time4tea

You dont know immediately if something that superficially seems the same actually is.

Copy and paste once is fine, twice, not so much.

Often I've seen two totally different things exist in one bit of code, no overlap!

Premature generification is bad, and leads the developer to believe that two things are the same, making it harder to see they are not.

Also, can make it much harder to see that a different abstraction would give a cleaner outcome....

Ax102-u

People seem to set their money on fire?

Well, my point was that maybe it actually isnt "to get more people to give to charity", maybe its actually something else.

Its actually very easy to give £5/month direct to a charity. Takes about 2 minutes, just gotta do it.

Ive always suspected that this is all of a tax dodge, a money spinner, and a pr exercise "we gave xxx to charity" - no, your customers did.

Just set up a direct debit to your favourite charity.

Yup, this works so nice.

Using traefik or caddy as proxy.

Docker context for remote access - over Internet or vpn, whatever.

Swarm-cronjob for scheduled things.

Labels for things that need to run in particular places.

So easy.

Personally, k8s is fine, but its an abstraction for building a service architecture, not the thing an end user (developer) should ever use. If you are in a big company and you are using helm or k8s yaml files to roll things out, your infra or platform teams have missed something out.. building the platform!

Website was too long.

ScrumMaster - a qualification you cannot fail. (Pls pay fee)

Ultimately big company look for things to help them sort their terrible product and software processes.

The whole point of agile, its that you don't know!

If you are SaFE, or 4 week sprints.. you are in management imposed bs.

Your company is a about to be eaten.

I mean, sure.

But what about allowing user inputs in trusted fields,

Or allowing switching environments per request, on inputs from users

Or allowing requests in a user context to access storage from another

Or storing everything in plaintext on a node that everything can access

Or not validating user inputs

Or...

Its not a success story.

Ah yeah, you are right. It was easy to miss, as it was ~30 words in a massive article.

Float to Live

https://rnli.org/safety/know-the-risks/cold-water-shock

No mention of JVM.. which is a bit odd as recently is kinda solved this problem. Sure, not all use cases, but a lot.

It uses N:M threading model - where N virtual threads are mapped to M system threads and its all hidden away from you.

All the other languages just leak their abstractions to you, java quietly doesn't.

Sure, java is kinda ugly language, you can use a different JVM language, all good.

Don't get me wrong, love python, rust, dart etc, but JVM is nice for this.

Super interesting article.

Didn't operate for long? 1984-1995 - its long enough. Still remember seeing those scrambled programs in France.

At the time in UK, lets say 87-92, the concept of paid tv over the air was incredible. Satellite existed, but wasn't very prevalent.

Carbon offsetting is a nonsense.

Any company that uses it, is doing nothing other than buying a grant to pollute.

So hard to read that article, with all the pop ups, scroll hijacks, and back button grabbing (soon to be illegal)

Why do they try to hide actual content with hateful tech?

Anyhow, no way I would give that company money.

Hmm, not sure - the entire point of this sort of thing is that nobody should ever have your private key material. Whether they say they discard it is immaterial, they have had it, so they could use it, and then as far as everyone is concerned, they are you.

Because the key is sent via the web, anyone in the way can see it. In lots of companies, trusts are manipulated so that the content is visible to intermediate proxies.

With a private key that has been given to you by somebody else, it is possible to repudiate any transaction that was made with the key. Its not so much as they could skip any security - its that if they have the key, they don't have to.

keys are protection from anyone, and an audit trail isn't useful when its possible to forge/repudiate literally anything.

imagine if your card pin was also written down in the card factory - you'd be suspicious that anyone can withdraw money from your account - and the bank would say 'ah but only you know it'. In fact this did happen - the bank was only issuing 3 different pin numbers.

When you create an app in GitHub - you are required to create a private key so that you can sign requests on behalf of your app.

Sounds reasonable.

However... to create the private key, they require you to download the private key from them. Which means they have it. So ANY APP on GitHub can be impersonated by GitHub as they have the key material for every app... so what is the point?

Am I losing my mind?

edit: i can't edit the link - it should be https://github.com/settings/apps

See also 2600Hz...

I definitely have not had that experience, although use FF for personal, various work, and various educational places.

None of those have required me to install a particular extension..

Of course thats not to deny your experience!

The only time profiles ever come into it, for me, is using web driver, playwright, or whatever.

I guess maybe the usage stats dont support making the profile selector better.

But also, maybe its a thing they would accept a change for?

Firefox is pretty cool. Use it every day.

Blocks ads Multi account containers Dev tools very good

I never notice that it is in any way slow, except for those sites that need infinity cpu on any browser, like jira.

What specifically is the issue? To my mind it quietly just gets on with things.

Garage is quite nice, for the cases I've tried so far. I didnt find it heavyweight.

Tres bon!

Spec driven ddevelopment.. ahh yes, because the formal methods era of computer programming was so quick and successful!

Let me find my: Requirements Specification Requirements Analysis ...

The circle will turn once again when people re-realise that by tue time you've written what should happen in enough detail, you've written the software, and English isn't that great at avoiding ambiguity.

Cancelled today after responses became code soup, skills ignored completely, and in response to a question told me "its A, no thats wrong, its B, no actually i dont know, please look for the answer".

Something materially changed in last 4 weeks.

Also, see made up boosterism about finding security holes everywhere. Its just fanning the flames of the industry worries about all the stupid account take overs.

Totally agree. But, if i may, the docs on varnish and tls are hella confusing. I just re-read the varnish v9 docs, and its not clear at all that/if it supports tls termination.

Literally every doc, from the install guide to the "beef in the sandwich" talks about it NOT supporting tls termination... then one teeny para in "extra features in v9.0" mentions 'use -A flag'...

This is cool! But also, worth mentioning. Sure I know its an open source project so you don't owe anyone anything, but also one with a huge company behind it - and this is a huge change of stance and also, sounds cool.

I initially read this as "we" being "Varnish Software", but maybe that was wrong.

Thanks for the info, but I'm a bit confused, sorry.

The reason for hitch was that tls and caching are a different concern, and the current recommendation is to use haproxy, which also isnt integrated into varnish/vinyl.

But you say that the reason to migrate off hitch is that its not integrated?

But what happend to separation of concerns, then? Is the plan to integrate tls termination into vinyl? Is this a change of policy/outlook?

Thanks!

Thanks for this. You dont mention hitch though. Is that now deprecated/discouraged?

It hasn't seen much action in a while, but maybe thats cos it works?

just use the tool that does the job.

TLS in -> hitch or caddy Cache -> varnish/vinyl TLS out -> haproxy

Connect them up with Unix sockets, if you like.

One of the most uplifting things I've seen for a long while.

Amazing artistry and skills.

Quite hard take an article seriously with this line in it:

int hour = order.timestamp().atZone(ZoneId.systemDefault()).getHour();

(Because... does the hour you did the thing change according to where you run the code? no - it should use either the location of the trader, or the exchange, neither of which are related to where the code runs)

Using strings as different kinds ids is kind of an anti pattern too. They are IDs in different domains. They can be a strongly-typed long (or other type, uuid, snowflake, whatever). No string concatenation required. This then carries on to the regular expressions - if you use strong types, you then don't need to validate that the stringly-typed stuff you used earlier, and hopefully didn't permute some function arguments somewhere is actually valid.. it just is)

The example shows rentrantlock for a single entire method.. there's no huge advantage over synchronised in this case.. maybe there's other code thats not shown.

Using double for prices & costs? You really need to be much more sure about what number of money you really have. I cant pay you $2.19999999999999.

If you have a cpu-bound algorithm, running vastly more threads than cpus isn't ever going to help, and if you really have 200 cores, then you'll want to modify your algorithm to remove synchronization... thanks Amdahl!

There may be some suggestions in the article, but it feels forced.

edit: added details on timezones, validation & threads.

You can block CN, RU, SG, KR, and the level 3 from "ipsum" and the numbers go down a lot.

People might not know about ipset - dont use individual rules in iptables.

Nginx can reject easily based on country.

geoip2 /etc/GeoLite2-Country.mmdb { $geoip2_metadata_country_build metadata build_epoch; $geoip2_data_country_code default=Unknown source=$remote_addr country iso_code; }

  map $geoip2_data_country_code $allowed_country {
    default yes;
    KR no;
    SG no;
    CN no;
    RU no;
 }

Its because, although sometimes a delivery cyclist might be annoying, the reality is that there are almost zero KSI due to cyclist in any country worldwide. The rules designed for SUV dont actually make sense for human-scale transport.