vvanpo

They don't stop you from seeing the stars, but I find them very distracting. Makes the experience of looking up at the stars on a quiet night less peaceful, I find.

How many applications actually do, though? At most places I've worked it's common to integrate a schema migration tool (flyway, liquibase) that requires DDL, and I've never seen anyone go to the effort of splitting out an ephemeral instance to run the migration with a separate database connection configuration.

Building an application that is immune to attack defeats all possible attack scenarios, yes. But no application is perfect or immune to all possible attacks, the concept of defense-in-depth is an acknowledgement of this.

As explained in the article this wouldn't work, because changing your org means your stored hash is no longer valid (as the org is incorporated in the hmac), and you can't generated your own hashes because you're missing the pepper. So after changing your org all subsequent requests would fail.

A pepper is just a salt that is "secret", i.e. not stored next to the hashes being salted. It indeed provides the desired defense-in-depth, in that a breach of the database does not allow spoofing requests to the application; a successful attack would require both an exploit giving database access as well as an exploit exposing the secret pepper. But this is just a result of splitting state across multiple data stores---you could theoretically split data across n databases which would require an attacker to find n exploits. As such I don't fully agree with their conclusion that "database state alone should not be able to grant authentication": just because you store application-wide secrets elsewhere doesn't mean it's not part of the application state, and isn't stored in a database.

For most monolithic applications I think the whole issue is be a bit moot; if the rest of the application state is in the primary database, then an attacker with database access could presumably accomplish anything without the need to spoof another user at the authentication layer.

Lastly, this scheme doesn't provide any mechanism for rotating the pepper.

It sounds like there is a story here, have you written about this somewhere?

How does this compare to FOKS (https://foks.pub)? Do both projects accomplish similar goals?

Edit: I see that this is primarily intended for federated social networks, but should be reusable for other uses. However for other e2ee systems (e.g. messaging, filesystems) where hiding your social graph is important, wouldn't a key directory be able to infer (part of) your social graph by recording which lookups you make? What's the best way to mitigate that?

I always thought the "made with love" taglines were inspired by the same Clay Shirky talk: https://youtu.be/Xe1TZaElTAs?si=3hUBnk8IXIzlXw4i

Instead of logging in, file a data erasure request: https://help.glassdoor.com/s/privacyrequest?language=en_US All it requires is verifying your email.

NPM and other Node.js package managers happily deduplicate dependencies are compatible within the specified version constraints. So if 3 different modules in your build specifies `foo^2` and two other modules specify `foo^3`, in general you will have two copies of `foo` loaded.

Quick note: your website front page currently says

Our open source code has been audited by reputed cryptographers.

I think you probably mean "reputable", as "reputed" inspires a lot less confidence.

From the article linked above:

To that, I can only respond that, in a properly configured shell like the one that comes by default with GoboLinux, typing /Programs takes the exact same number of keystrokes as typing /usr: slash, lowercase p, Tab.

I don't think Go or Java do.

Go's module system was specifically designed with this problem in mind: https://go.dev/blog/versioning-proposal

I think Java projects get around this when they have to with shading, but that's a bit clunky.

Hours worked is the #1 driver of any worker’s output: use your right to monitor.

I don't think hours behind a screen have ever had much of a correlation with productivity for me. Autonomy, stress, being tasked with solutions that actually make long-term sense, etc. must have a much stronger correlation. The enormous erosion of trust that having my hours monitored would have would certainly impact my output.

If that were the only point to an operating system, why doesn't Windows have a monopoly in all areas of computing?

Surely there are other considerations beyond stability to be had when choosing an operating system?

I see what you mean, I guess the mix-up here is that we have different working definitions of "enforcement".

For example, I would argue that Moxie's desire for unofficial clients to not use the word "Signal" in their project name is a statement of policy, whereas the takedown requests to remove the projects from GitHub and the Play Store are examples of enforcement of that policy.

That said I think I can be convinced that directly informing a violator of your policy of said policy is a type of enforcement in itself.

I also interpreted them that way.

It looks to me like those clients were removed due to trademark infringement (having "Signal" in their name), I don't think they were taken down because their code connects to OWS' servers (would GitHub or Google ever honour a takedown request like that?).

I recently switched to `rg` after many years of using `ag`, and the fact that it properly handles `.gitignore` syntax makes my life much better.

Do you have a source for that? The article seems to contradict this, from what I understand Ketamine is used for cases of treatment-resistant depression, i.e. many kinds of medications have been tried and failed.

There are many ways macOS improves over Linux desktops, but file explorers is not one of the arguments I would have made. Finder is practically unusable.

That graph shows results for Chrome 55. According to https://v8.dev/blog/cost-of-javascript-2019, parse times in Chrome have improved significantly over the years.

On the one hand, I understand that complete prohibition for drugs and alcohol just don't work. But I have a difficult time squaring that against my feelings towards tobacco, where I feel it would be so much easier for me to quit if I wasn't tempted by its availability at every corner store.

Jeff said

I don’t know of another company

He didn't say contemporary company.

Perkeep devs built a tool to grab the originals: https://github.com/perkeep/gphotos-cdp#gphotos-cdp

If you browse around on Goodreads, you find a lot of people that hit this milestone. But I don't really understand how. My e-reader tells me that based on the number of books I've read and the hours I've spent reading them, one book per week would be a full-time job. Although I recognize that I'm probably a much slower reader than average.

This makes computer science a bright target for mathematical formalization. This is entirely different from science.

Yes, but until computer science is fully formalized we will still need design, and can benefit from science. If/when it is fully formalized and creating software becomes an automate-able optimization problem, we will no longer need system designers. Or software developers, for that matter.

I never said ignore the field.

Not explicitly, perhaps, but it really does read like that is what you're implying. You said multiple times that anyone labelled as an architect or designer knows nothing and is peddling bullshit. If we can agree that design is amenable to scientific inquiry, then it would make sense that some designers do know things.

Re-reading your original post, I realize now that I chose the wrong quote to respond to. I do agree with you that anything labeled as "design" is necessarily constrained by a lack of knowledge. Any time there are multiple ways to solve the same problem and there is no a priori way to figure out which solution is the best, we are forced to design. My point is that this describes software development, which as noted above has not been fully formalized. Writing software is design, and therefore needs designers.

Often we have no choice. No one calculate the best work of art. Art is created by design.

Are you implying that when it comes to software, we do have a choice?

The concept of abstraction, good abstractions and bad abstractions can be separated from design and formalized into exact definitions. That is my argument.

This is where you lose me, I'm not sure I understand what you mean here. Abstraction is a design principle, and developers argue constantly about whether a given abstraction is good or necessary. The motivation behind abstraction as a principle hinges on how you define "too complex", and that sounds very subjective to me—the opposite of formal.

Anytime you see the word "Design" it refers to a field where we have little knowledge of how things truly work.

There are branches of science whose theories are more often derived from data and observation than from axioms. Just because you may not be able to break something down into first principles, does not mean that the knowledge is useless.

Design, too, can be data driven. UX and UI design can be analyzed using A/B tests, or by observing patterns of user behaviour.

It might be true that much of systems design is based on anecdotal evidence and intuition, but I don't think that's enough of a reason to ignore the field of design entirely.

For example, the concept of abstraction in software design may be based primarily on the intuition that human beings are bad at holding too much complexity in their minds. But any software developer who has written more than one program will agree that abstraction is crucial to good design.

Who does that? I think most people browse the web with many tabs open at once, and switch between them constantly. I don't think it should be on the user to resize their browser viewport every time they switch tabs to maintain a comfortable measure. That's the website's responsibility.

Does that really happen? They jail you in the USA?

In Canada I've admitted suicidal plans on multiple occasions to doctors, psychologists, and once even the police. On two of these occasions I was sent to the psychiatric emergency room, but only for as long as it took to assess that I was no longer a harm to myself. The first time that took an afternoon, the second time it took a couple days. After that I went home, no repercussions.