[–] 4 points 9 months ago

Yea, well that was my first though, but then I though - why would chrome even allow any website to just arbitrary check which extensions you have installed.

So I checked the scripts and at this line the script is showing

async function fetchExtensionInfo(extensionId) {
  return new Promise((resolve) => {
    const url = `https://chromewebstore.google.com/detail/$%7BextensionId%7D`;

So I thought maybe they were calling the chromewebstore foreach plugin, and if you have an extension already installed, you get a different response than when you don't - or something.

But I suppose I'm wrong and for some reason a site can just ask the browser internally which plugins are installed

  • source
  • parent
  • context
  • [–] 2 points 9 months ago (2 children)

    Uhm, doesn't really sound like this could be true. Maybe I'm missing something?

    You'd see 2953 get requests in your network tab, right?

    And the article says:

    LinkedIn silently probes for 2,953 Chrome extensions on every page load.

    Surely it would be drastically noticeable if for every page load they do 3k get requests to the chrome store

  • source
  • [–] 3 points 9 months ago (1 child)

    I don't think this has been mentioned, but it kind of depends on where your multiple laptops / desktops are. Is this always on your own home network? Because in that case you don't even need a remote service like Github

    If so, you can create a network drive on any of the devices - mount the network device on your other devices, and then create a local git repo there. Just remember that using an external git service is also a backup. So if you do everything locally, make sure to have your own backups in place

    A much, much worse but also possible solution is to just put your projects into onedrive/dropbox/gdrive and sync it everywhere. It works for syncing, since you're saying that's the main objective - but you lose out on version control

  • source
  • [–] 5 points 9 months ago

    However, what is stopping a malicious actor from bypassing the API gateway and communicating directly to the micro services ? Do we solve this problem using a firewall, so only trusted traffic reaches the micro services ?

    Kind of - sort of

    With this kind of setup, usually you'd put all your micro services inside a VPC. The micro services wouldn't even be directly accessible from the internet. So it wouldn't really be a "firewall" - but a nat gateway.

    Though conceptually a little bit the same. The API gateway is kind of acting as a firewall

  • source
  • [–] 3 points 10 months ago

    To be fair, it's not that crazy - your agents are generating a lot of data that Azure DevOps is storing. And they're doing a bunch of other things like release management and showing test results over time, etc etc

    I'm using Azure DevOps practically free - (unless I build way too much and run out of free credits for the month)

    But since so many things in Azure DevOps are already free.. If you're going to start substituting the paid features like extra build agents with your own "free self hosted agents" then where are they getting any money from?

  • source
  • parent
  • context
  • [–] 4 points 1 year ago (2 children)

    Pretty cool. I tried to google it, and I couldn't actually find the source for it. Just a bunch of articles about it and a reddit thread.

    I'm curious what it's written in

  • source
  • [–] 12 points 1 year ago (2 children)

    On September 19, Ruby Central, a nonprofit organization that manages RubyGems.org, a platform for sharing Ruby code and libraries, asserted control over several GitHub repositories for Ruby Gems as well as other critical Ruby open source projects that the rest of the Ruby development community relies on.

    Uhm, so how does this happen? If some people create Ruby Gems and host them under their own github account, how would Ruby Central suddenly assert control over them?

  • source
  • view more: ‹ prev next ›