For the past few years, CloudFlare has been steadily gaining popularity - being used by a staggering amount of websites, big and small. One of their frequently repeated claims to fame is that they "make web properties faster and safer". I disagree. In reality, CloudFlare has been structurally making the web less secure during these years. And they are incredibly good at selling that as a feature.…
Almost a week ago I published an article explaining why you shouldn't use JSON Web Tokens as a session mechanism. Unfortunately, it seems I've found the upper limit on article length before people stop reading - many of the commenters on Reddit and Hacker News kept suggesting the same "solutions" over and over again, completely ignoring that they were already addressed and found impractical in the…
Update - June 19, 2016: A lot of people have been suggesting the same "solutions" to the problems below, but none of them are practical. I've published a new post with a slightly sarcastic flowchart - please have a look at it before suggesting a solution. Unfortunately, lately I've seen more and more people recommending to use JWT ( JSON Web Tokens ) for managing user sessions in their web…
A topic that frequently confuses users in the #Node.js channel, is the Promise.try method provided by Bluebird. People often struggle to understand what it is, or why they should use it - and this isn't helped by the fact that almost all guides to Promises fail to demonstrate its use. In this brief article, I hope to provide a better explanation of what Promise.try is, and why you should always…
Okay, so let's get these things out of the way first: I am not a lawyer. However, I have to deal with intellectual property on a regular basis, because of my open-source work. I'm also very strongly opposed to copyright and patents, but have a more nuanced stance on trademarks. If any of this makes you uneasy, you can stop reading here. This issue was about trademarks . Trademarks are designed to,…
MongoDB is evil. It... ... loses data (sources: 1 , 2 ) ... in fact, for a long time, ignored errors by default and assumed every single write succeeded no matter what (which on 32-bits systems led to losing all data silently after some 3GB, due to MongoDB limitations) ... is slow, even at its advertised usecases, and claims to the contrary are completely lacking evidence (sources: 3 , 4 ) ...…
When using a promises library like bluebird in Express , you might have found it somewhat awkward to use them correctly - it's easy to forget to tack on a .catch statement at the end of a chain of promises. Fortunately, there's a solution for that, and it's called express-promise-router ! Using express-promise-router express-promise-router is a slightly modified version of the regular router that…
This article is meant to be an introduction to functional programming in Javascript - specifically, it will explain the map , filter and reduce methods. While these are natively available in any recent browser and in Node.js, most articles on them are far too technical to understand, while the concept of these functions is actually really simple, and will benefit any developer - even those working…
Yesterday, Mozilla made a blogpost , stating that they will be "deprecating non-secure HTTP" - in other words, forcing HTTPS. I believe that this decision is harmful to the open web, and this is why. First of all, for those who are not familiar with me - I actively encourage people to use SSL/TLS wherever possible. I do not believe that there is data that is "not important enough to encrypt". I do…
Well, not exactly a cheerful topic for my first post of 2015, but it has to be said. The EU has introduced new VAT (Value Added Tax) legislation that is supposedly meant to prevent companies like Amazon from 'reducing their tax burden'. Roughly summarized, the change of legislation means that VAT is now calculated based on the country of residence of the buyer , rather than that of the seller .…