标签：#r

Have you ever thought about how a sandbox tunnels a public URL out to the world when one end of the tunnel is untrusted code owned by the user? Take an example: a localhost:3000 app running in a sandbox inside a VM. The user wants a public link for it. It looks like a reverse proxy. It isn't, because the app behind the link is untrusted code. It feels easy, but for security it's full of hiccups. The naive version, and the holes it leaves. If there's just a public URL, anyone can hit it, and if the user doesn't want it shown to the world, that's not acceptable. If we put a secret token in the URL, it leaks, via browser history, referer headers, and server logs. And either way, the hostile app can steal or forge the visitor's session. A normal reverse proxy forwards traffic to a backend it trusts: your own app. This gateway forwards to a backend it must distrust: the user's code running in the VM. It's still a reverse proxy, it's just one whose backend you can't trust. That single inversion is why every byte crossing it, in both directions, gets inspected. What we actually want: a secure runtime URL, behind a reverse proxy, that can't be exploited, not against the visitor and not against the worker the sandbox stays executable and runnable while the URL is live the user can share it with anyone they choose, but it is not public This is deliberately not a plain browser-link architecture. It works through cookies, and it needs one extra sign-off step before the user gets a usable session. So how do we stop a random person from just landing on a particular sandbox's exposed URL? HMAC. How it actually works, in real time. There is no dumb reverse proxy blindly routing traffic into the sandbox. First, the traffic hits the edge (Caddy, wildcard TLS) and lands on cmd/preview-gateway. Its first job is to parse the host into sandboxID + port. Both are client-supplied through the URL, so the sandboxID is then strictly UUID-validated. Second, it verifies the token against its si

Annual Apple TV subscriptions get the biggest bump.

“Do we need to look at the ceiling before going to the bathroom? Can we actually trust the water is safe to drink?” asks one GSA worker.

Sophia Bendz, general partner at Cherry Ventures, stopped by Equity to break down the latest in the Swedish tech ecosystem.

Amazon and Best Buy have the TCL QM7L mini-LED TV on sale for as low as $797.99 for the 55-inch model, a $200 discount from the usual price. We spotted scaling discounts on larger sizes as well, although Amazon already listed low stock on the 65-inch version. While OLED televisions are great for deep black […]

submitted by /u/BrewedDoritos [link] [留言]

James Cameron's 1991 sci-fi blockbuster returns to theaters this weekend for its 35th anniversary.

Feature flags are common these days, and the .NET feature management library provides a lot of the plumbing to make them easy to get started with. The missing piece is a UI for managing flags - unless you are using Azure App Configuration. Relying on `appSettings.json` gets awkward when non-technical users need to change flags, deploys are slow, or the application is running in a distributed environment. I built FeatureFlags.app to fill that gap - a simple UI for managing .NET feature flags that