- May 2023
-
askubuntu.com askubuntu.com
-
You can diminish the size of the journal by means of these commands: sudo journalctl --vacuum-size=100M This will retain the most recent 100M of data. sudo journalctl --vacuum-time=10d will delete everything but the last 10 days.
.
-
-
www.postgresql.org www.postgresql.org
-
ISO 8601 specifies the use of uppercase letter T to separate the date and time. PostgreSQL accepts that format on input, but on output it uses a space rather than T, as shown above. This is for readability and for consistency with RFC 3339 as well as some other database systems.
-
-
rado0z.github.io rado0z.github.io
Tags
Annotators
URL
-
-
stackoverflow.com stackoverflow.com
-
Stop to think about "normal app" as like desktop app. Android isn't a desktop platform, there is no such this. A "normal" mobile app let the system control the lifecycle, not the dev. The system expect that, the users expect that. All you need to do is change your mindset and learn how to build on it. Don't try to clone a desktop app on mobile. Everything is completely different including UI/UX.
depends on how you look at it: "normal"
-
-
stackoverflow.com stackoverflow.com
-
lso, really look closely into SignalR, as the Android and iOS clients aren't... uhm... great
-
-
stackoverflow.com stackoverflow.com
-
Entropy is not a property of the string you got, but of the strings you could have obtained instead. In other words, it qualifies the process by which the string was generated.
-
-
www.wolfram.com www.wolfram.com
-
-
writings.stephenwolfram.com writings.stephenwolfram.com
-
datatracker.ietf.org datatracker.ietf.orgrfc67491
-
The credentials should only be used when there is a high degree of trust between the resource owner and the client (e.g., the client is part of the device operating system or a highly privileged application)
Tags
Annotators
URL
-
-
www.sumologic.com www.sumologic.com
-
Have you seen mobile phone lock screens where the user is required to draw a specific pattern onto a grid of dots? How about the Windows 8 picture password feature? These are examples of behavior-based authentication factors.
Behavior factors seems like an artificial distinction, at least based on these examples. These would be better classified as Knowledge factors. Drawing a pattern that you've memorized is conceptually no different than typing a code. Or should I point out that typing a code is also a behavior? You have to press your fingers in a certain location on your keyboard and in a certain order.
-
-
www.pcmag.com www.pcmag.com
-
“Multi-factor authentication needs multi-factor enrollment,” noted Taku. It shouldn’t have been possible to enroll just using a stolen password. He listed numerous possibilities, among them credentials handed out in person, a one-time password, or a PIN sent to the employee’s registered email or mobile.
-
-
github.com github.com
-
I'd like to discuss over a PR.
.
-
- Apr 2023
-
datatracker.ietf.org datatracker.ietf.org
-
The 409 (Conflict) or 415 (Unsupported Media Type) status codes are suggested
-
If the target resource does not have a current representation and the PUT successfully creates one, then the origin server MUST inform the user agent by sending a 201 (Created) response. If the target resource does have a current representation and that representation is successfully modified in accordance with the state of the enclosed representation, then the origin server MUST send either a 200 (OK) or a 204 (No Content) response to indicate successful completion of the request.
-
-
en.wikipedia.org en.wikipedia.org
-
Whereas U2F only supports multi-factor mode, having been designed to strengthen existing username/password-based login flows, FIDO2 adds support for single-factor mode.
-
-
bugs.ruby-lang.org bugs.ruby-lang.org
-
why not allow block forwarding without capturing: foo(&) foo(1, 2, &)
Tags
Annotators
URL
-
-
linrunner.de linrunner.de
-
In particular, with AC connected, a battery with a charge level higher than the stop charge threshold will not be discharged to the stop charge threshold, nor will there be a (cyclic) discharge down to the start charge threshold
Tags
Annotators
URL
-
-
linrunner.de linrunner.de
-
Limiting the maximum charge level to below 100%: stop charge threshold
Tags
Annotators
URL
-
-
linrunner.de linrunner.de
-
There are three migration paths:
-
-
askubuntu.com askubuntu.com
-
You can indeed prolong moderns Li-Ion batteries lifespan by keeping them at a lower charge. If you never ever use it disconnected, you should keep it at 40%. E.g. Uber driver cellphone always-on in travels. However for daily light usage, 60% is considered the 'sweet spot' for practicality, and 80% gives you more freedom. 100% is when the battery is at its peak 'stress' level, and thus wear faster.
-
-
batteryuniversity.com batteryuniversity.com
-
Exposing the battery to high temperature and dwelling in a full state-of-charge for an extended time can be more stressful than cycling.
-
-
github.com github.com
-
Discharges your battery until it reaches 80%, even when plugged in
-
This tool makes it possible to keep a chronically plugged in Apple Silicon Macbook at 80% battery, since that will prolong the longevity of the battery.
Tags
Annotators
URL
-
-
www.kickstarter.com www.kickstarter.comTerminus1
-
www.kickstarter.com www.kickstarter.comIndio1
-
www.kickstarter.com www.kickstarter.com
-
www.kickstarter.com www.kickstarter.comSoiled1
-
security.stackexchange.com security.stackexchange.com
-
If you send links with a secret login token with email, then they should be single-use and expire rather quickly.
-
But you can not make the user send a POST requests from an email
eh? how??
-
Sorry, I can't agree with you. If someone issues a second code, they should have two potential logins - one for each one they requested. Call me weird, but considering how cheap it is to store data, I'd rather keep around exactly what happened.
-
If you implement this system using the user table you risk impatient users requesting a second code and them arriving out of order.
-
By default SMTP offers very little protection against interception. Traffic may be encrypted between servers but there are no guarantees.
And how likely is it that the attacker actually owns one of the servers that is a hop on the way from mail sender to mail recipient?? Seems extremely unlikely.
-
email as a transmission mechanism isn't secure.
-
If the link can only be used once with a short expiry time and no info in the link can be used to derive secrets in the session it creates then you should be fine. Effectively, the link serves as an one-time password.
-
If so, then how is sending a link for password reset any more secure? Isn't logging-in using a magic link the same thing as sending a magic link for resetting a password?
In my opinion: It's not any different or less secure.
-
-
www.dictionary.com www.dictionary.com
-
À la carte can be now used figuratively to describe someone who picks some things out of a larger set, e.g., an à la carte Catholic who (conveniently) believes in some aspects of the religion, but not others. À la carte television refers to customers paying for just channels they want, rather they having to pay for a whole (cable) service.
Tags
Annotators
URL
-
-
en.wikipedia.org en.wikipedia.org
-
Google allowed third parties to build their own Wave services (be it private or commercial) because it wanted the Wave protocol to replace the e-mail protocol.[2][16][17] Initially, Google was the only Wave service provider, but it was hoped that other service providers would launch their own Wave services, possibly designing their own unique web-based clients as is common with many email service providers.
-
-
en.wikipedia.org en.wikipedia.org
Tags
Annotators
URL
-
-
www.mathsisfun.com www.mathsisfun.com
Tags
Annotators
URL
-
-
stackoverflow.com stackoverflow.com
-
You can do an Nth root by raising to a fractional power. For example, the 4th root of 625 is 5. (BigDecimal(625)**(1.0/4.0)).to_f # => 5.0
-
-
pages.nist.gov pages.nist.gov
-
A given secret from an authenticator SHALL be used successfully only once.
-
For look-up secrets that have less than 64 bits of entropy, the verifier SHALL implement a rate-limiting mechanism that effectively limits the number of failed authentication attempts that can be made on the subscriber’s account as described in Section 5.2.2.
-
-
en.wikipedia.org en.wikipedia.org
-
what-if-origin.sciesnet.net what-if-origin.sciesnet.net
Tags
Annotators
URL
-
-
en.wikipedia.org en.wikipedia.org
-
-
Similar to Base64, but modified to avoid both non-alphanumeric characters (+ and /) and letters that might look ambiguous when printed (0 – zero, I – capital i, O – capital o and l – lower-case L).
-
A variant of Base58 encoding which further sheds the lowercase 'i' and 'o' characters in order to minimise the risk of fraud and human-error.
-
-
api.rubyonrails.org api.rubyonrails.org
Tags
Annotators
URL
-
-
-
-
en.wikipedia.org en.wikipedia.org
-
a change in a weight of evidence of 1 deciban (i.e., a change in the odds from evens to about 5:4) is about as finely as humans can reasonably be expected to quantify their degree of belief in a hypothesis
Tags
Annotators
URL
-
-
en.wikipedia.org en.wikipedia.org
-
average level of "information", "surprise", or "uncertainty"
I like the use of "surprise" here
-
the entropy of a random variable is the average level of "information", "surprise", or "uncertainty" inherent to the variable's possible outcomes
-
-
-
-
But in reality, what we witness is the emergent patterns from each individual starling simply doing it darndest not to collide with the starlings nearby.
-
-
extension.oregonstate.edu extension.oregonstate.edu
-
Cloche Seven pieces of 10-foot ½-inch PVC pipe One piece of 10-foot roll galvanized plumbers' metal stripping to attach PVC to sideboards every 2 feet. 28 1-inch roofing nails
-
-
www.androidpolice.com www.androidpolice.com
-
www.reddit.com www.reddit.com
-
stackoverflow.com stackoverflow.com
-
Using --ours did what I was after, just discarding the incoming cherry picked file. @Juan you're totally right about those warning messages needing to say what they did't do, not just why they didn't do it. And a bit more explanation that the ambiguity from the conflict needs to be resolved (by using --ours, etc) would be super helpful to this error message.
-
--ignore-unmerged When restoring files on the working tree from the index, do not abort the operation if there are unmerged entries and neither --ours, --theirs, --merge or --conflict is specified. Unmerged paths on the working tree are left alone. Holy smokes! I guess the git-ish fix for the user interface problem here will be to rename the option from --ignore-unmerged to --ignore-unmerged-except-in-cases-where-we-do-not-want-to-allow-that--consult-documentation-then-source-code-then-team-of-gurus-when-you-cannot-figure-it-out---and-wait-while-half-of-them-argue-about-why-it-is-right-as-is-while-the-other-half-advocate-adding-four-more-options-as-the-fix.
-
In recent git versions, git restore is supposed to be a "better" way to revert undesired local changes than the overloaded checkout. Great, that sounds reasonable - a nice simple purpose-built tool for a common operation.
-
-
blog.cloudflare.com blog.cloudflare.com
-
If the chicken must come before the egg, where do you put the chicken?
If the chicken must come before the egg, where do you put the chicken?
Tags
Annotators
URL
-
-
stackoverflow.com stackoverflow.com
-
If the chicken must come before the egg, where do you put the chicken?
If the chicken must come before the egg, where do you put the chicken?
-
Since nobody provided a wire capture, here's one.
-
The rest of the URL (/path/?some=parameters&go=here) has no business being inside ClientHello since the request URL is a HTTP thing (OSI Layer 7), therefore it will never show up in a TLS handshake (Layer 4 or 5). That will come later on in a GET /path/?some=parameters&go=here HTTP/1.1 HTTP request, AFTER the secure TLS channel is established.
-
-
en.wikipedia.org en.wikipedia.org
-
It is the conceptual equivalent to HTTP/1.1 name-based virtual hosting, but for HTTPS.
Tags
Annotators
URL
-
-
softwareengineering.stackexchange.com softwareengineering.stackexchange.com
-
users/me feels like a bad idea because REST prefers to have one url per resource. You will then have: users/me users/123myId Which point to the same resource.
-
If you work with hateos better supply a link to your own resource.
-
-
blog.hubspot.com blog.hubspot.com
-
Why do so many businesses share their data openly, for free? Most often, the answer is scale. As companies grow, the staff within those companies realize they have more ideas than they have the time and resources to develop them. It’s typically easier to work with other external companies that specialize in these ideas than build them in-house. By creating APIs, a company allows third-party developers to build applications that improve adoption and usage of its platform. That way, a business can build an ecosystem that becomes dependent on the data from their API, which often leads to additional revenue opportunities.
-
-
learn.microsoft.com learn.microsoft.com
-
Clients interact with a service by exchanging representations of resources.
-
A primary advantage of REST over HTTP is that it uses open standards, and does not bind the implementation of the API or the client applications to any specific implementation.
-
-
stackoverflow.com stackoverflow.com
-
-
I would say you have one API with 3 endpoints
-
-
-
:"signed_up_but_#{resource.inactive_message}"
-
-
www.dekudeals.com www.dekudeals.com
-
The first Mr. DRILLER game for the Nintendo Switch™ featuring updated graphics and HD cutscenes!
Ambiguous. Missing a comma before "featuring"?
Tags
Annotators
URL
-
- Mar 2023
-
en.wikipedia.org en.wikipedia.org
Tags
Annotators
URL
-
-
en.wikipedia.org en.wikipedia.org
-
Impersonation is a security concept implemented in Windows NT that allows a server application to temporarily "be" the client in terms of access to secure objects.
-
-
github.com github.com
-
before_action -> { doorkeeper_authorize! :public }, only: :index
-
-
github.com github.com
-
Looking SO good. Will do a final check and merge when I get home. Meanwhile it seems addressing most of houndci comments and waiting for a green CI will be enough! Thanks for your hard and good work.
-
-
stackoverflow.com stackoverflow.com
-
This leads to an override of the controller as well
-
What you're actually trying to do is to have the exact same behaviour that native Devise implementation but on an Engine via API
-
-
I know that Devise offers these capabilities, but it's hard to make out how to do it without hitting their preconfigured (view?) routes.
-
-
stackoverflow.com stackoverflow.com
-
-
uninclude a module
-
-
stackoverflow.com stackoverflow.com
-
uninclude a module
-
-
-
inline(:C)
inline(:C)
-
-
github.com github.com
-
user = User.new(password: "あ" * 25) # 25 characters, 75 bytes
characters vs. bytes
-
-
www.makeuseof.com www.makeuseof.com
-
pages.github.com pages.github.com
-
-
www.freehosting.com www.freehosting.com
-
-
blog.cloudflare.com blog.cloudflare.com
-
Because they follow this specification, most authoritative DNS servers won't allow you to include CNAME records at the root. At CloudFlare, we decided to let our users include a CNAME at the root even though we knew it violated the DNS specification. And that worked, most of the time. Unfortunately, there were a handful of edge cases that caused all sorts of problems.
-
The Inflexibility of DNS Traditionally, the root record of a domain needed to point to an IP address (known as an A -- for "address" -- Record). While it may not seem like a big deal, tying a service to an IP address can be extremely limiting.
-
-
hub.docker.com hub.docker.com
-
Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. This is the default and is easy and fairly transparent to the user. The downside is that the files may be hard to locate for tools and applications that run directly on the host system, i.e. outside containers. Create a data directory on the host system (outside the container) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The downside is that the user needs to make sure that the directory exists, and that e.g. directory permissions and other security mechanisms on the host system are set up correctly.
Tags
Annotators
URL
-
-
www.cbtnuggets.com www.cbtnuggets.com
-
legitimate form of privilege escalation
-
-
en.wikipedia.org en.wikipedia.org
-
-
Generally speaking, privilege escalation means getting more rights in the system than you already have.
-
-
doorkeeper.gitbook.io doorkeeper.gitbook.io
-
stackoverflow.com stackoverflow.com
-
Problem details for HTTP APIs HTTP status codes are sometimes not sufficient to convey enough information about an error to be helpful. The RFC 7807 defines simple JSON and XML document formats to inform the client about a problem in a HTTP API. It's a great start point for reporting errors in your API. It also defines the application/problem+json and application/problem+xml media types.
-
Michael Kropat put together a set of decision charts that helps determine the best status code for each situation. See the following for 4xx status codes:
-
HTTP is an extensible protocol and 422 is registered in IANA, which makes it a standard status code. So nothing stops you from using 422 in your application. And since June 2022, 422 is defined in the RFC 9110, which is the document that currently defines the semantics of the HTTP protocol:
-
-
developer.mozilla.org developer.mozilla.org
-
stackoverflow.com stackoverflow.com
-
HTTP 400 is the right status code for your case from REST perspective as its syntactically incorrect to send sales_tax instead of tax, though its a valid JSON.
-
Ideal Scenario for 422: In an ideal world, 422 is preferred and generally acceptable to send as response if the server understands the content type of the request entity and the syntax of the request entity is correct but was unable to process the data because its semantically erroneous.
-
Exactly my thoughts on the matter! I'm coming from XML SOAP background and concept of schema just got into my blood and JSON documents rather don't announce their schema. To me it's whether server "understands" the request or not. If server doesn't know what "sales_tax" is then it's simply 400: "I have no idea what you sent me but definitely not what I want.".
-
As I said above, the deciding factor is what is meant by syntax. If the request was sent with a Content Type of application/json, then yes, the request is syntactically valid because it's valid JSON syntax, but not semantically valid, since it doesn't match what's expected. (assuming a strict definition of what makes the request in question semantically valid or not). If, on the other hand, the request was sent with a more specific custom Content Type like application/vnd.mycorp.mydatatype+json that, perhaps, specifies exactly what fields are expected, then I would say that the request could easily be syntactically invalid, hence the 400 response.
-
Just because the code is described as part of the WebDAV spec doesn't mean it's WebDAV-specific! Status codes are supposed to be generic.
-
Missing field can be a field that has not been sent and that's clearly a 400 to me, because the app cannot understand this payload, it violates the contract. IMHO, 400 suits better to not well-formed JSON, JSON that has different key names (contract violation) and JSON that one or more of the field(s) contents is from another type, let's say, you expect a int and got an object. Even not null constraint can be in both status codes, 400 if field not sent at all (and most frameworks understands it as null), and 422 if sent but with null value.
-
Just let me get this straight, is RFC 7231 the latest? If so, there is no mention of 422 in there so does that mean it's now obsolete?
-
I rolled back your edit because the double negative was very deliberate - I explicitly would not claim correctness, just lack of clear incorrectness
-
Your answer (422) makes sense to me. This is also what Rails (respond_with) uses when a resource couldn't be processed because of validation errors.
-
-
www.rfc-editor.org www.rfc-editor.org
-
15.5.21. 422 Unprocessable Content The 422 (Unprocessable Content) status code indicates that the server understands the content type of the request content (hence a 415 (Unsupported Media Type) status code is inappropriate), and the syntax of the request content is correct, but it was unable to process the contained instructions. For example, this status code can be sent if an XML request content contains well-formed (i.e., syntactically correct), but semantically erroneous XML instructions.
-
-
www.cleaneatingkitchen.com www.cleaneatingkitchen.com
-
Cook Mode Prevent your screen from going dark
-
-
support.google.com support.google.com
-
Is there anyway around the 1 yr limit ? I have been a google user for 10+ years and recently was going to move from Australia to America and as such updated my location. The move however didnt work out and now back in Australia I am unable to access many of the local apps due to my location being locked to the US.
-
-
www.ghacks.net www.ghacks.net
-
For those who wish to conceal their location from Google, keep in mind that you use Google services under license agreement. That’s a contract. Google is within their legal rights to know under which country’s laws that agreement is being made. Google is liable for honoring each country’s laws.
-
Google claims: “We associate your Google Account with a country (or region) so that we can better provide our services to you.” I call 100% smelly bug-ridden B.S. This is obviously some crap written by their nasty lawyers to protect Google’s well-exposed and ugly backside. Google couldn’t give a rat’s ass about any of us. They’ve made that clear by their actions time and time again.
-
-
-
For example, when the user is logging in and we get back an OTP_REQUIRED error code, we can prompt the user for their TOTP using a friendly UI. But if we receive the OTP_INVALID error code, we can display an error message instead.
.
-
Why the 2 separate steps for this? Simple: to make things easier on the front-end side of things. Sending 2 different error codes, one for when the OTP is required but missing, and one where the OTP was provided but invalid, allows us to adjust our login UI accordingly.
-
We're going to define a has-many relationship for a user's second factors, to be able to support multiple second factor types, e.g. TOTP, backup codes, or hardware keys.
-
-
But first, an important note — friends don't let friends use SMS 2FA.
-
-
fidoalliance.org fidoalliance.org
-
Passkeys Accelerating the Availability of Simpler, Stronger Passwordless Sign-Ins
-
User Experience The user experience will be familiar and consistent across many of the user’s devices – a simple verification of their fingerprint or face, or a device PIN, the same simple action that consumers take multiple times each day to unlock their devices.
-
Also, service providers can offer passkeys without needing passwords as an alternative sign-in or account recovery method.
-
When a user is asked to sign-in to an app or website, the user approves the sign-in with the same biometric or PIN that the user has to unlock the device (phone, computer or security key). The app or website can use this mechanism instead of the traditional (and insecure) username and password.
-
-
-
If you can unlink your address from a locked out account and then link it to a new account and add new 2FA factors to new account, and basically set it up again to be a replacement nearly identical to the original... how is that any different / more secure than just using a "reset account" feature that resets the original account (removes 2FA)?
We're still back to the recurring original problem with account security where the security of your account comes down to the security of your linked e-mail account.
-
-
github.blog github.blog
-
Twenty-eight (28) days after you enable 2FA, you’ll be asked to perform a 2FA check-up while using GitHub.com, which validates that your 2FA setup is working correctly. Previously signed-in users will be able to reconfigure 2FA if they have misconfigured or misplaced second factors during onboarding.
-
The strongest methods widely available are those that support the WebAuthn secure authentication standard. These methods include physical security keys, as well as personal devices that support technologies, such as Windows Hello or Face ID/Touch ID.
-
We strongly recommend the use of security keys and TOTPs wherever possible. SMS-based 2FA does not provide the same level of protection, and it is no longer recommended under NIST 800-63B.
-
-
-
We now take an opinionated stance on which second factor you should set up first – you'll no longer be asked to choose between SMS or setting up an authenticator app (known as TOTP), and instead see the TOTP setup screen immediately when first setting up 2FA.
-
-
blog.cmpxchg8b.com blog.cmpxchg8b.com
-
The problem with using SMS-2FA to mitigate this problem is that there’s no reason to think that after entering their credentials, they would not also enter any OTP.
-
I assume anyone interested in this topic already knows how phishing works, so I’ll spare you the introduction. If a phishing attack successfully collects a victim's credentials, then the user must have incorrectly concluded that the site they’re using is authentic.
-
discussions about SMS-2FA get heated very quickly. I've found that SMS-2FA deployment or advocacy has been a major professional project for some people, and they take questioning it's efficacy personally
-
Here are the main arguments I’ve heard for SMS 2FA: SMS 2FA can prevent phishing. SMS 2FA can’t prevent phishing, but it can prevent “credential stuffing”. We have data proving that SMS 2FA is effective. I’ll cover some other weaker arguments I’ve heard too, but these are the important ones.
-
I believe that SMS 2FA is wholly ineffective, and advocating for it is harmful.
Would this also appyl to OTP by e-mail??
-
Unique Passwords and U2F are not perfect, but they are good. Unique Passwords reduce the impact of phishing, but can’t eliminate it. U2F doesn’t prevent malware, but does prevent phishing.
-
This argument only works if what you’re defending is good. As I’ve already explained, SMS-2FA is not good.
-
Don’t let the perfect be the enemy of the good. Seat belts aren’t perfect either, do you argue we shouldn’t wear them? Etc, etc. This argument only works if what you’re defending is good. As I’ve already explained, SMS-2FA is not good.
-
If you also want to eliminate phishing, you have two excellent options. You can either educate your users on how to use a password manager, or deploy U2F, FIDO2, WebAuthn, etc. This can be done with hardware tokens or a smartphone.
-
You are currently allowing your users to choose their own password, and many of them are using the same password they use on other services. There is no other possible way your users are vulnerable to credential stuffing.
-
If you use a third party password manager, you might not realize that modern browsers have password management built in with a beautiful UX. Frankly, it’s harder to not use it.
-
If you’re a security conscious user... You don’t need SMS-2FA. You can use unique passwords, this makes you immune to credential stuffing and reduces the impact of phishing. If you use the password manager built in to modern browsers, it can effectively eliminate phishing as well.
not needed: password manager: 3rd-party
-
We have a finite pool of good will with which we can advocate for the implementation of new security technologies. If we spend all that good will on irritating attackers, then by the time we’re ready to actually implement a solution, developers are not going to be interested.
-
t’s important to emphasise that if you don’t reuse passwords, you are literally immune to credential stuffing.
Tags
- weak argument
- WebAuthn
- interesting point
- don't take it personally
- interesting way of thinking about it
- security: phishing
- good enough
- passwords: don't reuse passwords
- finite supply
- OTP by SMS
- authentication
- ineffective
- good point
- password manager: 3rd-party
- password manager: built into browser
- controversial
- not good enough reason/rationale/explanation
- differences of opinion
- passwords: use unique passwords
- not good
- security: credential stuffing
- not needed
Annotators
URL
-
-
dictionary.cambridge.org dictionary.cambridge.org
-
build something in/into something phrasal verb with build verb
-
-
www.reddit.com www.reddit.com
-
You can also find the combination verb+in+to, but in that case you're usually dealing with a phrasal verb consisting of a verb and the particle "in", which happens to be followed by the preposition "to".They wouldn't give in to our demands.
-
"Built in to" appears when you use the phrasal verb "build in" followed by an infinitive, but that is not what you are trying to do in your sentence.There's an electronic switch built in to stop all data transfers.
-
-
www.chompchomp.com www.chompchomp.com
-
The house, of course, is not doing the agreeing; Cooper is! Because of the distance between Cooper and the participle phrase that describes him, the comma is necessary.
-
A present participle phrase will always act as an adjective while a gerund phrase will always behave as a noun.
-
-
-
english.stackexchange.com english.stackexchange.com
-
So in your example, you would not use a hyphen: "You can use the types [that are] built in to the library."
-
How can this be called an adjective? The postmodifier here is a participle phrase, 'built into the library'.
-
take off, should also be counted as a (multi-word) verb.
-
Using a hyphen is the wrongest thing to do here.
-
-
stackoverflow.com stackoverflow.com
-
Unfortunately all SMS/voice gateway are owned by paid services, thus there is no such thing as open-source, that I can recommend.
-
Fortunately, we found RingCaptcha (https://ringcaptcha.com), which has a the 'starter plan' that offers free 500 OTP monthly. Just a small plug for them for providing freemium service; they are highly reliable because they are integrated with all major global, and regional providers, e.g., Twilio, Nexmo, Infobip, MessageBird, etc., and send your OTP through the best provider/route based on country/phone carrier, and can auto fallback to alternative paths. This means you just need to integrate with RingCaptcha, without the headache of deciding which SMS/voice OTP provider has best combination of price and reliability, which is a real headache when you are sending OTP world-wide.
-
-
apps.apple.com apps.apple.com
-
the issues I've always had with it: No support. As in, no one in Google's support organization has any clue about what this app does. No support group discussions as far as I can tell ("Smart Lock" is too generic to really find anything). That's not surprising, because while I've figured out how it works/what it does in my use case, there's really no clear documentation on it - like what it even does, really.
-
No support group discussions as far as I can tell ("Smart Lock" is too generic to really find anything).
too generic
-
-
www.arengu.com www.arengu.com
-
like the one in the picture.
.
-
-
-
stackoverflow.com stackoverflow.com
-
{{#discriminator.mappedModels}} {{#-first}} {{#vendorExtensions.x-useDeduction}} @JsonTypeInfo(use = JsonTypeInfo.Id.DEDUCTION) {{/vendorExtensions.x-useDeduction}} {{^vendorExtensions.x-useDeduction}}
-
-
www.quora.com www.quora.com
-
Most platforms that require OTP verification for ensuring security are targeted at the mobile phone only. But some payment gaterways send OTP to email address also simultaneously to doubly ensure that you get the OTP and that you have requested the OTP. There could be some delay in SMS or email reaching you. Many OTPs are time restricted - you have to use them quickly.
-
-
m.egwwritings.org m.egwwritings.org
-
It is a law of nature that our thoughts and feelings are encouraged and strengthened as we give them utterance. While words express thoughts, it is also true that thoughts follow words. If we would give more expression to our faith, rejoice more in the blessings that we know we have,—the great mercy and love of God,—we should have more faith and greater joy. No tongue can express, no finite mind can conceive, the blessing that results from appreciating the goodness and love of God. Even on earth we may have joy as a wellspring, never failing, because fed by the streams that flow from the throne of God.
Tags
Annotators
URL
-
-
datatracker.ietf.org datatracker.ietf.org
-
-
It is also used to migrate existing clients using direct authentication schemes such as HTTP Basic or Digest authentication to OAuth by converting the stored credentials to an access token.
-
-
github.com github.com
-
Double quotes for string literals - because pre-committing to whether you'll need interpolation in a string slows people down
Tags
Annotators
URL
-
-
datatracker.ietf.org datatracker.ietf.org
-
Another option would be to implement a delay scheme to avoid a brute force attack. After each failed attempt A, the authentication server would wait for an increased T*A number of seconds, e.g., say T = 5, then after 1 attempt, the server waits for 5 seconds, at the second failed attempt, it waits for 5*2 = 10 seconds, etc.
-
The reason for masking the most significant bit of P is to avoid confusion about signed vs. unsigned modulo computations. Different processors perform these operations differently, and masking out the signed bit removes all ambiguity.
-
The lack of interoperability among hardware and software technology vendors has been a limiting factor in the adoption of two-factor authentication technology. In particular, the absence of open specifications has led to solutions where hardware and software components are tightly coupled through proprietary technology, resulting in high-cost solutions, poor adoption, and limited innovation.
-
-
en.wikipedia.org en.wikipedia.org
-
www.networkworld.com www.networkworld.com
-
Protocols are, by their very nature, open. If you can't read the protocol specification then you can't very well implement it, can you?
-
As others pointed out, OATH's claims of "open source" have little meaning when compared to other authentication protocols such as SAML. When you include the entire Liberty Alliance specifications as well as the Web Services Initiative protocols and methods (as devised by Microsoft and IBM) there's nary a proprietary bit of code involved. Actually, there's no code involved at all. Protocols are, by their very nature, open. If you can't read the protocol specification then you can't very well implement it, can you?
-
-
en.wikipedia.org en.wikipedia.org
-
the output is 20 bytes, and so the last byte is byte 19 (0-origin).
-
It is suggested that verification be locked out after a small number of failed attempts or that each failed attempt attracts an additional (linearly increasing) delay.
-
-
en.wikipedia.org en.wikipedia.org
-
One-time passwords are generated on demand by a dedicated OATH OTP authenticator that encapsulates a secret that was previously shared with the verifier. Using the authenticator, the claimant generates an OTP using a cryptographic method. The verifier also generates an OTP using the same cryptographic method. If the two OTP values match, the verifier can conclude that the claimant possesses the shared secret.
-
-
www.mediawiki.org www.mediawiki.org
-
bitwarden.com bitwarden.com
-
We believe that being open source is one of the most important features of Bitwarden. Source code transparency is an absolute requirement for security solutions like Bitwarden.
Tags
Annotators
URL
-
-
www.pcmag.com www.pcmag.com
-
But getting codes by phone turns out not to be not very secure at all. A vulnerability in SMS messaging is that crooks can reroute text messages(Opens in a new window).
-
Unlike the other apps listed here, Authy requires your phone number when you first set it up. We're not fans of this requirement, since we’d rather have the app consider our phones to be anonymous pieces of hardware; and some have suggested that requiring a phone number opens the app up to SIM-card-swap fraud.
-
2FAS doesn't need your phone number or even require you to create an online account, so it's not susceptible to SIM-swapping fraud.
-
-
datatracker.ietf.org datatracker.ietf.org
-
The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.
-
-
github.com github.com
-
More maintained alternative: https://github.com/tinfoil/devise-two-factor
Tags
Annotators
URL
-