Senior Web Developer or "Full stack developer" by today standards, better-know as the "unpopular opinion" on several threads.
The current state of web development makes me sad, mostly because it's all fault of all the die-hard javascript developers, you know what f*ck all javascript/ecmascript/typescript/node developers.
I think in your release model are forgetting about development and the staging areas that most devs can run or well use freely before ever going to production. Those are the places where the developers not only have access but are also encouraged to disrupt, destroy and let their creativity run before going to production. Giving access to production from day 1 its a disaster waiting to happen and m pretty sure stoling ip or databases aren't part of your monitoring software scope nor being able to detecting malice.
From my POV: Open Source should be about transparency, 3rd party code reviews and occasionally contribution from your own fanbase/community or well niche players. It was never about allowing (unpaid) developers help you built your project, unfortunately most people think the later is why you go OSS.
Personally i prefer the type of mentor/boss that comes and says things straight, surgarcoating everything isn't good once you realize that everyone could think you are stupid or well starting to find your replacement.
Oh boy... is he used to work on facebook? when i was a jr dev, i didn't have access to production everything went to source control and then tested by my project technical leader and qa.
This ensure that i won't do this things since my changes getting reviewed and tested plus we have reproducible builds that anyone can verify and continue working.
Case in point: No JR Dev ever need access to production ever, period.
The problem is not the tooling, the browsers or JS itself, the problem is that JS developers are trying to put themselves EVERYWHERE THEY CAN in attempt to pursue the now infamous "full-stack engineer" motto.
1) An Stable "enterprise grade" version which receives fixes and minor performance updates for at least 5 years, maybe even charge extra for another 2-5 years round (just like Microsoft does).
2) Reports: Business love reports, if they add a way to generate reports straight from the DB (like Oracle and SQL Server) is a killer feature most of the time.
> what could have they done differently to stay afloat?
Make a private (non-OSS) version optimized for Business (B2B), do external consultant jobs and pretty much ask for donations from the big players/users. This is a common problem from almost every OSS project and so far the only one that is doing this is OpenSSL.
IMHO if you know about those you pretty much most of the terminology the "js guy" is using, personally speaking i know Angular haven't used yet bower in any project.
IMHO pgadmin X is a mess... finding were the tables, indexes and views when you first run pgadmin is dauting. Then setting permissions or properties for tables is mostly useless since they don't work at all (most of the time you have to get and fix the SQL generated rather than using the GUI). To this day its still baffles me why Python developers choose PGSQL as his defacto DB standard.
Never heard of the survey maybe the data is biased to only approach people on the silicon valley where technologies are used as if they were current season premium fashion cloths.
I actually thing is the other way around... App Development is solved (unless you want to run the same codebase on multiple OS) but Web Development is a mess now that JS devs are trying hard to put themselves in every layer of the app from the networking layer to the data layer, throwing out the window years of good practices.
The day PostgreSQL had a decent development suite, that's the day PGSQL is going to rocket, it's sad that even the freaking MySQL and SQLite have better (free) tools.
Just try to win a project on any modern "freelancing" website and you will understand... personally i used to make solid money on Rent-A-Coder even before getting my CS degree and when they sell us to Freelancer, i started losing bids and the great bids were "closed" to only accept bid "first world developers" (ie US Developers) or limited to people that already paid for the website membership to get in so pretty much any bid today had like 20 indian developers working for 5c/hour.
The sad part is that when you reach that age (31 here) is you start looking at the "new trend" (ex Angular, React and NodeJS) as unnecesary and the "new devs" that doesn't have any experience on making and maintaining long term projects (> 5 years) look at this as the holy grail technology and if you aren't using that technlogy it means you aren't as efficent as the "new guys" so you either migrate to management (which sucks), change industries or became a private just another entrepenur.
Problem with your solution is that you already now people, if you don't you have to rely on websites like freelancer that pretty much are the same as paid-to-win-the-bid in modern mobile video games and it's sad when people all over the world bid really low those making the website effectively racist regarding devs that to this for living instead of side jobs.
Like what? normal disclosure or leaking the exploit to big guys like taviso? nah this won't do shit... cisco will patch and charge you his "premium membership" to download updates and sysadmins won't update now that shit hit the fan and the average kiddie can, cisco will be forced to release the update as free (to protect his stock) and sysadmins will be forced to update asap.
Well if i were part EQ and saw my exploits leaked somewhere else, this is what i will personally recommend doing, to level up the game and meanwhile let's blame russia so my job is secure (finding exploits in TAO) and to keep out of the game the small league players (HackingTeam, NSO, FinFisher, et al).
Lots of people are talking like it's a political move, insiders, super team hackers... but imho this is just to level up the game.
Pretty sure that this tools are know to the NSA to be leaked and probably saw a small guy using this therefore they release the stash of the most "shared" tools to the general public via this charade and the small players start again from zero and the big league players (equation group) can dominate the the field again with his 0-days.
f* yeah lots of tutorials and books start saying "do as i say, write everything i ask you to do, i know more than you noob" specially those made by the author of "learn * the hard way".
There is a big difference with the word "should" and "need".
While i should run PHP in a jail, it doesn't mean i need to. While with python, nodejs, ruby et al, i need to otherwise it becames a dependency mess for every app on the same server.
While RoR, Python, NodeJS et al don't solve the most annoying issue for every developer: Deployment. Then they don't solve anything.
And don't start talking about docker... that's a patch/hack to a serious problem, if i need an entire "jail manager" just to run your app then deployment is not as easy as you kins think it is.
With PHP you can grow your own infrastructure from being a couple of calls to your RDBMS/MySQL up to installing modern libs and implementing a framework.
On the other hand: With RoR, Python, NodeJS, et al (which by itself can do anything, since they need frameworks and libraries for anything web-related) you have to start with these HUGE dependencies and package managers that only add more technical debt to your project plus your projects can't start from dead-simple bd-calls it has to be all or nothing and under the same structure because "it's the right thing to do bro, you will thank me later"... guess what: i still don't use everything.
The day a languages appears that is web-ready and dead-simple with no technical debt that's the day we can say: PHP Suck.
Forgot to check if the server isn't backdoored. You will be surprised how many providers add many backdoors and monitoring systems you don't need (m looking at you AWS guys).