• 0 Posts
  • 106 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle



  • Don’t use JSON for the response unless you include the response header to specify it’s application/json. You’re better off with regular plaintext unless the request header Accept asked for JSON and you respond with the right header.

    That also means you can send a response based on what the request asked for.

    403 Forbidden (not Unauthorized) is usually enough most of the time. Most of those errors are not meant for consumption by an application because it’s rare for 4xx codes to have a contract. They tend to go to a log and output for human readers later, so I’d lean on text as default.





  • I just recently started working with ImGui. Rewrite compiled game engines to add support for HDR into games that never supported it? Sure, easy. I can mod most games in an hour if not minutes.

    Make the UI respond like any modern flexible-width UI in the past 15 years? It’s still taking me days. All of the ImGui documentation is hidden behind closed GitHub issues. Like, the expected user experience is to bash your head against something for hours, then submit your very specific issue and wait for the author to tell you what to do if you’re lucky, or link to another issue that vaguely resembles your issue.

    I know some projects, WhatWG for one, follow the convention of, if something is unclear in the documentation, the issue does not get closed until that documentation gets updated so there’s no longer any ambiguity or lack of clarity.





  • Either do a left join and repeat all the post values for every tag or do two round-trip queries and manually join them in code.

    JSON_ARRAYAGG. You’ll get the object all tidied up by database in one trip with no need to manipulate on the receiving client.

    I recently tried MariaDB for a project and it was kinda neat, having only really messed with DynamoDB and 2012 era MsSQL. All the modern SQL languages support it, though MariaDB and MySQL don’t exactly follow the spec.



  • ShortFuse@lemmy.worldtolinuxmemes@lemmy.world-----BEGIN PRIVATE KEY-----
    link
    fedilink
    arrow-up
    15
    arrow-down
    1
    ·
    edit-2
    2 months ago

    Yeah, except for the first few bytes. PKCS8 has some initial header information, but most of it is the OCTET_STRING of the private key itself.

    The PEM (human “readable”) version is Base64, so you can craft up a string and make that your key. DER is that converted to binary again:

    /**
     * @see https://datatracker.ietf.org/doc/html/rfc5208#section-5
     * @see https://datatracker.ietf.org/doc/html/rfc2313#section-11
     * Unwraps PKCS8 Container for internal key (RSA or EC)
     * @param {string|Uint8Array} pkcs8
     * @param {string} [checkOID]
     * @return {Uint8Array} DER
     */
    export function privateKeyFromPrivateKeyInformation(pkcs8, checkOID) {
      const der = derFromPrivateKeyInformation(pkcs8);
      const [
        [privateKeyInfoType, [
          [versionType, version],
          algorithmIdentifierTuple,
          privateKeyTuple,
        ]],
      ] = decodeDER(der);
      if (privateKeyInfoType !== 'SEQUENCE') throw new Error('Invalid PKCS8');
      if (versionType !== 'INTEGER') throw new Error('Invalid PKCS8');
      if (version !== 0) throw new Error('Unsupported PKCS8 Version');
      const [algorithmIdentifierType, algorithmIdentifierValues] = algorithmIdentifierTuple;
      if (algorithmIdentifierType !== 'SEQUENCE') throw new Error('Invalid PKCS8');
      const [privateKeyType, privateKey] = privateKeyTuple;
      if (privateKeyType !== 'OCTET_STRING') throw new Error('Invalid PKCS8');
      if (checkOID) {
        for (const [type, value] of algorithmIdentifierValues) {
          if (type === 'OBJECT_IDENTIFIER' && value === checkOID) {
            return privateKey;
          }
        }
        return null; // Not an error, just doesn't match
      }
    
      return privateKey;
    }
    

    I wrote a “plain English” library in Javascript to demystify all the magic of Let’s Encrypt, ACME, and all those certificates. (Also to spin up my own certs in NodeJS/Chrome).

    https://github.com/clshortfuse/acmejs/blob/96fcbe089f0f949f9eb6830ed2d7bc257ea8dc32/utils/certificate/privateKeyInformation.js#L40

    Edit: To be specific, PKCS8 is usually a PKCS1 (RSA) key with some wrapping to identify it (the OID). The integers (BigInts) you pick for RSA would have to line up in some way, but I would think it’s doable. At worst there is maybe a character or two of garbage at the breakpoints for the RSA integers. And if you account for which ones are absent in the public key, then anybody reading it could get a kick out of reading your public certificate.



  • ShortFuse@lemmy.worldtoMemes@lemmy.mlplease
    link
    fedilink
    arrow-up
    3
    ·
    edit-2
    3 months ago

    No. Microsoft is not liable, at least when it applies to HIPAA.

    The HIPAA Rules apply to covered entities and business associates.

    Individuals, organizations, and agencies that meet the definition of a covered entity under HIPAA must comply with the Rules’ requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. If a covered entity engages a business associate to help it carry out its health care activities and functions, the covered entity must have a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do and requires the business associate to comply with the Rules’ requirements to protect the privacy and security of protected health information. In addition to these contractual obligations, business associates are directly liable for compliance with certain provisions of the HIPAA Rules.

    If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules. See definitions of “business associate” and “covered entity” at 45 CFR 160.103.

    https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html


  • ShortFuse@lemmy.worldtoMemes@lemmy.mlplease
    link
    fedilink
    arrow-up
    18
    ·
    edit-2
    3 months ago

    HIPAA doesn’t even require encryption. It’s considered “addressable”. They just require access be “closed”. You can be HIPAA compliant with just Windows login, event viewer, and notepad.

    (Also HIPAA applies to healthcare providers. Adobe doesn’t need to follow HIPAA data protection, though they probably do because it’s so lax, just because you uploaded a PDF of a medical bill to their cloud.)




  • There is no section 15 or 16 in GPLv3, but I did find section 7 saying:

    Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or

    But that’s an optional thing that you must add onto the GPLv3 license. I’ll have to keep that in mind for the future.

    That would explain why what I’ve read mentioned it’s not guaranteed in GPLv3 (when comparing to MIT). I’ll have to figure out what that notice would look like.