.tip

May 23, 2026 · one of the small things

Dependency alerts need one person and a weekly slot

An alert feed with no owner grows to three hundred items and stops meaning anything. One person triages weekly: fix, mark not applicable with a reason, or schedule.

Group the low ones into a monthly bump PR. Anything with a known exploit and a reachable code path ships that day. The point is not zero alerts. It is that every alert has been looked at by a person who wrote down why.

securityengineering-practice

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close