"🍌 is so close to 🍒" still could be true though!

(assuming it's an old-school machine with rotating drums which could have those symbols adjacent)

it's also what I predicted 💪🏻

wtf it's even using React!

so maybe IDEs should just have an integrated web panel like they do a terminal 🤷🏻‍♂️

the one benefit I can think of is: being in the terminal lets you embed yourself in arbitrary IDEs

cleaner than a separate GUI window, but without the overhead of maintaining separate extensions for intellij, vscode, zed, etc.

> Automatically closes inactive tabs and makes it easy to get them back

noooo they need to go into the void, never to be recovered

but ok yeah that seems pretty great, and even open source!

So much going on here...

The link to their website is an outlook safelinks url?

They're not even a security company, they're a "hide the fact you used an LLM" tool???

Yeah, as a security engineer, for me this falls into the bucket of being an essentially free way to prevent some hypothetical attack we haven't thought of yet

Partitioning the cache by tenant very slightly reduces hit rate, but you'll sleep better at night knowing there's no novel attacks out there

Sketch implementation: for a user A, hash pairs of phone numbers for each of their contacts. Sort the numbers before hashing so it might be A||B, C||A, A||D, etc.

Those get uploaded to bsky, and the client gets a list of hits back -> this tells them which of their contacts have bsky accounts

Perhaps this double-opt-in is the key? If you can only get a hit when *both*
A's contact list includes B
*and*
B's contact list includes A, I think that could work safely?

> I started refactoring [...], but I haven't finished updating [...]
> I’ll continue adapting those paths, unless you’d prefer I pause here.
🥺

bot's sleepy, wants a rest

Honestly it's of marginal benefit here, but definitely a useful header to know about

Based on @filippo.abyssdomain.expert's investigation, this header is how the latest Go version implements cross-site request forgery detection

Yup! In that case you'll get

Sec-Fetch-Site: same-site

Because the request comes from the same registered domain

Whereas for an exact hostname match, you'd get:

Sec-Fetch-Site: same-origin

(Other values: "none" if a user clicked 'open image in new tab', or 'cross-origin' for someone hotlinking)

Provided the favicon service is running on the same domain, you can probably use the Sec-Fetch-Site header

Allowing anything except a "cross-site" value is equivalent to your current referrer check (but would work even if referrers aren't sent)

Still a dead/pinned butterfly based on the wing position