[-] tyteen4a03@lemmy.zip 1 points 2 months ago

In pnpm you can override this. I don't think you can in npm.

5
submitted 3 months ago* (last edited 3 months ago) by tyteen4a03@lemmy.zip to c/javascript@programming.dev

Because there's no guide on how each package manager sets their minimumReleaseAge and every package manager uses a different format... (can we please get a standards committee going for security-related configs like these?)

Note: unless otherwise specified, X is a number ONLY. No date units (don't specify 7d or 1440m. Your config will error.)

And for the love of your favourite deity, remove all carets (^) from your package.json unless you know what you are doing. Always pin to exact versions (there should be no special characters in front of your version number)

  • npm: In .npmrc, min-release-age=X. X is the number of days. Requires npm v11.10.0 or above.

  • pnpm: In pnpm-workspace.yaml, set minimumReleaseAge: X. X is the number of minutes. Requires pnpm v10.16.0 or above. From v11 onwards, the default is 1440 minutes (1 day)

  • Yarn: In .yarnrc.yml, set npmMinimalAgeGate: X. X is a duration (date units supported are ms, s, m, h, d, w, e.g. 7d). If no duration is specified, then it is parsed as minutes (i.e. npmMinimalAgeGate: 1440 is equal to npmMinimalAgeGate: 1440m). Requires Yarn v4.11 or above (Yarn v4.10 also has the option, but only supported minutes as a raw number)

  • Deno: In deno.json, set "minimumDependencyAge": "X". X can be a number in minutes, a ISO-8601 Duration or a RFC3339 absolute timestamp (basically anything that looks like a date; if you are in Freedom Country remember to swap the month and the date) Requires Deno v2.6.0 or above.

  • Bun: In bunfig.toml, set:

      [install]
    
      minimumReleaseAge = X
    

X is the number of seconds. Requires Bun v1.3.0 or above.

8
submitted 10 months ago by tyteen4a03@lemmy.zip to c/duolingo@lemmy.world

AdGuard DNS blocks connections to Duolingo's ads endpoints so you will not be shown any 3rd party ads. The asterisk is: it will still show you ads for Super Duolingo but those are shorter, way less annoying, and will never be double-played. I just turn off the speaker for 15 seconds and let the ads play while I do literally anything else.

You can also use this trick to get unlimited free energy. Note that in the current (Android) version, the in-lesson watch ads to gain energy buttons don't work, so you'll want to stock up on energy before starting a new lesson.

Here's how to set it up for both iOS and Android: https://adguard-dns.io/en/public-dns.html

There's no need to bother with option 1 which tells you to install an app. Option 2 is what you want.

17
submitted 11 months ago by tyteen4a03@lemmy.zip to c/webdev@programming.dev
33
1
submitted 2 years ago by tyteen4a03@lemmy.zip to c/css@programming.dev
12
[-] tyteen4a03@lemmy.zip 3 points 2 years ago

So what part of the proposed solutions "wouldn't work"?

[-] tyteen4a03@lemmy.zip 2 points 2 years ago

Having something is better than nothing! In our case, having connect-src enabled would have avoided the incident.

[-] tyteen4a03@lemmy.zip 2 points 2 years ago* (last edited 2 years ago)

Not sure what you're referring to by "custom endpoints" - if you are a normal Datadog RUM user you can only ever send data to one of the several "sites". There's nothing customizable.

40
Datadog has a security footgun (sheriffcranky.substack.com)

tyteen4a03

0 post score
0 comment score
joined 2 years ago