we met in a field

i plucked a fruit from your veins

you encouraged me to eat

i exchanged with you a name.

.

i kept you close inside a jar

and with time, you turned sour

you encouraged i add water

lest it be the final hour.

.

my glass turned pink

with the hue of your skin

you explained - it's drink,

you encouraged me to sip

.

i never knew beauty

like your taste upon my lips

you are my favorite poison

and i have now, not a drip.

In lieu of the recent Gillette ad, and seeing as the conversation around it has stirred the pot quite a bit, I wanted to propose a conversation where we start from the very beginning:

Without yet talking about subsets, variants, or interpretations of masculinity/femininity (toxic or otherwise). How do you define it for yourself: what makes you masculine or feminine, or what parts of you would you describe as such, do you feel that those things go as universal descriptors or are they specific to your case?

There may also be some deeper questions in here about where you think you gained this conception (your family? your immediate circle of contacts? Role models?) or who you think best embodies your ideal definition of your gender.

I'd say something here about thinking a monthly thread for this is better or something, but that would be a lie and the truth is that I was busy during Christmas and subsequently forgot to post this thread for about three weeks running. Sorry about that.

Feel free to talk about something you saw that was cool, something that was bad, ask for recommendations, or anything else you can think of.

If you want to, feel free to find the thing you're talking about and link to its Anilist, MAL, or any other anime/manga database you use!

So I have all my passwords, TOTP backup codes, and account recovery codes in my password manager (Bitwarden.) In turn, Bitwarden is secured with a master password and TOTP 2FA. I have a recovery code for the 2FA in the event that I can't get to andOTP anymore (2FA app.) The thing is, where do I put that code? I can't put it in a note app or anything, because if I'm locked out of Bitwarden, I don't have my passwords. Do you see my problem? I was thinking about physically writing it down, but that makes me nervous because I might lose it. Are there any good solutions to this problem?

Releases of the week 12/01/2019 - 18/01/2019

Featured Release

James Blake - Assume Form (Alternative R&B, Art Pop)

"After dropping two new songs yesterday — the subtle trapper “Mile High” and the haunting “Lullaby For My Insomniac” — James Blake reveals today the entirety of Assume Form, his fourth full-length to date and follow-up to 2016’s The Colour In Anything. It’s available to stream in full below via Apple Music and Spotify.
The album spans 12 tracks, including last year’s excellent “Don’t Miss It”, and features guest spots from Travis Scott, Metro Boomin, Rosalía, André 3000, and Moses Sumney. Blake previously contributed to the most recent full-length efforts from Oneothrix Point Never and Travis Scott, as well as on singles from Kendrick Lamar, André 3000, and Moses Sumney.”

Source: Consequence of Sound

Listen to single

Stream

Other Notable Relases

Sharon Van Etten - Remind Me Tomorrow (Indie Pop, Synth)

Listen to single
Stream

Future - The WIZRD (Hip Hop, Trap)

Listen to single
Stream

Deerhunter - Why Hasn’t Everything Already Disappeared (Neo-Psychedelia, Indie Rock)

Listen to single
Stream

Toro Y Moi - Outer Peace (Alternative R&B, Synth Funk)

Listen to single
Stream

Feel free to discuss or feature any and all other releases in the comments below

Discussion Points

Have you listened to any of these releases?
What are your thoughts?
What are you looking forward to listen to?
What have you enjoyed from these artists in the past?

// All feedback on this format welcome below.

hey this is tildes so i should talk about code.

i dont type each > for the markdown individually.

got a tiny function i wrote that does it for me: https://repl.it/repls/HonoredRubberyProfessional

so there's that for anyone who wants an easier time formatting their thing.

stuff at the bottom. not necessarily inspo. just.

yeah

i just

want to go back

to normal.

normal like in 2016

when i had a little cash

and spent it all

on books, coffee, clothes, teenage shit

i was nineteen

we had yet to meet

back to normal

like the centuries

where i would never be

from the dawn of the earth

up to the nineties.

back to normal

back to friends

back to hobbies and dreams

back to having endless things

that i found exciting

back to normal

when i'd stay up a little late

and fall asleep, be up at 8

and make my coffee

not living in the night,

sleeping in the morning.

.

but the meds are all a hex,

cyanide with side effects

take this pill if you're depressed

now youre a narcoleptic wreck

and your car's a crumpled mess

so momma drives you to your check-

ups full of shit you never said

like how you wanna quit - dead.

because you say something she think

is wrong you end up in the shrink

with all the people with the bigger problems

thrashing as they shriek

and you wake up on a table

see the warden of the clink

shoving hands into your mouth

tryna feed you what they think

'll fix your fucking problems.

hooked - benzodiazepines.

and now you're mellow, now you're numb

for now your skin'll cease to bleed

and still you look around in envy

pretty people - normalcy.

.

i gotta get out this house

get back to normal

maybe she can't find me there.

maybe i can get a text

or get some coffee

breathe, not even care

'bout if i'll turn a cursed corner

see her curly golden hair,

and have a flashback to the nights

spend crying lonely in despair

as she would sit, a room away

sipping vodka in here chair

taking snaps and scrolling insta

for her modelling career

and i would wail my soul would bleed

praying that her heart would hear

and she would get up, come and hold me

stroke my hair like "mama's here."

and i could breathe

our love immortal

i want nothing but a world

where i am back in full control

through death or breath

just make me normal.

https://www.youtube.com/watch?v=5NB7RBZ1yGY

https://www.youtube.com/watch?v=w--D1S8SrCQ

https://www.youtube.com/watch?v=NO5JLdsNxSk | Lyrics

Everything I said was heavily downvoted, even though I was making valid points and 90% of the replies were mockery or useless dribble. The few people that attempted to engage in discussion with me were either just has heavily downvoted as me (even though their views were opposing mine) or were unable to do it in a logical or civil manor. It wasn't even a really controversial topic, my opinion is just something that is in contrast of the greater "hivemind".

I know we are not where I think most of us would like to be just yet, but I had not been back on Reddit for a while and I feel like I made a good decision by distancing myself from the Reddit community. I really enjoy the community we are building here.

Anyway, I kinda just felt like I needed to post this. I know it's not really high quality content (and I honestly had no clue where to post it), but I wanted you guys to know I appreciate all of you.

❤

Preface

Software security is one of those subjects that often gets overlooked, both in academia and in professional projects, unless you're specifically working with some existing security-related element (e.g. you're taking a course on security basics, or updating your password hashing algorithm). As a result, we frequently see stories of rather catastrophic data leaks from otherwise reputable businesses, leaks which should have been entirely preventable with even the most basic of safeguards in place.

With that in mind, I thought I would switch things up and discuss something security-related this time.

Background

It's commonplace for complex software systems to avoid unnecessarily large expenses, especially in terms of technical debt and the capital involved in the initial development costs of building entire systems for e.g. geolocation or financial transactions. Instead of reinventing the wheel and effectively building a parallel business, we instead integrate with existing third-party systems, typically by using an API.

The problem, however, is that sometimes these third-party systems process requests over a long period of time, potentially on the order of minutes, hours, days, or even longer. If, for example, you have users who want to purchase something using your online platform, then it's not a particularly good idea to having potentially thousands of open connections to that third-party system all sitting there waiting multiple business days for funds to clear. That would just be stupid. So, how do we handle this in a way that isn't incredibly stupid?

There are two commonly accepted methods to avoid having to wait around:

1. We can periodically contact the third-party system and ask for the current status of a request, or
2. We can give the third-party system a way to contact us and let us know when they're finished with a request.

Both of these methods work, but obviously there will be a potentially significant delay in #1 between when a request finishes and when we know that it has finished (with a maximum delay of the wait time between status updates), whereas in #2 that delay is practically non-existent. Using #1 is also incredibly inefficient due to the number of wasted status update requests, whereas #2 allows us to avoid that kind of waste. Clearly #2 seems like the ideal option.

Method #2 is what we call a webhook.

May I see your ID?

The problem with webhooks is that when you're implementing one, it's far too easy to forget that you need to restrict access to it. After all, that third-party system isn't a user, right? They're not a human. They can't just give us a username and password like we want them to. They don't understand the specific requirements for our individual, custom-designed system.

But what happens if some malicious actor figures out what the webhook endpoint is? Let's say that all we do is log webhook requests somewhere in a non-capped file or database table/collection. Barring all other possible attack vectors, we suddenly find ourselves susceptible to that malicious actor sending us thousands, possibly millions of fraudulent data payloads in a small amount of time thanks to a botnet, and now our server's I/O utilization is spiking and the entire system is grinding to a halt--we're experiencing a DDoS!

We don't want just anyone to be able to talk to our webhook. We want to make sure that anyone who does is verified and trusted. But since we can't require a username and password, since we can't guarantee that the third-party system will even know how to make use of them, what can we do?

The answer is to use some form of token-based authentication--we generate a unique token, kind of like an ID card, and we attach it to our webhook endpoint (e.g. https://example.com/my_webhook/{unique_token}). We can then check that token for validity every time someone touches our webhook, ensuring that only someone we trust can get in.

Class is in Session

Just as there are two commonly accepted models for how to handle receiving updates from third-party systems, there are also two common models for how to assign a webhook to those systems:

1. Hard-coding the webhook in your account settings, or
2. Passing a webhook as part of request payload.

Model #1 is, in my experience, the most common of the two. In this model, our authentication token is typically directly linked to some user or user-like object in our system. This token is intended to be persisted and reused indefinitely, only scrapped in the event of a breach or a termination of integration with the service that uses it. Unfortunately, if the token is present within the URL, it's possible for your token to be viewed in plaintext in your logs.

In model #2, it's perfectly feasible to mirror the behavior of model #1 by simply passing the same webhook endpoint with the same token in every new request; however, there is a far better solution. We can, instead, generate a brand new token for each new request to the third-party system, and each new token can be associated with the request itself on our own system. Rather than only validating the token itself, we then validate that the token and the request it's supposed to be associated with are both valid. This ensures that even in the event of a breach, a leaked authentication token's extent of damage is limited only to the domain of the request it's associated with! In addition, we can automatically expire these tokens after receiving a certain number of requests, ensuring that a DDoS using a single valid token and request payload isn't possible. As with model #1, however, we still run into problems of token exposure if the token is present in the URL.

Model #2 treats each individual authentication token not as a session for an entire third-party system, but as a session for a single request on that system. These per-request session tokens require greater effort to implement, but are inherently safer due to the increased granularity of our authentication and our flexibility in allowing ourselves to expire the tokens at will.

Final Thoughts

Security is hard. Even with per-request session tokens, webhooks still aren't as secure as we might like them to be. Some systems allow us to define tokens that will be inserted into the request payload, but more often than not you'll find that only a webhook URL is possible to specify. Ideally we would stuff those tokens right into the POST request payload for all of our third-party systems so they would never be so easily exposed in plaintext in log files, but legacy systems tend to be slow to catch up and newer systems often don't have developers with the security background to consider it.

Still, as far as securing webhooks goes, having some sort of cryptographically secure authentication token is far better than leaving the door wide open for any script kiddie having a bad day to waltz right in and set the whole place on fire. If you're integrating with any third-party system, your job isn't to make it impossible for them to get their hands on a key, but to make it really difficult and to make sure you don't leave any gasoline lying around in case they do.

I was thinking about the intersection of internet privacy and politics. You could even say I was having a bit of a mini-crisis. I like to think of myself as being pretty liberal, but I wondering how that fits into privacy. I was a little upset when I learned that Obama called Edward Snowden unpatriotic. I was kind of thinking that what he did was patriotic. Wasn't the NSA monitoring US citizens without warrants. That's morally wrong right? I think I would be pretty fine with the government monitoring someone if they had a warrant given to them by a non-secret court. I'm wondering if anyone here can give me some insight on this or if anyone else feels/has felt this way.

The study published in the Lancet: Food in the Anthropocene: the EAT–Lancet Commission on healthy diets from sustainable food systems

The editorial in the Lancet: The 21st-century great food transformation

An article in Cosmos for people (like me!) who don't have access to the Lancet: Feeding the planet: a call for radical action