264 karma · joined August 15, 2017
Email must be: * Secure and encrypted; * Have proven identity; * Have easy to fabricate and predictable rendering;
I feel like the ability to have forms and charts is very nice, but adds a lot of complexity, especially from a security point of view. I'd be looking at this kind of "application level" functionally being a layer added optionally on top, not being in the core protocol.
Here in the UK the deaths are climbing back up again as the second wave comes in. Yesterday we had 241 Covid-19 fatalities, a number not seen since the start of June.
Additionally, the way the UK is counting deaths changed a few months ago. Originally we were counting everyone that had been diagnosed with Covid, now if the death doesn't occur within 28 days of infection the death isn't counted as a Covid-19 death.
And finally, we're testing a hell of a lot more now so the alleged case numbers back in April (~5000 a day) don't marry up at all with case numbers now (~20,000 a day). I'm guessing back in April it was closer to 80,000 cases a day in reality, which would make the disease just as deadly now as it was back then.
Was out well before the iPhone, sold Internationally, had installable 3rd party apps (proper apps, not just "web" apps that the 1st gen iPhone had).
Apple fanatics always seem to think Apple create the first smartphone as we know it.
I really really want it to succeed and would be happy to back it on Kickstarter or similar.
How do we ensure that these projects don't end up being bought out by Facebook or Google?
You can't go selling peoples private messages to Netflix (the sheer audacity of that just blows my mind!). You can't allow peoples private data to be sold to data analytics firms that are trying to sway elections.
Facebook is built on the belief that people don't need privacy and I think that's fundamentally wrong.
As an aside, I hope people continue migrating to https://MeWe.com which has a clear privacy bill of rights at its core and zero ads. It makes money in a far more traditional approach by charging for "pages" and extended emotions etc.
I think if the WSJ posted factually incorrect information, Facebook would have reacted and asked for a redaction and probably an apology.
Also I read recently that they have a crisis internally amongst their staff with employees considering jumping ship. Additionally, new graduates no longer consider Facebook as the premium place to work. This may start to hurt them in the coming years.
Also, if a product just mentions "vegetable fat" it's more than likely palm.
I'd say from a programming language point of view, having keywords that are short (single word would be ideal) and phonetically distinct is really important.
One python programmer I watched on Youtube made his own vocabulary of strange sounds that he trained his software to recognise and translate to real keywords.
In my answer above, I was pretty clear about how the load on the database can be significantly reduced with a blacklist and optionally Redis out front, thus allowing JWT to significantly reduce the burden on the database.
Regarding session invalidation, I would handle this in two ways.
1. Support a "Log everyone out" function by storing a simple version number in the JWT. If the version constant in your app is different to the number in the JWT, it is invalid.
2. Support a "I need to logout user X function" by storing a blacklist of tokens in your RDBMS. If your RDBMS goes down, you have much bigger problems. A blacklist will be very short, and often completely empty, so lookups will be significantly faster than checking a session table. You could also use Redis or an application cache for storing the blacklist, with an RDBMS fallback.
Regarding storage, there's nothing stopping you putting your JWT into a cookie with the HTTPonly flag set. So long as you're not storing too much in token, they will be less than 4k and so will fit.
In this media rich age, the data size argument is a bit silly.
The "you're going to hit the database anyway" argument whilst probably accurate in most cases, doesn't invalidate that JWT allows for one or more fewer database hits on every request.
Having built-in integrity checking is definitely a feature. Just because you can do it without JWT doesn't mean that it's not useful that JWT does it.
IMHO the biggest argument against the use of JWT is that you can't easily invalidate JWT sessions. Should you need to dump a users session or if the information contained in that session token has become invalid then you might be in trouble. For my use cases so far however this hasn't been a problem.
JWT is a fine solution for quite a lot of use cases. As with everything tech, just be aware of the limitations and choose wisely.
Pattern 2: Yes absolutely
Pattern 3: Seems a bit inefficient, allocating memory when a simple if statement would avoid calling the method at all.
Pattern 4: Would prefer
if (foo && bar) { return true; }
return baz;
Than the proposed solution which is harder to read.
Pattern 5: Just no! The repository getRecord method should have no care about coping strategies, which may change depending on the calling context. It should instead throw an RecordNotFoundException. You could also use success and error callbacks in the method signature.
My hobby project languages or choice are currently D and Kotlin. I prefer the semantics and flexibility of D, but Kotlin has the backings of the tried and tested Java ecosystem, which is hard to beat when you just want to get down to it. Also web servers in Java are vastly superior at the moment. Vert.x is so very fast.