• FizzyOrange@programming.dev
    link
    fedilink
    arrow-up
    12
    arrow-down
    1
    ·
    7 months ago

    Saving this for when people try to claim that naming things isn’t important!

    Also that is clearly a security issue. Anyone who tries to claim otherwise is forgetting that humans exist. Though I suspect they were just trying to avoid admitting fault and doing work. Disappointing either way.

    • BodilessGaze@sh.itjust.works
      link
      fedilink
      arrow-up
      4
      ·
      7 months ago

      Unfortunately, retrofitting CSP on an existing site can be nightmare, especially if you have external dependencies. At my job, we spent months trying to enable CSP on one our oldest sites, but ultimately gave up because one of our dependencies won’t work unless we added “unsafe-inline” everywhere, which kinda defeats the whole point of CSP.

      • tyteen4a03@lemmy.zipOP
        link
        fedilink
        arrow-up
        2
        ·
        7 months ago

        Having something is better than nothing! In our case, having connect-src enabled would have avoided the incident.

  • onlinepersona@programming.dev
    link
    fedilink
    English
    arrow-up
    4
    ·
    7 months ago

    I can’t find the adjective to use for datadog’s documentation, but I wouldn’t call it good. It seems like it’s written by different teams but every team writes everybody’s documentation. There’s no section just for a single team and nothing feels coordinated.

    Anti Commercial AI thingy

    CC BY-NC-SA 4.0

  • bigredgiraffe@lemmy.world
    link
    fedilink
    arrow-up
    4
    arrow-down
    2
    ·
    edit-2
    7 months ago

    I mean sure but that’s a lot of words to say “I didn’t read the directions and no one caught it in a merge request review because no one else read the directions either.”

    Their documentation and examples are pretty easy to read and the site parameter is explained in the getting started guide and even linked from the readme for the JavaScript sdk, and in lots of sample configurations so I’m not sure how this made it into a release and then no one noticed the missing metrics for eleven days, sounds like lots of issues in that shop.

    The behavior of the sdk isn’t great but the proposed solution wouldn’t work because you can use custom endpoints for all of the components using endpoints on domains you own anyway.

    • tyteen4a03@lemmy.zipOP
      link
      fedilink
      arrow-up
      2
      ·
      edit-2
      7 months ago

      Not sure what you’re referring to by “custom endpoints” - if you are a normal Datadog RUM user you can only ever send data to one of the several “sites”. There’s nothing customizable.