Tom Delalande
Tom Delalande
  • 19
  • 671 668
JWTs are insecure session tokens
I've often seen hate for JWTs online, but never really understood why they we're seen as badly designed and insecure. So I did some digging and came to my conclusion. Which is that JWTs are a good method of authentication, but bad session tokens.
Basic opaque session tokens are usually the way to go. Using stateless tokens has many added costs, while not providing that many benefits in practice.
มุมมอง: 23 678

วีดีโอ

Authentication is a developer nightmare
มุมมอง 51K14 วันที่ผ่านมา
authn.tinyclub.io Music: th-cam.com/video/jUkI7Ixiqgk/w-d-xo.html Let's talk about authentication. I would like to show how easy it is to implement authentication with 3 different methods. Password, Oauth2 (or social login) and passkeys. They all have their benefits and drawbacks but hopefully this video is a fun way to understand how the systems powering authentication actually work. I've also...
The cloud is over-engineered and overpriced (no music)
มุมมอง 322K21 วันที่ผ่านมา
I tried the music and the feedback is clear enough that I think it's worth uploading a version of this with no music. I'm still learning! I'm sorry :( I really liked the riff I wrote for the intro since it has a time signature of 7/4 but I got carried away a bit... Let's spin up a server a simpler way.I'm experimenting with some background music, let me know what you think.In this video I will ...
The cloud is over-engineered and overpriced
มุมมอง 98K21 วันที่ผ่านมา
Let's spin up a server a simpler way. I'm experimenting with some background music, let me know what you think. In this video I will be showing how to use fundamentals to spin up a server, replacing cloud providers like AWS, Google Cloud Provider and Microsoft Azure with Linux, Docker and Git. For many applications, the tools we use are grossly over-engineered. I'm trying to force myself to ret...
My latest weekend project. Mixing the scalability of SQL and with the easy of use of spreadsheets
มุมมอง 6Kหลายเดือนก่อน
I've been processing a lot of local CSVs lately. Often feeling like the tools I'm using don't behave quite how I would like them to. I built a prototype of an application remedy these frustrations. And also explore some existing solutions to fix similar problem using tools like Postgres, SQLite, HTTPie, Bash and JQ.
Comparing 10 programming languages. I built the same app in all of them.
มุมมอง 69Kหลายเดือนก่อน
Many modern programming languages have some great features like null safety, exhaustive switch statements, error handling, strong type systems, immutability, great tooling and good readability and write-ability. I couldn't decide which language I preferred so I made a TCP server that does some basic file processing in all of them. Using no dependencies where applicable. I did this using Rust, G...
Why I return HTTP '200 OK' for errors
มุมมอง 5K2 หลายเดือนก่อน
I can't think of a meaningful CTA so my call to action is that you have to finally finish that side project you keep adding features to instead of just finishing. I started making this video thinking it was a really hot take to return 200 OK for domain errors when using HTTP. But after digging into it, and more specifically reading HTTP status codes, it doesn't feel that controversial at all. I...
How leveraging events can simplify your app
มุมมอง 11K2 หลายเดือนก่อน
Event sourcing is no silver bullet. But it is a match made in heaven for some domains. I also don't see much mainstream coverage of event sourcing, CQRS and domain driven design. Thank you so much for taking the time to watch. Timestamps 0:00 Problem space 0:40 CRUD implementation 1:12 Issues 1:48 Event sourcing 3:02 CQRS 3:34 Aggregate 4:05 Advantages 4:40 Disadvantages 5:08 Exit
The better alternative to Markdown
มุมมอง 30K2 หลายเดือนก่อน
AsciiDoc (or Adoc) is a tool used to write technical documents. It is far better than the industry standard of Markdown but it is very underrated. Thank you so much for taking the time to watch. Github Writeup on Markdown issues: github.github.com/gfm Timestamps: 0:00 - What is Markdown? 0:11 - The problem with Markdown 0:42 - What is AsciiDoc? 1:00 - Embedded source code 1:30 - Exporting 1:47 ...
Kotlin for Typescript developers
มุมมอง 3.7K2 หลายเดือนก่อน
Subscribe th-cam.com/channels/YuQjtwffrSIzfswH3V24mQ.html This video is meant for Typescript developer interested in Kotlin. I cover the syntax, tooling and create a general project. If you're on the fence about trying Kotlin, I hope that this can be helpful. Thank you so much for taking the time to watch Github: github.com/tom-delalande/learning-kotlin-typescript Twitter: tomdelala...
HTMX examples for React developers
มุมมอง 3.5K2 หลายเดือนก่อน
Subscribe th-cam.com/channels/YuQjtwffrSIzfswH3V24mQ.html I rebuilt the same 5 pages with React and HTMX (Kotlin) to see how they compare. They are surprisingly similar. Thank you so much for taking the time to watch. Twitter: tomdelalande_ Discord discord.gg/Cg66xQ8KgP Twitch: www.twitch.tv/tomdelalande Github github.com/tom-delalande/learning-htmx-vs-react Timestamps 0:00 Intro 0:...
You can compile Kotlin to Javascript
มุมมอง 4.2K3 หลายเดือนก่อน
Twitch www.twitch.tv/tomdelalande Discord discord.gg/Cg66xQ8KgP Convert Website tinyclub.io/kotlin-html Converter Github github.com/tom-delalande/html-to-kotlin-converter On the next step in my ever-going quest to avoid Javascript no matter the cost. I show you how easy it is to compile Kotlin code to Javascript. 0:00 Intro 0:36 Why I needed to compile Kotlin to JS 1:46 Compiling Kotlin to JS 3...
Use this instead of HTMX
มุมมอง 13K3 หลายเดือนก่อน
Subscribe: th-cam.com/channels/YuQjtwffrSIzfswH3V24mQ.html HTMZ: leanrada.com/htmz/ HTMX: htmx.org/ Original HTMX video: th-cam.com/video/9OYn48xBzOY/w-d-xo.html HTMX Poker video: th-cam.com/video/c7eacNAuGUw/w-d-xo.html The Kotlin server side rendering adventures continues in this latest installment. HTMX can be replaced by 1 line of Javascript, the author calls it HTMZ. This is very cool. 0:0...
My opinion on Pkl (Apple's new configuration format)
มุมมอง 1.9K3 หลายเดือนก่อน
Apple recently released a new configuration format called Pkl (Pickle). I migrated some configuration over from TOML and so far I really enjoy it. It works really well with Kotlin and seems like a great replacement for Json and YAML. 0:00 - What is Pkl 0:24 - Why I'm interested 1:10 - Use case 1:38 - Template example 2:21 - Configuration example 2:45 - What I preferred about TOML 3:13 - Website...
Making Poker with HTMX: Real time multiplayer using SSR with Kotlin, HTMX and Tailwind
มุมมอง 2.4K3 หลายเดือนก่อน
Making Poker with HTMX: Real time multiplayer using SSR with Kotlin, HTMX and Tailwind
Implementing Passkeys with no dependencies
มุมมอง 2.1K3 หลายเดือนก่อน
Implementing Passkeys with no dependencies
Why I enjoy writing Kotlin
มุมมอง 14K3 หลายเดือนก่อน
Why I enjoy writing Kotlin
Why Kotlin is the best language to use with HTMX
มุมมอง 7K4 หลายเดือนก่อน
Why Kotlin is the best language to use with HTMX

ความคิดเห็น

  • @GloriousBagel
    @GloriousBagel 6 นาทีที่ผ่านมา

    I love getting a MS Azure ad before video about cloud service over dependence 😂

  • @seanknowles9985
    @seanknowles9985 30 นาทีที่ผ่านมา

    Union types in kotlin?

  • @nealkashya
    @nealkashya 12 ชั่วโมงที่ผ่านมา

    Me with 2 Dell Optiplex Micros and one mid 2010s gaming pc, hosting an entire private cloud, code server, media server and my own website using cloudflare tunnel! Honestly for someone who can get a basic grip of how type 1 hypervisors function and how to create redundant storage for cheap, you can get so much done for much cheaper than public cloud hosting!

  • @Janemayank
    @Janemayank 12 ชั่วโมงที่ผ่านมา

    You don't need music. You talk meaningful.

  • @parzival123
    @parzival123 16 ชั่วโมงที่ผ่านมา

    you are a genius

  • @Verrisin
    @Verrisin วันที่ผ่านมา

    before watching, but: afaik it's just to lock clients in

    • @Verrisin
      @Verrisin วันที่ผ่านมา

      as in, the insane "infrastructure" everything is connected by, and must be defined in terms of.

  • @ashleydavis3318
    @ashleydavis3318 วันที่ผ่านมา

    i tried zig recently, and i completely agree. string manipulation is often the first thing people try with a new language, and it's easily the worst part of zig, which gave me a really bad impression. the concept is brilliant, but actually using the tools feels like pulling teeth.

  • @twistedtwo8
    @twistedtwo8 วันที่ผ่านมา

    Can you do a tutorial or lesson about this ? TIA.

  • @kelownatechkid
    @kelownatechkid วันที่ผ่านมา

    Cowabunga, dudes

  • @jonarod
    @jonarod วันที่ผ่านมา

    Good video, thanks. Would love to see a more in-depth self-hosting with NixOS video. Great job.

  • @SwiftoMan
    @SwiftoMan วันที่ผ่านมา

    Great video, think you hit the nail on the head with the format

  • @Aucacoyan
    @Aucacoyan 2 วันที่ผ่านมา

    Thank you so much, this is so inspiring that I want to setup a lab for myself and see how much do I need a cloud to "provide the solutions to my problems". Keep it coming!

  • @theranajayant
    @theranajayant 2 วันที่ผ่านมา

    Nice, appreciate you building things in this way. Cloud is in need a big over spent by saas companies.

  • @khanra17
    @khanra17 2 วันที่ผ่านมา

    WhyTF are you moaning? Speak dude ! Speak

  • @dominiksmeda7203
    @dominiksmeda7203 3 วันที่ผ่านมา

    Dude!!, dude!! Add some better description like blue green deployment in docker compose!!! Love it man.

  • @finndriver1063
    @finndriver1063 3 วันที่ผ่านมา

    +1 for Gleam, but wish Clojure had been in here. I guess 2007 is a too old, but 1.0.0 was much more recent. I think it would be interesting to compare some 'old' languages still in use, but with their newer features. Think Fortran, C, Common Lisp, Erlang, Haskell, Ada, Smalltalk, Pascal for example. For example, I think CL's tooling is superb, and Haskell's is now good even though it had a bad reputation. Smalltalk is OOP, but not as you know it, and Erlang has some of the cleanest loveliest code I've ever seen. Fortran is quick and I find it quite simple to read for whatever reason. If you need the list to be 10, then perhaps add Forth, Cobol, Eiffel or Prolog if you're up for a challenge.

  • @emmanuelpeter8485
    @emmanuelpeter8485 3 วันที่ผ่านมา

    Oh so this is how instagram rolls out features

  • @dariomachado5374
    @dariomachado5374 3 วันที่ผ่านมา

    Hey there! I just stumbled upon Ridotto and I must say, it's a game-changer in the gambling world. With its decentralized platform and provably fair gaming, it's a breath of fresh air in an industry that often lacks transparency. Excited to see where it goes!

  • @168original7
    @168original7 3 วันที่ผ่านมา

    Makes sense, website hosting is expensive

  • @ayushchaudhari5655
    @ayushchaudhari5655 4 วันที่ผ่านมา

    Caddy is awesome! I have been secretly running it on the production server for my company. I just dread the day when they realise I am not using nginx and have a heart attack (founder is 60 and only uses tech he knows about).

  • @yjawhar
    @yjawhar 4 วันที่ผ่านมา

    Add free cloudflare protection and you have DDOS protection

  • @bluzytrix
    @bluzytrix 4 วันที่ผ่านมา

    The secure version of this would be to use cloudflare tunnels to route all traffic to the machine so that you don't have to expose it to the internet.

  • @demetriusalbuquerque
    @demetriusalbuquerque 4 วันที่ผ่านมา

    The voice he created to appear unbiased, disinterested as if he knew everything, completely spoils the content of the video.

  • @KvikDeVries
    @KvikDeVries 4 วันที่ผ่านมา

    Thank you for the words of wisdom :)

  • @maingateway2308
    @maingateway2308 5 วันที่ผ่านมา

    Liked and subscribed for the most real video in tech 👑

  • @wtho
    @wtho 5 วันที่ผ่านมา

    What about e2e tests? Do they also run on prod using the feature toggle?

  • @kennethkho7165
    @kennethkho7165 5 วันที่ผ่านมา

    I got recommended and clicked because of "no music"

  • @y0uTUB3R93
    @y0uTUB3R93 5 วันที่ผ่านมา

    where do I find the ssh key on your github?

  • @y0uTUB3R93
    @y0uTUB3R93 5 วันที่ผ่านมา

    Where do I find the ssh keys on your Github?

  • @chrism3790
    @chrism3790 5 วันที่ผ่านมา

    The cloud can be surprisingly cheap if you know what you're doing. The problem is that most companies are so. goddamn. wasteful. I'm a data engineer at a company with about 100 million in revenue. About 5 years ago, our crayon-eating CTO decided we needed "more leverage" with AWS so we could get "better pricing", so he decided to "pressure" them by threatening to move our entire analytics stack (data lake + data warehouse) to Google Cloud. As if AWS would give a shit. So when they said no, he had to go through with it to not look like the idiot he was. As a result, we ship every single piece of data we have cross-cloud. We have a 7 Petabyte datalake. It costs hundreds of thousands of dollars in egress and processing to move the data, not to mention the cost of the man hours that were needed to rebuild the whole thing. The data engineering and data warehouse teams were subjected to massive pressure for a year, and most of them ended up leaving. 4 years later, the tech debt is still off the charts. Everything breaks constantly because it was built in a hurry, and the whole environment is borderline unmanageable. We can't fix it because we're too busy putting out fires. That single decision has cost the company millions of dollars over the last 5 years. And mind you, this is at a company that broke even for the first time in 10 years in 2023. A year after the migration, the CTO said he felt burnt out and had achieved everything he could at our company. He left to work for a new startup and do it all over again. I only put up with this shit because pay and benefits are quite good and I have a very cool and experienced manager from who I still learn something new every day. And hey - I get to learn about two different cloud platforms 😂

  • @ANONAAAAAAAAA
    @ANONAAAAAAAAA 5 วันที่ผ่านมา

    I always prefer using session over JWT. However, if I have to use JWT to, say, cut the cost of deploying Redis, I add a field like created_at in JWT so that I can revoke it by adding server side logic which invalidates tokens created before specific timestamp and accepts only new ones. You can also invalidate tokens for each user, after users update passwords, by saving timestamps in DB for each user.

  • @siz1700
    @siz1700 6 วันที่ผ่านมา

    NixOS is not based on debian, not based on arch. It's just based.

  • @mokoepa
    @mokoepa 6 วันที่ผ่านมา

    Could you also provide links (to resources that you find helpful/would be recommend or the ones you used) in the description/pinned comment of yours. Thank you 👍🏾

  • @gusryan
    @gusryan 6 วันที่ผ่านมา

    Do you have the source for the Rust project available online?

  • @ANONAAAAAAAAA
    @ANONAAAAAAAAA 6 วันที่ผ่านมา

    Honestly, choosing programming language is rather insignificant compared with choosing your specialty. Specialties includes: mobile app, frontend, backend(startups), backend(enterprise), embedding system, infrastructure, etc... Each specialty requires tons specialized knowledges and programming languages are just one of them. For example, backend dev requires knowledges about databases like table design, indexing, SQL, locks and transactions, execution plans, query tuning etc..., and these are a lot harder to master than any programming languages since you have to play with real world production systems to actually understand them. Once you understand how to build specific type of apps like backend app, mobile app etc..., changing the languages is not so difficult for the most of cases. Choosing languages is like choosing kitchen knifes as a chef and choosing specialty is like deciding the dishes to cook from Italian, French, Chinese or Indian. So I would suggest fresh juniors who's entering this industry to pick up whatever languages which are likely to give you industry experiences you want, rather than hopping "modern languages" one after another.

  • @ANONAAAAAAAAA
    @ANONAAAAAAAAA 6 วันที่ผ่านมา

    Nice video! I 100% agree with sticking to the simplest solutions. Too many people prefer rather convolved over engineered solutions, which makes me feel sick of. One thing, however, I love about cloud is IaC tools especially Terraform. Managing infrastructure using version controlled codes really gives me the sense of security since I can rollback the changes whenever I mess up something. Maybe it's time to learn Ansible or other IaC tools I can use for on-premise setup.

  • @FaintArt
    @FaintArt 6 วันที่ผ่านมา

    nice vid, keep it up!!

  • @Jan12700
    @Jan12700 6 วันที่ผ่านมา

    2:00 Why not a Hypervisor based on Linux, like Proxmox?

  • @jaivaswani1817
    @jaivaswani1817 6 วันที่ผ่านมา

    Great video! I completly agree with all your points. Just 1 question.. How did you route public traffic to your sever ? Do you have a public IP that your domain points to?

  • @rampandey191
    @rampandey191 6 วันที่ผ่านมา

    Why not use session tokens for interview service communication as well?

  • @prfwrx2497
    @prfwrx2497 6 วันที่ผ่านมา

    The cloud is just someone else's computer.

  • @gonzadev
    @gonzadev 6 วันที่ผ่านมา

    Excellent! Thanks for your video.

  • @MagnusAnand
    @MagnusAnand 6 วันที่ผ่านมา

    Cool!!

  • @jful
    @jful 6 วันที่ผ่านมา

    Are you saying it would be better value if it had music?

  • @Malix_off
    @Malix_off 6 วันที่ผ่านมา

    👋

  • @t0khyo
    @t0khyo 6 วันที่ผ่านมา

    Thanks for (no music) hope u keep things like this 👌🏻

  • @JayLooney
    @JayLooney 7 วันที่ผ่านมา

    Everyone is already in the comments mentioning something absent, so... me too :'D -- At this point almost all Auth Providers have a component in their system called "anomaly detection" or something that sits in between the "user interactions" (login, renew session, recover account, register), and the actual "authentication processes". The AnomalyDetectionEngine or w/e is responsible for checking things like "Have we seen this IP before?, on this users account? What about this device? Has the password been in a breach?" (and potentially many other areas of concern) -- and then it will make some decisions based on that info like whether to send an email and present a user with a password reset page in the event of a breach detection, or whether to block the auth entirely, or to send a verification code to a phone number or email, and so on. -- Anyway this is a fun video and a fun way to learn about Auth, the reason it's a developer nightmare though is because it's just a nightmare period. Unfortunately, there is no simple way to foresee every possible way an attacker may attempt to subvert your auth system.

  • @davidsiewert8649
    @davidsiewert8649 7 วันที่ผ่านมา

    Missed the most important option: allowing to set and send the jwt using secure http cookie on the server -> so client side JS does not have access to the token but its send to the server at any request anyway.

  • @AlexWilkinsonYYC
    @AlexWilkinsonYYC 7 วันที่ผ่านมา

    We actually ended up with our startup self hosting, however our AWS costs were only about 1k a month when we switched. Our self hosting is essentially free.