Repository navigation
Stop naming the protoc host in the UI - #6
Merged
Merged
Conversation
Three places named it: the language group, the note beside the language bar and the footer, with the header badge naming it too. None of them needed to. What a user has to know is that this one target leaves the browser, which the wording still says; where it goes is an implementation detail, and printing it on every page is an invitation to point traffic at it directly. The messages shown when the service cannot be reached lose the hostname for the same reason. Source comments keep it, since that audience needs to know.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The hostname appeared in four places: the language group heading, the note beside the language bar, the footer, and the header badge — plus the error messages when the service is unreachable.
None of them needed it. What a user has to know is that this one target leaves the browser, which every one of those still says; where it goes is an implementation detail, and putting it on every page view is an invitation to send traffic at it directly rather than through the site.
protoc — on protoc.protobuf-net.devprotoc — compiled on a serverprotocon protoc.protobuf-net.dev — your schema is sent there…protoc— your schema is sent to a server when you press Generateuses protoc.protobuf-net.devcompiled on a serverprotocon a server.The badge's tooltip still explains why (
protoc is a native compiler and cannot run in the browser…), so the honesty is unchanged — it is one hop less specific.This is not a security boundary and is not offered as one: the endpoint is in the site's own JavaScript and the service is open source. It is the difference between findable and advertised. The service side has landed the matching half — its landing page now says only that it supports protobuf-net.dev, with
robots.txtdisallowing everything andnoindexon both.tsc,vitest(27) andvite buildpass.