fpereiro

Context: we've been using Azure Cache for Redis for about two years now. We have constant health checks that require a successful ping on redis. Normally, we might have a small connection issue every 2-3 days well outside office hours, not much else.

Over the last two days (June 8 and June 9) we have seen constant network issues between our runtimes (Hetzner, Western Europe) and Azure Redis. I cannot discard it being something on our end. But it is highly suspicious that we have Redis issues while we have minimal to no network issues with Azure Postgres, which is in the same zone as Azure Redis.

We see no issues reported by Azure, but that's not much of a reassurance. We've experienced Azure outages in the past (for example, sending of emails) that never had an official mention in any public status page.

If you're also experiencing network issues with Azure services in Western Europe, it'd be great to know we're not the only ones.

Sharing here very much in the spirit of being embarrassed by what I'm showing. I'm more excited about the ideas than the implementation. I'm very curious to hear about others building similar things, or trying out these types of tools.

The ideas are:

1. Use markdown for everything, even communicating with agents (dialogs) and orchestration patterns. 2. Use the browser as the UI. 3. Go full YOLO but every project lives in a Docker container where every single change generates an automatic git commit.

Honestly, I'm not sure who might be interested in it. I dream of this helping non-programmers build something locally and being able to peek through to see what the agent is doing. But then again, this requires to open the terminal and have Docker installed. That is a lot of friction. I'm thinking of building a cloud version.

If you made it this far, you can check it out here:

https://buildwithvibey.com

https://github.com/altocodenl/vibey

Hi HN! I am wondering if any of you is using a logging SaaS that you're happy with. I've been using logz.io but I am not impressed with it, and our team's research hasn't uncovered better alternatives.

In short, what we're looking for is: - Some service to which we can push our logs. - That will show our logs in their platform within 1-2 minutes of them being generated (almost real time). - That provides a decent UI for querying logs using free text search and date ranges. - That can let you set basic alerts to Slack. - That doesn't cost an absurd amount of money (< 1000x on the underlying computing resources).

Based on previous experience, I don't want to run (or use) Grafana or Loki. I'd rather use a good SaaS and pay ~100USD/mo for a relatively small volume of logs.

Do you have any alternatives that you're happy with?

Hi HN! Over the last three months I've written a treatise (fancy noun!) with a view to understand computation systematically. My goal was to create, at least for myself, a coherent picture of what's essential about all this bit pushing we do individually and societally. I intend to write something empowering and actionable to those of us trying to make sense of systems, as well as build (much) better systems.

It's about 40-50 pages long, so it's not short, and probably quite dense, despite me trying to make it as conversational as possible. I have a visual summary of it linked at the top but it's yet incomplete (still working on it).

My goal in posting it here is to get some feedback. I'm especially looking for thoughtful disagreement, particularly concerning my main points. Something quite at the top of Paul Graham's disagreement hierarchy. I'm really open to challenge to my main points; if what I wrote is any good, it should be anti-fragile and get better with a good critique. And if it doesn't, hey, at least I learned something!

A couple of days ago I posted it on the Future of Coding slack (very cool community, you should join us!) and got already feedback. Now I'm daring to put it here to see what happens.

Here it goes: https://github.com/altocodenl/todis

Thanks for reading!

Hi HN! Question for those with experience writing and/or auditing the auth flows of a web application. I recently decided to move my session cookies to HttpOnly, to mitigate the damage of a XSS attack.

To prevent CSRF, I was sending said session cookie as an extra field with every POST request (double submit cookie pattern: https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f). Now that the session is not readable from javascript, I need to create a separate CSRF token.

Based on great feedback from the community (see https://news.ycombinator.com/item?id=22209588 and https://github.com/fpereiro/backendlore/issues/12), I'm considering the following approach:

- On every successful login, create a new secret/token (using the same crypto mechanism I use to create the session secret, but a different secret altogether) and store it on the database, tied to the session itself. Set both the session and the CSRF token to expire at the same time. - Every time I get a request with a valid session, renew the life of both the session AND the associated CSRF token. - On every successful login, return the CSRF token in the body so that it can be read by client-side javascript. - Set up an endpoint to retrieve the associated CSRF token for its session. If no session is present (or the session has expired), return a 403 code. This also solves the problem of letting the client-side app know whether the user is logged in or not (I would hit this GET /csrf endpoint when the javascript loads to determine whether there's a valid session available).

My understanding is that, as long as the browser supports Same-Origin Policy (https://en.wikipedia.org/wiki/Same-origin_policy), a CSRF attacker could not submit a GET request to my server and obtain the result. If you see any security issues in the above scheme - or if you use a similar scheme and know it to be secure - please let me know. Thank you very much for your feedback!