Just a lvl 28 guy from Finland. Full-stack web developer and Scrum Master by trade, but more into server-side programming, networking, and sysadmin stuff.

During the summer, I love trekking, camping, and going on long hiking adventures. Also somewhat of an avgeek and a huge Lego fanatic.

  • 0 Posts
  • 18 Comments
Joined 2 years ago
cake
Cake day: June 20th, 2023

help-circle
  • As someone living in a green country, could someone explain how things work in practice in the yellow or orange countries? I understand that in places like Russia or China, journalists can end up in prison, or worse, if the government doesn’t like their writing. But how exactly is the press not free in countries like Canada or most European nations that are labeled yellow here?

    And why is the US labeled orange? As far as I know, the media there is highly politically polarized, with most major news organizations openly supporting a particular agenda. That’s certainly a serious issue and not how the press should operate, but even Trump’s government isn’t actively limiting the freedom of the press to report on issues like they see fit? Or am I mistaken? I’m genuinely asking.



  • They can include runnable JavaScript too, which can cause vulnerabilities in certain contexts. One example from work some years back: We had a web app where users could upload files, and certain users could view files uploaded by others. They had the option to download the file or, if it was a file type that the browser could display (like an image or a PDF), the site would display it directly on the page.

    To prevent any XSS (scripts from user-provided files), we served all files with the CSP sandbox header, which prevents any scripts from running. However, at the time, that header broke some features of the video player on certain browsers (I think in Safari, at least), so we had to serve some file types without the header. Mistakenly, we also included image files in the exclusion, as everyone through image files couldn’t contain scripts. But the MIME type for SVG files is image/svg+xml… It was very embarrassing to have such a simple XSS vuln flagged in a security audit.


  • I don’t have an answer for you, but I can absolutely relate. Some people say something like “find a job you love, and you’ll never work a day in your life.” But for me, it doesn’t work that way. I like my job, have awesome coworkers, and always look forward to the next week. But obviously I’d still rather be doing things I enjoy more. You know, playing that latest video game, finally finishing the Lego set I bought three months ago, hanging out with friends, etc. Two days out of seven just isn’t enough time to do all that, which leads to anxiety about optimizing the little time I have.

    One thing that has helped me somewhat (and I know I’m very privileged to be able to do this) is taking every other Friday off. A two-day weekend versus a three-day weekend makes a huge difference for me. I’m actually considering switching to having every Friday off. But then ofc, there might be the dilemma of having the time to do the things I enjoy but not enough money for them :(















  • Empire of the Ants by Bernard Werber

    This was the book that got me to stop hating books.

    I didn’t like reading as a child or teenager until I was forced to read this one for a mandatory book report in high school and really, really liked it. I don’t know why, I don’t even remember that much about the book, but it got me interested in science fiction and reading in general.