mtw.

1.3K posts

mtw. banner
mtw.

mtw.

@mtw_dev

prev: @rainbowdotme @tryfragile

Sumali Aralık 2009
238 Sinusundan5K Mga Tagasunod
mtw.
mtw.@mtw_dev·
Cloudflare down again?
English
1
1
6
339
mtw. nag-retweet
Chris Rodriguez
Chris Rodriguez@imagecrate·
A rough exploration of what inline questions could feel like in ai chats. Got the idea while thinking about ways to mitigate context pollution
English
0
1
18
1.1K
mtw.
mtw.@mtw_dev·
Weaving some traditional danish cord today
mtw. tweet mediamtw. tweet media
English
0
0
0
197
mtw. nag-retweet
Chris Rodriguez
Chris Rodriguez@imagecrate·
Any companies looking for a designer to contract and help out for the next few weeks/months?
English
1
1
9
1.8K
mtw.
mtw.@mtw_dev·
There’s a fine line between a bus and an ambulance
English
0
0
0
81
joshpuckett
joshpuckett@joshpuckett·
I was nervous to fuzzy match on name, so it's exact match on email! The most fun part making this was writing a hundred little notes like this to people who inspire me, in case they joined. I'm sure only a handful will ever see them, but it brought me joy and I hope it does to you, too.
English
16
0
393
16.9K
joshpuckett
joshpuckett@joshpuckett·
As software gets easier to make, the products that stand out will be the ones crafted with uncommon care. If that's the kind of work you want to do, I'm sharing everything I know: interfacecraft.dev
English
348
265
5.6K
1.1M
mtw.
mtw.@mtw_dev·
Why am I so into motion design and micro interactions lately
English
1
0
0
173
mtw. nag-retweet
notch
notch@notch·
@theo Installed any neat NPM packages lately?
English
147
55
2.7K
447.7K
mtw.
mtw.@mtw_dev·
@GigaBasedDad Yes and buy one from my brother so I can help him make more please. #information" target="_blank" rel="nofollow noopener">slowhouse.co/shop/mooney-co…
English
0
0
0
191
Giga Based Dad
Giga Based Dad@GigaBasedDad·
Build your wife the perfect console table
English
3
14
301
28.5K
mtw.
mtw.@mtw_dev·
I’ve never seen someone quad down before. I’m almost impressed.
Harjot Gill@harjotsgill

As the dust settles, I want to apologize for my strongly worded response to Aiden. It was excessive, even considering the inflammatory tone of his messages toward our company and staff, and I should have handled it more professionally. Below is a more detailed explanation of the situation, and I ask for patience and understanding from everyone. It started when Aiden posted that he hates our product with a "burning passion" without providing any context. That provocative statement understandably prompted a response from our team, who politely asked for feedback. From my perspective, he shared feedback centered on an atypical usage of the product, along with commentary delivered in a condescending tone. As a leader, I do not tolerate situations where our team is spoken down to or treated dismissively. That was the point at which I unfortunately lost my cool and responded in a manner I now regret. My response was not representative of how we engage with users who provide feedback in a constructive and respectful way. I want to thank the users who took the time to share their perspectives, both those who voiced support and those who raised thoughtful concerns about our approach to feedback. We are fully aware that our product is not perfect and that there are rough edges, and we rely on thoughtful, constructive feedback to help us identify and improve them. It means a great deal to me and to our team. I also want to thank the thousands of CodeRabbit users who have provided feedback over the years and helped us improve the product. Without them, we would not be where we are today. I've learned several lessons from this incident, and those lessons will stay with me for a long time. I hope others can learn from it as well. I wish everyone happy holidays and a happy New Year, and I'm looking forward to building on a strong year as we head into 2026.

English
0
0
1
528
mtw.
mtw.@mtw_dev·
Someone please help me draw a logo 😭
English
8
0
7
230
mtw.
mtw.@mtw_dev·
@yslmammi You aren’t grinding hard enough. Needs to be every week. Use a different surname.
English
0
0
15
13.6K
𝒶rα˚˖𓍢ִ໋
𝒶rα˚˖𓍢ִ໋@yslmammi·
tip for newlyweds: send a wedding invite to every billionaire whose address you can find because it's a 50/50 chance their assistants just send you a perfunctory gift without ever wondering who the hell you are
English
89
1.4K
42.6K
2.1M
mtw.
mtw.@mtw_dev·
@commando_skiipz This is rage bait. Any one with a brain is gonna find your encryption logic client side then it doesn’t matter at all. Aka it’s wasted ops
English
0
0
1
111
Ghost St Badmus
Ghost St Badmus@commando_skiipz·
This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.
Ghost St Badmus tweet media
Prime 👨🏽‍💻👾🤖@prime_sui

Never thought encrypting your password before sending to your backend was a thing until 2 days ago

English
100
124
829
216.4K
mtw. nag-retweet
Nate
Nate@natebirdman·
after a few years of effort, i'm fairly sure we're the only way you can do this: 100 performance on mobile lighthouse 100% shared ui, framework, routing, data, etc native and web with a hydrated React client app
Nate tweet media
English
18
8
203
37K
mtw. nag-retweet
Nate
Nate@natebirdman·
This works today on @one__js, the most slept on framework SSR, SSG and SPA, per page or global, typed loaders, hand off between any page seamlessly. Preload next page and loader on hover. Typed params and links. Nice docs. Hono prod server built in. Yada yada
Tanner Linsley@tannerlinsley

Purely static sites were possible with Start, but we’re trying to make it a bit easier. And opt in per page! And gracefully upgrade to spa of you enter on a hydrated page. WIP github.com/TanStack/route…

English
3
5
48
12.7K
mtw.
mtw.@mtw_dev·
Someone is trying to be sneaky. The latest CVE has brought a whole bunch of people trying random things on our apps. cc @rauchg
mtw. tweet media
English
1
0
1
351