I'm old enough to remember when the "Back" buttons in web browsers used to work reliably. You'd get exactly one page transition back in history for every press of the button.

Can we bring that back, please?

On Dec. 15, a researcher disclosed a weakness in the way many companies have implemented Google OAuth that potentially allows former employees to retain access to SaaS providers like Slack and other platforms. According to the researcher, Google paid a bug bounty for the vulnerability report in October 2023, but still hasn't changed anything to address the issue.

https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of/

Today, Nudge Security published a writeup about the issue, noting how their SaaS platform was affected. Nudge's Jaime Blasco provides a helpful tl;dr on the weakness:

"It’s a well-known work email hack: add “+string” to your work email address (e.g., [email protected]) and you can easily filter any unwanted marketing emails or create multiple different signups for a single app using your work email address."

"However, this same trick can be used to create an entirely new Google account—one that looks like a corporate email address and forwards messages to it, but isn’t actually managed or even visible within your corporate Google organization.

This creates a big problem when it comes to offboarding employees. If a given “shadow Google account” were used to sign up for corporate SaaS accounts like Slack or Zoom using Google OAuth (i.e., “Sign in with Google”), that access could persist even after suspending the employee’s corporate Google account. Effectively, there’s no way for a Google administrator to see or suspend the shadow Google account from their admin console. This could leave a back door for unauthorized access by a former employee or threat actor by compromising the shadow account."

https://www.nudgesecurity.com/post/google-oauth-vulnerability

Bezos and Musk have it deeply wrong.
The problem isn't that we need a trillion people to have more Einsteins or Mozarts.

The problem is we don't nurture and protect the ones we have.

Stephen Jay Gould wrote: "I am, somehow, less interested in the weight and convolutions of Einstein's brain than in the near certainty that people of equal talent have lived and died in cotton fields and sweatshops".

The Voyager team at NASA sends a patch to Voyager 2 and later to the Voyager 1. The code is "shipped" to Voyager 2 on a Friday (October 20, 2023), and will be activated on a Saturday: Oct 28, 2023. The signal needs approx. 18hrs from earth to Voyager 2.

And you're afraid of deploying your PWA on a Friday when you can roll everything back in minutes?

https://fosstodon.org/@AkaSci/111270064467765032