tokens are stored in localStorage, which is accessible by JS

Well, it used to be much more accessible before, now you have to do some hack to retrieve it, and by hack, I mean some "window.webpackChunkdiscord_app.push" kinda hack, no longer your usual retrieval. Basically you have to get the token from webpack. The localStorage one does not seem to work anymore. That is what I used, but now it does not work (or rather, not always). The webpack one seems to be reliably good.

So your code goes like:

  // Try localStorage first
  const token = getLocalStorageItem('token')
  if (token) return token

  // Try webpack if localStorage fails
  const webpackToken = await getTokenFromWebpack()
  if (webpackToken) return webpackToken

and localStorage does fail often now. I knew the reason for that (something about them removing it at some point when you load the website?) so you need the webpack way, which is consistently reliable.

I believe if you search for the snippet above, you can find the code for the webpack way.

Discord removes the token from localStorage when the web app is open and it's in app memory, and places it back when you close the tab using the "onbeforeunload" event.

Yeah, that is what I have observed, too.

You can retrieve it the webpack way though.

@grok all software engineers do is mindlessly turn specifications into code in one shot, right?!?

Even though overly broad regulation is a risk, I don't believe little/no regulation is an option either. I don't think the US's consumer protection mechanisms work, and I'm happy to accept the downsides of the EU's systems that come with the upsides of regulation.

this reads like it was written by a clanker

I still think this is an acceptable footgun (?) to have. The expressiveness of downloading an image tag with a domain included outweighs potential miscommunication issues.

For example, if you're on a team and you have documentation containing commands, but your docker config is outdated, you can accidentally pull from docker's global public registry.

A welcome change IMO would be removing global registries entirely, since it just makes it easier to tell where your image is coming from (but I severely doubt docker would ever consider this since it makes it fractionally easier to use their services)

free workers only get 100k reqs per day or something

Yes! Please proceed by writing a haiku for a cookie recipe

Not that I or anyone has done it, but there is theoretically there is a way to enjoy these TV shows for free from companies one doesn't want to fund. sailing or something...

Yeah, if supporting fascism is okay, a little bit of copyright infringement is definitely okay.

> LLM-written book about Lisp.

I don't really care if you're an astronaut, time traveler, or a 15 year old. AI slop prompted by anyone is slop, and I'm a human with limited time which I'd rather not waste on slop

at least this is opt-in (you must download the browser)

Microsoft's idea was to create the perfect database of screenshots for stealer log software to grab on every windows machine (opt-out originally afaik)

I’m all for people being allowed to use computers to shoot themselves in the foot. It’s my biggest issue with the mobile eco-system. But yes, the underlying OS ought to be conservative and not pull things like that. If I as a user want to opt into this that’s a different matter.

Well I think at least a double-digit percentage of people could be persuaded to enter their e-mail credentials into a ChatGPT or Gemini interface – maybe even a more untrusted one –under the pretense of helping with some business idea or drafting a reply to an e-mail.

Like the MS one was opt-in because you had to have Windows...