Top all-time · #16795
Sander Mak
Personal blog · branchandbound.net/blogprogrammingsecurity
Sander Mak writes Branch and Bound, a personal blog at branchandbound.net about programming and security. Since 2012, 4 different Hacker News readers have linked it 30 times, most often “Some AngularJS pitfalls”. The last post was in 2017, but the archive is still widely read.
Most-linked posts?
- Some AngularJS pitfalls2 people · 2 mentions · first linked 2013-08-05
What Hacker News says?
The vulnerability even has a name: Cross-build injection attacks. I wrote about it some time ago [1], [2]. The complete answer includes verifying the (now mandatory) PGP signatures [3] of artifacts in Maven Central. But you need a web-of-trust for that and the whole process is rather impractical currently. [1] http://branchandbound.net/blog/security/2012/03/crossbuild-i... [2] http://branchandbound.net/blog/security…
Comment linking /blog/security/2012/08/verify-dependencies-using-pgp/
on “How to take over the computer of a Maven Central user”Submitted Some AngularJS pitfalls as a story · 89 points
HN discussionDoesn't that also involve an extra HTTP call? I discussed the same issue as OP a while ago: http://branchandbound.net/blog/web/2012/11/unify-server-side... Someone in the comments there mentioned a nice alternative to embeddding the data in a <script> tag to avoid the problem jashkenas raised (</script> in the JSON). Namely, setting it in a data- attribute.
Comment linking /blog/web/2012/11/unify-server-side-client-side-rendering-embedding-json
on “Avoiding Common Backbone.js Pitfalls”Submitted Scala is like Git as a story · 6 points
HN discussionIf you're fascinated by infinity, you should check out 'Infinity and the mind' by Rudy Rucker. It really puts the concept of infinity in it's historical perspective and even contains a unique conversation between Rucker and Godel. (shameless plug: I wrote a review on my blog http://branchandbound.net/blog/bookreview/2013/01/bookreview... )
Comment linking /blog/bookreview/2013/01/bookreview-infinity-and-the-mind/
on “Take It to the Limit (2010)”Submitted Show HN: Java 9 Modularity, my upcoming book, just had its early access release as a story · 3 points
HN discussionAgreed. I tried to explore this issue a while back: http://branchandbound.net/blog/web/2012/11/unify-server-side... Turns out that using script-tags is somewhat problematic, but as a comment points out, data-attributes could work.
Comment linking /blog/web/2012/11/unify-server-side-client-side-rendering-embedding-json/
on “Some AngularJS pitfalls”Submitted Facebook announces Apollo: 'consistency at scale' as a story · 3 points
HN discussionTo see an example of the sibling comments, see http://branchandbound.net/blog/web/2013/08/some-angularjs-pi...
Comment linking /blog/web/2013/08/some-angularjs-pitfalls/
on “Little-known directives of Angular.js”Submitted Launching Scalabitz as a story · 3 points
HN discussionI'm biased (currently authoring http://shop.oreilly.com/product/0636920049494.do ), but I believe categorising the new module system as just something organisational is a bit too dismissive. The module system brings two essential features: reliable configuration and strong encapsulation. Both are a boon for modular development and I believe all but trivially small codebases can benefit. Reliable configuration means…
Comment linking /blog/java/2015/10/osgi-to-jigsaw/
on “Java 9 Enters First Bug Fixing Round”Submitted Automatic-Module-Name: Calling All Java Library Maintainers as a story · 2 points
HN discussionAnd even the established ones which do require signing are not really trivial to use correctly: http://branchandbound.net/blog/security/2012/08/verify-depen...
Comment linking /blog/security/2012/08/verify-dependencies-using-pgp/
on “Building HTML5 Apps with Yeoman and Backbone”Submitted From OSGi to Jigsaw (Java 9 Modules) as a story · 2 points
HN discussionOne thing that always motivates me is thinking about the amount of time the audience is investing in you. If you're speaking to 100 people, that's a solid 100 hour investment. This helps me put the time I need for preparation in perspective. It may seem crazy to spent hours and days to prepare a one hour talk, but it's not really not if you think about it like this. Some more thoughts I've written on preparing a tec…
Comment linking /blog/conferences/2012/06/preparing-a-technical-talk/
on “Protips for Conference Talks”Submitted On monoliths, microservices and critical thinking as a story · 2 points
HN discussionSome more background information can be found in this blogpost: http://branchandbound.net/blog/scala/2013/05/launching-scala... Scalabitz was built using Scala, Play and a bit of Akka.
Comment linking /blog/scala/2013/05/launching-scalabitz
on “Show HN: first weekend project, find interesting Scala content with Bit.ly's API”Submitted The Road to Data Science as a story · 2 points
HN discussionSubmitted Ng-conf 2014: the world's first AngularJS conference as a story · 2 points
HN discussionSubmitted A failed experiment: improving the Builder pattern as a story · 2 points
HN discussionSubmitted The Java Modularity Story as a story · 2 points
HN discussionSubmitted Annoyances in the daily life of a developer as a story · 2 points
HN discussionSubmitted A year of blogging analyzed using R as a story · 2 points
HN discussionSubmitted Cross-build injection attacks: how safe is your build? as a story · 2 points
HN discussionSubmitted Exploring Angular2 as a story · 1 points
HN discussionSubmitted Unify client-side and server-side rendering by embedding JSON as a story · 1 points
HN discussionSubmitted Cryptographic signature verification of build dependencies as a story · 1 points
HN discussionSubmitted Preparing a technical talk as a story · 1 points
HN discussion