Skip to main content
6 votes
Accepted

Git philosophy: public vs. personal files: is there hybrid versioning?

You could consider a "root" repo containing your private tools/hooks/scripts, and a submodule for your public sources. The submodule would know nothing of the parent project and would have a "clean" ...
axl's user avatar
  • 1,217
6 votes
Accepted

Is XACML actually used and implemented?

I am the author of the XACML wikipedia page and I work for one of the leading vendors, Axiomatics. Yes, XACML is very much used across a wide range of verticals: from finance (a lot of banks even ...
David Brossard's user avatar
6 votes

Should I keep in the database a record of the user accepting the terms and coditions?

Regardless of any legal considerations: you might need to track acceptance for new users you will need to ask re-acceptance of changed terms and conditions for existing users. you may have to ask for ...
Christophe's user avatar
  • 78.6k
5 votes

How to test functionality that requires a certain internal state?

Tests should run fast. Now sure, you could set up each test by using processCommand to process every commend needed to get the game into the state you want to test but that's pitifully slow. The ...
candied_orange's user avatar
5 votes

Should I keep in the database a record of the user accepting the terms and coditions?

Most services require the user to accept the terms of service in order to create an account. If you keep track of when the account was created and a revision history for the terms of service, you will ...
Thomas Owens's user avatar
  • 83.3k
5 votes
Accepted

Cookie consent and facebook cookies?

Going against the law is not an option: first it might make you loose more visitors (i.e. those who count on you to respect their privacy). Second, GDPR fines calculated as percentage of your global ...
Christophe's user avatar
  • 78.6k
2 votes

Is XACML actually used and implemented?

The Wikipedia article lists major implementations : "SunXACML, Axiomatics, AuthzForce, InfoBeyond Technology" so it is being used. I don't think many companies manage their regulatory compliance with ...
Ewan's user avatar
  • 77.4k
2 votes
Accepted

How to ensure privacy on a remotely hosted server?

If you design for privacy, and you have no control on the remote host, you have to consider the host as being potentially compromised. The only way then to ensure privacy, is to handle only data ...
Christophe's user avatar
  • 78.6k
1 vote

How can I enable user data sovereignty in a B2B SaaS application?

I do think that amon's answer is very good, I'd add a couple of thoughts as well. My experience tells me that third-party audits against standards coupled with contractual obligations are usually ...
Thomas Owens's user avatar
  • 83.3k
1 vote
Accepted

How can I enable user data sovereignty in a B2B SaaS application?

Talk with your customers. Figure out what they actually need. Quite often, legal protections are sufficient, i.e. a contract that spells out that you will only use the data for the customer's purposes,...
amon's user avatar
  • 135k
1 vote

Do I have too much access to my users' personal media?

The cloud, as it's sometimes defined, is just someone else's computer. In this case, you are the cloud and other people are uploading files to your computer. So yes, it is normal that you would have ...
amon's user avatar
  • 135k
1 vote
Accepted

Do I have too much access to my users' personal media?

am I missing a security/privacy measure here? Yes. Get the client to encrypt the blob before it is uploaded to the cloud, with a key which is known only to the client and not to you. There are some ...
Philip Kendall's user avatar
1 vote

How to create a code that will be send by SMS to verify that it's a valid phone number?

The code just needs to be random, and it needs to be associated with and only with the one particular session that is attempting to log in. That way it doesn't actually matter if you know user123's ...
svidgen's user avatar
  • 15.1k
1 vote

Should I keep in the database a record of the user accepting the terms and coditions?

If you have multiple signup options, marketing opt ins, data protection opt outs, various versions of your TnCs etc etc then you will need to keep track of which user selected what. This is fairly ...
Ewan's user avatar
  • 77.4k
1 vote

How generate an anonymous (even for system administrator) identification number from a non anonymous identification number

It depends on a few things: How large is the input keyspace How secure are the systems that will be processing this data How much money do you have to spend The size of the keyspace -- the original ...
anon's user avatar
  • 11
1 vote

Should MVC/REST return a 403 or 404 for resources belonging to other users?

It really depends on the information given away by the 403 status code. If you have an API endpoint responding to GET /myresource/{id} with a 404 when the resource does not exist, then the status code ...
Maxime Rossini's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible