ucarion

It does get at what I'm talking about. But I've seen retrying in this situation lead to worsening the situation, because your basic problem is two hot paths conflicting with each other and now you're conflicting even more.

Do folks have any thoughts on ways of avoiding deadlocking access patterns? In a codebase where folks are sort of adding ad-hoc endpoints left and right, it's hard to avoid the case of two endpoints that more or less want to do:

    tx1: update a
    tx2: update b
    tx1: update b
    tx2: update a

I do not agree that slice() should operate on extended grapheme clusters. Don’t lump the grapheme cluster/scalar value split in with the sins of UTF-16 and its unreliable code point/code unit split.

Maybe a simpler argument against this idea is that the definition of an extended grapheme cluster changes between versions of Unicode. The relevant standard is on its 47th revision (not all of which change extended grapheme clusters, but many do): https://www.unicode.org/reports/tr29/

In old-school chess AIs, zugzwang is also of interest because it can break null-move pruning[0], which is a way to prune the search tree. "Null move" just means "skip your turn", and the assumption that skipping your turn is always worse than the optimal move. But in zugzwang positions, that assumption is wrong, so you have to avoid doing null-move pruning.

Stockfish's heuristic for "risk of zugzwang" is basically "only kings and pawns left over", alongside logic for "is null-move pruning even useful right now" [1]:

    // Step 9. Null move search with verification search
    if (cutNode && ss->staticEval >= beta - 16 * depth - 53 * improving + 378 && !excludedMove
        && pos.non_pawn_material(us) && ss->ply >= nmpMinPly && !is_loss(beta))
    {

[1] https://github.com/official-stockfish/Stockfish/blob/1a882ef...

Leads me to discover: https://www.twitch.tv/chat_loadtest_01 ... neat!

I've almost never needed any of these, but there's all sorts of weird redirections you can do in GNU Bash: https://www.gnu.org/software/bash/manual/bash.html#Redirecti...

It is news to me that manipulating ASCII art is something AI can do well! I remember this being something LLMs were all particularly horrible at. But I just checked and it seems to work at least with Opus 4.5.

claude(1) with Opus 4.5 seems to be able to take the examples in that article, and handle things like "collapse the sidebar" or "show me what it looks like with an open modal" or "swap the order of the second and third rows". I remember not long ago you'd get back UI mojibake if you asked for this.

Goes to show you really can't rest on your laurels for longer than 3 months with these tools.

Eddie Izzard was joking in 1998 about the "The" and the prohibited names for The City (https://youtu.be/QRB_GhLXCds?si=R4kYkodzvYDxe33H&t=276), so it's probably been like this for many decades thence!

For those unfamiliar: https://news.ycombinator.com/item?id=26998308 ... It's basically a bunch of posts that 'dang and 'tomhow (others too? idk) think are underrated, so it tends to be potent hacker-catnip stuff.

For others, I'm sure parent knows: OKLCH is largely a bugfix for CILEAB. Both try to make a color space where even steps feel evenly spaced to a human. But CIELAB had procedural flaws in its creation.

See slide 19: https://www.w3.org/Graphics/Color/Workshop/slides/talk/lille... -- if you ask CIELAB to make "pure blue" (RGB 0 0 100%) become grayscale, the intermediate colors become purple to the human eye. The entire point of a perceptual color space is that that doesn't happen. OKLCH fixes that.

BTW, credit to Björn Ottosson, who basically side-projected a color space into the web standards and more: https://bottosson.github.io/posts/oklab/ ... folks like him are why we sometimes have nice things!

Kind of moot anyway; 100x zoom is equivalent to a 2400mm lens (with no stabilization assist). If you can hand-aim that on target, you're an elite marksman.

Seems their IG has some of these, including the shot from the article: https://www.instagram.com/tripodtales/p/C8hRS0ctzCp/

Factory Butte: https://www.instagram.com/tripodtales/p/C6gg-wpS-tr/

"Long Dong Silver": https://www.instagram.com/tripodtales/p/C-yLCskOGiC/

Into the Past by Jim Hildreth

The area in this photo -- the Caineville Mesa, Factory Butte, "Long Dong Silver" (I'm not aware of a more polite name) -- is some of the strangest land in America. It really is that lunar blue gray. The Temples of the Sun and Moon (enormous natural sandcastles) are also nearby, and are similarly eerie in the evening.

The closest I've ever felt to being in space. Recommend!

Since we both worked there: I can think of a few places at Segment where we'd have added more reporting/analytics/search if it weren't such a pain to set up a OLAP copy of our control plane databases. Remember how much engineering effort we spent on teams that did nothing but control plane database stuff?

Data plane is a different story, but not everything is 1m+ RPS.

Shuffle-sharding is similar to stochastic Blue stuff, and you'll find Amazon talking about it:

https://aws.amazon.com/builders-library/workload-isolation-u...

Which isn't exactly what you're talking about, but between that and other things in the "Builder's Library" series, you can see that people are doing this, and writing about it.

In practice, identity providers (Okta, Entra, etc.) will retry for a bit before reporting to the IDP admin that their SCIM connection to the SaaS vendor is unhealthy. From there, things get fixed ad-hoc.

Okta and Entra have different request patterns, and so have differing artifacts if the SaaS vendor's state diverges from the desired state. Okta tends to be more stable, because they usually GET-then-PUT (c.f. compare-and-set). Entra likes to PATCH, which leads to dead-reckoning artifacts.

What you're describing is an interesting and hard problem in computer science, but SCIM is not trying that hard to get it right.

To really support Entra in particular, you must have to reference Entra's implicit spec, which is roughly documented here:

https://github.com/AzureAD/SCIMReferenceCode/tree/master/Mic...

One way this comes up is that the way those C# objects serialize, there are properties that Microsoft will send you in form `"key": { "value": "xxx" }`, but which they expect that you read back to them of the form `"key": "xxx"`.

It's best to not take the SCIM RFCs too literally.

Django is in the works! As is Laravel and Rails (my first love).

Right now we offer prebuilt pages you can redirect to, as well as SDKs your clientside JavaScript can talk to if you want to reskin. Said SDKs are glorified cURL wrappers, and our prebuilt pages are built using them too.

Prebuilt UIs: https://tesseral.com/docs/features/self-serve-organization-s...

The API they talk to, which you can talk to too: https://tesseral.com/docs/frontend-api-reference/tesseral-fr...

Since Tesseral's data model is that users belong-to organizations, anytime you have a user, an organization is also available to you (e.g. in the context of a JWT's claims, or an API call to `api.tesseral.com/v1/users/user_...`, etc):

For authz checks, you have a similar denormalization when you use Tesseral's RBAC. When a user gets an access token, those access tokens have a list of `actions` that the user is allowed to carry out. All of our SDKs have a `hasPermission` function that basically just `accessToken.actions.contains(...)`:

e.g. Go: https://pkg.go.dev/github.com/tesseral-labs/tesseral-sdk-go@...

Again in Go, here's the data type for access tokens:

https://pkg.go.dev/github.com/tesseral-labs/tesseral-sdk-go#... (organization lives in .Organization, list of permissions lives in .Actions)

So we do a little bit of denormalization whenever we mint an access token, but in exchange your code doesn't need to do any network hops to get an organization or do a permission check. (Access tokens are ES256-signed, and our SDKs handle caching the public keys, so that network hop is very infrequent.)

Thanks Aeneas!

One way is that it's really obvious what you're supposed to do with Tesseral! Like, here's our Go SDK docs:

https://tesseral.com/docs/sdks/serverside-sdks/tesseral-sdk-...

It's pretty clear what you're supposed to do. Keycloak can't give you that kind of clarity, because they're designed to accommodate products that are B2C/B2B, single- or multi-tenant. Sometimes Keycloak is an IDP or an OAuth gateway, sometimes Keycloak is a customer identity management product.

Keycloak requires you to have familiarity with technologies at a level beyond what most developers have worked with. When your customer says "I need to enable SAML, and require it for all logins", with Keycloak you now need to know how SAML works, how to configure it, and how to walk your customer through that process. (FWIW, they can't support SCIM at all, you need to install a 3rd-party plugin.)

In Tesseral, all you need is this [0]:

    import { useOrganizationSettingsUrl } from "@tesseral/tesseral-react";

    const Example = () => {
      const organizationSettingsUrl = useOrganizationSettingsUrl();

      return <a href={organizationSettingsUrl}>Organization Settings</a>;
    }

[0] https://tesseral.com/docs/sdks/clientside-sdks/tesseral-sdk-...

It's a bit of a mix of subtle design decisions and discrete features.

A few major things:

1. In business software, Organizations are your tenants. Users aren't tenants themselves. You have to think about things like "Which Organizations can this person sign into", you need to support user invitations, and you'll need to accommodate IT admins asking for control -- think stuff like turning off magic links for every employee at their company or requiring every employee to have MFA.

2. B2B software needs different auth and user management features. The big one is SAML SSO, but there's also stuff like provisioning (and deprovisioning) users from identity providers and letting your customers define custom role-based access control. Similarly, consumer software generally doesn't need to support stuff like API keys or audit logs.

Generally speaking, the big conceptual difference is that you're selling to a company, and the company wants control.

We're aiming to abstract away our AWS dependencies -- KMS, S3, SES -- specifically to accommodate other clouds or non-clouds.

We're trying to offer a clear abstraction for specifically B2B SaaS. By taking opinions, we can make implementation quicker and easier for developers.

And every other month was named after a coup d'etat!

Is the main objection to RFC5234 its weird syntax for repetition (*THING, [THING], 5THING)?

Six-digit verification codes for something like a "forgot password" flow are OTPs -- they're only good for one login -- but they are not HOTP/TOTPs. HOTP/TOTP has a registration step, where you copy a server-generated secret to your phone through a QR-code-encoded otpauth:// URI (https://github.com/google/google-authenticator/wiki/Key-Uri-...). That doesn't happen in a "forgot password" flow.

Incidentally, if you think of TOTP as being HMAC(unix mod 30, secret), one idea would be to do public key crypto instead of symmetric HMAC stuff. That's basically what a security key is.

If you additionally made it so that you couldn't phish the security key -- by having the OS + web browser know which apps can ask for which security keys -- you'd have reinvented WebAuthn.

P.S.: Make you sure you have stuffing protection in place against these kinds of six-digit-code auth schemes. A million possibilities is often acceptable for a secondary factor, but it's useless if attackers can just try all million codes.

Since they're in the thread, nice article 'dogacel! I've never seen an article on this that also took the time to dig into HMAC internals and that gnarly DT function.

Sorry if asked and answered: can you hand-edit the generated migrations? Like, what if I want to do a create index concurrently or something?

I think short options taking a value in the same argv (i.e. `-o=1` stuff) isn't a GNUism mostly because it's backwards-incompatible with POSIX. `=` is a valid getopt option character, `chmod` uses it.

That said, I think? 'nloomans means for USER_CONTROLLED_DATA to be a set of short flags, not flag values, as in:

    root@08e9950d5bfd:/# export USER_CONTROLLED_DATA=lh 
    root@08e9950d5bfd:/# ls -a"$USER_CONTROLLED_DATA"
    total 56K
    drwxr-xr-x   1 root root 4.0K Mar 23 16:51 .
    drwxr-xr-x   1 root root 4.0K Mar 23 16:51 ..
    [...]