Macil @Macil@mastodon.social

@shaen Serving user content from another domain is common advice, but I think it's overkill for just images. If you enforce the file extension is jpg/jpeg/png/gif, and your server serves those with the right Content-Type headers, then you're good to go. The issue would be if they could upload something that your server served as html or another format javascript could run in like svg.

@shaen You're probably safe from XSS and SQLi if a user can enter <b>'"foo in all fields and get that exact string back without it being formatted or causing an error.

If you let users upload files, make sure you specifically whitelist the allowed file-types or the Content-Type headers you serve them as, so a user can't upload a HTML file with JavaScript and have it be served as HTML from your domain.

Django will protect you from CSRF issues as long as your GET requests are side-effect free.

imagine if everyone who started a World of Warcraft account was shipped a goldfish. And they all had to keep their goldfish alive. If the goldfish died, then their WoW account would get closed forever. It'd be fucked up and people would ask blizzard what the fuck.
But we have basically the same deal with reality and these meat bodies we get and everyone thinks it's normal
We need to make reality 2.0
thank you for attending my ted talk

@eevee Now I'm thinking of the ways you could add online interactions along these lines.

I love how Nethack servers let you run into the bones files of other players. Dark Souls also had a feature like this: if you died and let a lot of souls despawn, then a special enemy holding them would immediately spawn in another player's world where you died.

I think I just want Dark Souls style online interactions in everything.

I was dreaming about mario maker this morning, and when my alarm went off, I was still mostly asleep and convinced that my alarm clock was an object in my mario maker dreamspace rather than in meatspace, so I was scared that if I woke up all the way, I would lose access to the dreamspace and wouldn't ever be able to turn off the alarm. I focused on falling back asleep so I'd be able to hit the snooze button on the alarm. It took me a while to reason myself out of that and finally get my alarm.