, but I am also heavily involved with Cyberia Computer Club and Layer Zero
Joined Feb 2021
