Lemdro.id

Or, maybe just tell them the JWT they’ve got is expired, and ask them yes or no if they want the new (current) price instead, and update it transparently if they say yes.

Based on this, it seems like you're suggesting to move the logic closer to the frontend and leave the auto-refetching logic out of the backend?

The more I look at the responses, the more I feel this is a front-end problem to be solved rather than the backend's.

10 mo. ago

I think the idea was that if they managed to get the private key, we have away bigger problems on our hands than them submitting fraudulent orders. Even with server-side tokens, the same could happen if someone get access to your machine.

10 mo. ago

Actually, we are controlling both ends. But the issue is that frontend have rather limited bandwidth most of the time (sadly the truth is that despite that your own team wants to make things clean, other teams may not have the same stance).

10 mo. ago

I think the idea was that as long as it is within 5 min, our service can be certain that the price shouldn't change and thus we can save the computation cost of having to compute the price.

It also is a user requirement, cause within that 5 min, even if the price is supposed to be changed, we will still use the price in the JWT.

10 mo. ago

What are the alternatives to a JWT. I know it is a bit bloated and we could just use the HS256 signature itself, but that doesn't really change the core problem of expiry vs auto-refetch

General Programming Discussion @lemmy.ml 0WN3D @lemmy.cafe 10 mo. ago

[Solved] How to know why a package is being updated/installed

I had this discussion in my workplace and wanted to share and get opinions from the folks here. (I suspect StackOverflow might not appreciate such open ended questions).

Context: We have a microservice involved in pricing signalling to our users. We have an endpoint which have the following:

Input: an array of item ID's
Output: the expected final price of the given items.

The item prices are quite volatile (and no, it is not crypto related), and is dependent on things like instantaneous supply-demand, promotions, etc.

Since the prices change quite frequently, it became a requirement that we commit to the price that was shown to the user initially, up to a certain time period (eg 5 min after the price was calculated). This improves the UX since the user will be charged as according to what they expected at the start.

Currently, in our system, we achieve this via a JWT, which contains all the details in the request, the obligatory signature, and the expiry set to 5 min from the time it was generated.

After generating this receipt, the FE can then call the endpoint with the JWT which does the actual payment processing using the params encoded in the token. This way, we know that the params + the total cost that is quoted in the JWT originates from our service since we verify that we signed it.

And the system evolves once more. We see that in the system, there is this mechanism, that if the token is expired, we do not reject the request at the charging step. Instead, we call the price endpoint internally using the params provided, and check if the price is the same as in the expired JWT. If it is the same, we process it as normal despite the JWT being expired.

This is where the contention lies. I believe that we should force the user to procure another non-expired JWT and removing this complex logic while others believe in the value of this improved UX where the user doesn't need to restart the whole flow again.

What do y'all think? Which way would y'all architect the endpoint? Or is there something fundamentally wrong with our design (maybe JWT is not the best suited for this use case)?

10 mo. ago

Mosquito splinters

Oh, ticks are rare in my region, that's why I have no prior experience with them.

I was thinking in the context of us slapping the mosquito would be equivalent to slamming a thumbtack into your skin which could increase the damage dealt and penetration depth.

Asklemmy @lemmy.ml 0WN3D @lemmy.cafe 11 mo. ago

Mosquito splinters

Just a random shower thought.

Mosquito's proboscis is sharp enough to penetrate your skin. So when you smack it while it is in the process of drawing your blood, isn't there a chance of its proboscis being forcefully jammed into your skin, leading to some sort of "splinter"? Or does it somehow loses its stiffness the moment it feels the impact?

I've never encountered nor heard of such occurrence in my lifetime of killing those buggers, but wondering if such a thing is even possible. If such could happen, I could only imagine the risk associated with having a piece of foreign organic matter being embed in the body

11 mo. ago

Oh, I didn't knew you can pass 2 is. I was depending on the tab completion from pacman, but I didn't see that it says you could specify i's

11 mo. ago

[Solved] How to know why a package is being updated/installed

Ah, it worked. I thought Qi only works for packages that are already installed. Didn't knew it worked for things that are synced as a new dependency of a package

Arch Linux @lemmy.ml 0WN3D @lemmy.cafe 11 mo. ago

[Solved] How to know why a package is being updated/installed

Hey, sometimes when I do pacman -Syu, I see some weird package being installed and I am curious which explicitly installed package is installing/updating it.

How do I so with pacman?

I know we can easily find out why an installed package is being installed, but what about before the package is being installed?

1 yr. ago

ok, here you go https://pastebin.com/uPc5S1LU

1 yr. ago

https://pastebin.com/uPc5S1LU

Tried the settings on the GitHub, doesn't seem to work, and it also made the stuttering worse

opengl-pbo=yes
opengl-early-flush=no.
video-sync=display-resample

ok, here you go

1 yr. ago

Yea, it seems to be using 200% CPU. But I have vo=gpu though, so I'd thought the GPU would've taken some of the load.

If I am strapped for CPU resources, how do I make it so that MPV buffer or something instead of dropping the audio when this happens? Cause it is strange the even though the visuals are acceptable, it is the audio that fails before the video

Linux @lemmy.ml 0WN3D @lemmy.cafe 1 yr. ago

I've tried searching around and stuff but I couldn't find a working solution

Background: I am running Arch Linux on a Raspberry Pi, mainly as a media player.

When I run MPV, it seems to drop frames (1-2 per second). Visually, nothing looks wrong so I am fine with that.

The issue is that after playing for some duration, the audio will just disappear. I would then need to pause the video for a while or seek backwards for the audio to come back (sometimes it just comes back on its own when I leave it playing too). I suspect it may be due to the dropped frames or maybe it's due to insufficient system resource.

Could someone help suggest some config changes which may help with the issue? I am totally fine with the visual dropped frames, I just want to fix the audio issue.

This is my config.

input-ipc-server=/tmp/mpvsocket ao=pipewire volume=120 demuxer-readahead-secs=3 cache=yes

1 yr. ago

are you running it from a tty on login

Yea, directly on tty.

I imagine these are two separate issues.

I'd think they are related since mpv is working fine on Xwayland but not when I launch alacritty instead

Can you dump your installed packages with pacman -Qe and post it here? I’ll compare it to mine.

alacritty 0.12.2-1
ani-cli 4.6-1
archlinuxarm-keyring 20140119-2
base 3-1
base-devel 1-1
bat 0.23.0-3
cage 0.1.5-1
dhcpcd 10.0.2-1
dialog 1:1.3_20230209-1
linux-rpi 6.1.54-1
lobster 4.0.0-1
man-db 2.11.2-1
neovim 0.9.1-1
net-tools 2.10-2
netctl 1.28-2
noto-fonts 1:23.9.1-1
opendoas 6.8.2-1
openssh 9.4p1-4
pacman-contrib 1.9.1-1
raspberrypi-bootloader 20230921-1
raspberrypi-firmware 20230921-1
ripgrep 13.0.0-3
socat 1.7.4.4-1
tmux 3.3_a-7
vi 1:070224-6
which 2.21-6
wireless-regdb 2023.09.01-1
wireless_tools 30.pre9-3
wpa_supplicant 2:2.10-8
xorg-xwayland 23.2.1-1

1 yr. ago

That shouldn't be the problem since I'm using pipewire and it is working in the Xwayland session. When I launch into alacritty, I also checked that pipewire + wireplumber were both active

1 yr. ago

I tried with cage + Xwayland and that works perfectly, so I highly doubt that is the issue. Maybe it is something to do with cage + alacritty that is causing it, but I'm not too well versed in the Wayland stuff to know if spawning a terminal application may somehow not support audio.

Arch Linux @lemmy.ml 0WN3D @lemmy.cafe 1 yr. ago