police are describing as a car-ramming attack

Call it what it is please.

Terrorism.

It’s a musical, the songs are catchy.

However I disliked how fast paced the writing was, and how even though it’s called “Hazbin Hotel” and the pilot framed it as a sort of slice of life “bunch weirdos” hanging out and getting redemption, instead that weirdly became the B plot?

Somehow they took the whole story and shifted it over to the B plot and pulled this other big high stakes thing out as the A plot.

That’s not really what I was wanting to watch, and it feels a bit like they hit swapped out the story on me, so I kinda got a bit turned off by that.

I don’t give a shit about some high stakes angels vs demons war end game shit.

I wanted to see interpersonal relationships of weirdos learning to co-exist.

Tl;dr: I was expecting something closer to The Good Place, but instead that got side lined by some huge MCU style plot no one asked for.

I use neorg for neovim, specifically I use:Neorg journal today to open up a daily .Norge file that I maintain notes, todo, etc on.

If I need to leave a note for myself for the future, I create a note for that day ahead of time.

Yup, I usually have it set to the slowest setting when typing.

I find I work much better and can think clearer while walking, as it keeps the blood flowing and makes me feel more awake and engaged.

If I have a tough problem I’m trying to work through I turn the speed up to a faster pace and sorta just work through it in my head while speed walking, often this helps a lot!

During meetings when I’m bored I also turn the speed up a bit.

I often get around 10k to 12k steps in a day now.

Note I don’t stay on the treadmill all day long, I usually clock a good 4 hours on it though.

Then I take a break and chill on the couch with my work laptop, usually I leave my more “chill” tasks like writing my tests for this part, and throw on some Netflix while I churn all my tests out.

Highly recommend it, I’ve lost a good 15ish lbs now in the past year since I started doing it, and I just generally feel a lot better, less depressed, less anxious :)

From my experience the only big changes I’d say I made overtime are:

1. Font size bumped up

2. Switched to neovim from visual studio, which took like a year to relearn my entire workflow (100% worth it though)

3. Switched from multiscreen setup to one single big screen (largely due to #2 above no longer needing a second screen, tmux+harpoon+telescope+fzf goes brrrr)

4. Switched to a standing desk with a treadmill, because I became able to afford a larger living space where I can fit such a setup.

If I were to do this meme though it’d mostly be #1, there just came a day when I had to pop open my settings and ++ the font size a couple times, that’s how I knew I was getting old.

Men work more overtime, take on more risks, and are more willing to put themselves in danger.

Men get paid more, because they are willing to pay the extra pound of flesh it demands, because they have a bit more flesh to offer. Men have higher average stamina, physical strength, and physical resilience.

I won’t necessarily say that’s a good thing, but it’s a fact. There’s a reason all the dangerous jobs are male dominated, but simultaneously men die on the job or get severely maimed substantially more.

Interestingly enough if you look at a woman dominated industry that is extremely dangerous abd demands a pound of flesh (like prostitution) suddenly the gender gap flips heavily the other way.

As I always say, you don’t see people talking about gender disparity of garbage truck drivers and other areas of the sanitation industry, even though there’s a lot of disparity over there.

Why aren’t people complaining about the lack of women in the sanitation industry? Weird, huh?

You can’t “invoke logic via HTML attributes,”

Oh boy a semantic argument

Proceeds to describe how you can use HTMX to invoke logic via HTML attributes

Whatever you want to call it, trigger, invoke, whatever.

You can leverage HTML attributes to automatically cause arbitrary Javascript ajax calls to happen by extension if those attributes being present.

Trying to argue the semantics of this is stupid.

You put HTML attributes on shit, and the presence of those attributes in turn causes arbitrary Javascript client side logic to fire off purely due to the presence of those attributes.

That’s like, literally it’s entire shtick.

And any web dev who remotely understands the point of CSP and why it was created, should instantly have alarm bells going off at the concept of triggering arbitrary ajax via html attributes.

“HTMX doesn’t bypass CSP! It just (proceeds to describe the exact mechanism by which it bypasses CSP)”

It’s bonkers how many people don’t grok this, SMH.

I see you don’t understand what the word “if” means, and you also don’t understand modern js practices.

That’s like saying you “serve React client side” and “transpile JavaScript into more JavaScript.” Jesus, I feel like I’m taking crazy pills.

You don’t serve react client side, any junior dev is familiar with transpiling framework code to produce their website. Yes, you 100% transpile react code before serving it, the fact you dont understand what I am talking about speaks volumes. It’s clear this whole time I’ve been having a discussion with someone who doesn’t even know the absolute bare minimum of day 1 front end dev. If you don’t understand how literally normal and industry standard something as basic as transpiling js is, you have literally zero business spreading info about something far more serious as HTMX.

You are in zero way qualified to be recommending anyone expose their websites to the security nightmare that is HTMX, stop spreading misinfo, stop encouraging devs to do so.ething stupid, and go learn the basics of FE dev practices.

If you don’t understand the tools of the trade, stop spreading terrible info about them online.

Everything you have written in this entire thread has made everyone who has read it stupider and you have actively made the internet a worse place. You are a prime example of the exact thing that is wrong with web devs nowadays.

Go back to the drawing board, you have a LOT to learn still it sounds like.

Just to be clear, are you talking about some kind of templating library that literally transpiles all the htmx logic and instead packs it into individual ajax logic in js files “per element”, such that you don’t need to serve htmx client side and instead you pre-transpile all the ajax logic out to separate files?

Cause the very start of my statements was that if we had something like that then HTMX would be fine, as a templating lib that transpiled out to html+js.

That you can CSP lockdown, because now you no longer are able to invoke arbitrary logic with html attributes, only the explicitly transpiled ajax can and all concepts of htmx have been actually removed from the final html+js you actually serve to the client.

If that is what you are talking about above, then please link me because that sounds awesome and is what HTMX outta be, and would remove all of its security issues.

If that’s not what you are talking about, and you truly dont understand the fact that you can’t compare an html element that triggers logic (which you can’t CSP block), to a script chunk that performs logic (which you can CSP block), then I think you do indeed need to go read up on and understand what the point if CSP is and why it was implemented in browsers.

The two are apples and oranges. HTML elements should not be capable of invoking logic arbitrarily, that violates a core principle of html.

That’s not broad enough.

If you in any way have functionality that handles anything remotely requiring security, do not use HTMX.

This goes way beyond “parameterized endpoints”.

Listen extremely closely and pray to God anyone dev with more than 2 brain cells groks how serious th8s vulnerability is:

HTMX enables arbitrary invocation of ANY api endpoint with cookies included, through html attributes, which inherently can’t be covered by Content Security Policy

This is deeply important for any web dev worth their salt to understand.

Sanitizing User input should be your LAST layer of defence against attack vectors. Not, NOT, your first and only

It’s supposed to be your “break in case of emergency” system, not your primary (and only remaining) defense layer.

why you didn’t properly sanitize user input

This is like someone pointing out that blowing a giant hole in the hull of your ship causes it to take on water, and you respond by asking “well why aren’t you bailing out the water with a bucket?”

You do understand why Content Security Policy exists, and what it is for… right?

“We don’t need a watertight ship hull for the voyage, just reinvent and implement a bunch of strapping young lads that 24/7 bail water out of the ship as it sails, it’s faster and more efficient than doing something crazy like building your ship to be secure and water tight.”

CSP allows you to whitelist/blacklist arbitrary Javascript, and ideally you completely blacklist online js from being executed at all, such that only .js files of same domain can be invoked by your website.

This serves the role of locking down injection attacks, only your explicitly approved Javascript can be invoked.

HTMX enables invoking of logic via HTML attributes on HTML elements… which CSP can’t cover

Which means you re-open yourself to injection attacks via HTML. Attackers can inject an HTML element with HTMX attributes and no amount of CSP will stop HTMX from going “Okey doke!” And invoking whatever the attributes say to do.

This effectively shoots even a completely locked down CSP config square in the nuts, totally defeating the entire point of using it.

It’s a cute idea but what is needed is a way to pre-emptively treat HTMX as a template file that transpiles everything out so the ajax happens in a separate .js file

If we had that, then it’d be safe and secure, as the whole “htmx attributes on elements” thing would just be a templating syntax, but when transpiled it wouldn’t be supported anymore so attackers can no longer inject html as an attack vector

Doesn’t matter, the entire implementation principle of how HTMX works and what it does inherently bypasses CSP. There’s no getting around that.

You fundamentally are invoking logic via HTML attributes, which bypasses CSP

Unfortunately it also kicks Content Security Policy square in the nuts and shoots a giant hole right through your website security, so if anyone on my team brings up using it I inform them it’s an instant security fail if we so much as touch it.

It’s a cute idea but horribly implemented. If your website has any security requirements, do not use htmx

That’s a very very long list…

Debian + Cinnamon desktop which inck7des the countless tools that come with that stack.

• Termux on my phone
• Zsh as my debian shell
• OpenSSH
• OpenVpn
• tmux + tmuxinator
• neovim, and dozens of plugins/tools with that
• dart
• flutter
• large chunks of Node.js and the npm ecosystem
• dotnet framework and countless nuget packages
• lazygit
• stable diffusion
• llama.cpp, and many tools built on top of that
• k3OS running Rancher
• my entire selfhosted stack on the above which includes but is not limited to:
  • Shinobi
  • Bitwarden
  • Gogs

Compile the application yourself, usually.