adeptima

Didnt know ...

"CapRover has built in anonymous usage analytics starting v1.11"

https://github.com/caprover/caprover/blob/master/TERMS_AND_C...

https://github.com/caprover/caprover/issues/1852

Was looking at CapRover to see if it has REST API

Looks shaddy

I was inspired by the article "Kubernetes The Hard Way" ... cant find the original article now

Had to study concepts like "bridged networking with libvirt" https://linuxconfig.org/how-to-use-bridged-networking-with-l...

No way I would recommend my way to study k8s ... it was just a pet project for a greater good.

Now in 2024 it's better to start from projects like minikube or k3s (my preference) on local computer

https://minikube.sigs.k8s.io/docs/ https://docs.k3s.io/

and later use terraform to provision infra

or

Forget it all and just use managed kubernets from cheaper providers like digital ocean

The result of inflicting pain on myself - I do value the work done by people who provide stable managed kubernets and upgrade it flawlessly.

as @wmf correctly stated "If the OP was running a virtual desktop on a server with no GPU then they probably had to fall back to software rendering which can be slow. This isn't QEMU's fault per se; if you physically don't have a GPU then you don't have a GPU."

and 99% cheap servers in the wild dont have a GPU or even hardware graphic card

yes, i connect with virt-manager and ssh-based libvirt url.

my main case was to scrape multiple messangers and apps with desktop ui only.

everything must run and render on server.

correct. thank you for phrasing it better

you can choose Apple virtualisation in UTM instead of QEMU too. Apple virtualization is optimized for M1+

Warning for humans! If you are trying to run a virtual PC on QEMY let's say on bare metal hosting from hetzner, you will very soon discover - QEMU is a dead slow without actual graphic card or at best you will get all kind of funky missing libs error messages on Ubuntu and other OS in very surprise spots.

Had a very good experience simulating K8s cluster with QEMU aka studing K8s hard way once I figure out how networking actually works between virtual machines and domains can be assigned with external proxy.

Back in 2021, I asked one of our devs who badly wanted GraphQL for his resume (this dev left in 6 months) to address the following issues:

- GraphQL performance issues

- GraphQL makes tasks more complex

- GraphQL schemas confuse junior devs, higher entry level

- REST cache easier

- REST if you understand what you are doing ... can do the same

- REST is better for error handling and tooling

Now in 2024, I clearly see LLMs gives much better autocomplete for REST or SDK code generated with protobuf ecosystem

There is not enough code repos based on GraphQL for LLMs to reason.

If you have like minded people who loves GraphQL, nothing can stop them but at higher and broader level it's a huge risk for dev velocity (like anything else if you dont know what you are doing)

Spend one year to study multiple languages - bash, C, C++, Go, Python ... and even Mojo or Rust. 10-20 hours a week. Being able to read top programming languages is the best investment I ever made. You will become fearless and can see the matrix ;)

Andrej Karpathy karpathy is a magician!

But being the coolest kid on the block with pure C/CUDA implementation is not enough https://github.com/karpathy/llm.c

Studying a baby Llama 2 model source code in pure Mojo is the next level https://github.com/tairov/llama2.mojo https://github.com/tairov/llama2.mojo/blob/master/llama2.moj...

Mojo Lang - Tomorrow's High Performance Python? (with Chris Lattner) https://www.youtube.com/watch?v=JRcXUuQYR90

Andrej Karpathy and Chris Lattner collab is on my wishlist ;)

Found recently Tantivy inside of ParadeDB (Postgres extension aiming to replace Elastic)

https://github.com/paradedb/paradedb/blob/dev/pg_search/Carg...

after listening

Extending Postgres for High Performance Analytics (with Philippe Noël) https://www.youtube.com/watch?v=NbOAEJrsbaM

And inside of the main thing - Quickwit(logs, traces, and soon metrics) https://github.com/quickwit-oss/quickwit

Had a surprisingly good experience with combined power of Quickwit and Clickhouse for multilingual search pet project. Finally something usable for Chinese, Japanese, Korean

https://quickwit.io/docs/guides/add-full-text-search-to-your...

to_tsvector in PG never worked well for my use cases

SELECT * FROM dump WHERE to_tsvector('english'::regconfig, hh_fullname) @@ to_tsquery('english'::regconfig, 'query');

Wish them to succeed. Will automatically upvote any post with Tantivy as keyword

JWT is not a protocol but kind of a message format from my perspective.

https://www.rfc-editor.org/rfc/rfc7519

It can be signed with HMAC SHA-256 algorithm: {"typ":"JWT", "alg":"HS256"}

Ripping off JWT from surrounding context is a road to hell.

It's worth to study JWT in context of OIDC (OpenID Connect) IDP providers.

You will quickly bump into buzzwords like client (RP), server (OP), PKCE, Token Exchange, mTLS and all kind of Implicit. Hybrid flows.

My biggest regret I didn't go through JWT related RFCs and OpenID Connect specs earlier.

[1]: https://openid.net/specs/openid-connect-core-1_0.html#CodeFl... 3.1. Authentication using the Authorization Code Flow

[2]: https://openid.net/specs/openid-connect-core-1_0.html#Implic... 3.2. Authentication using the Implicit Flow

[3]: https://openid.net/specs/openid-connect-core-1_0.html#Hybrid... 3.3. Authentication using the Hybrid Flow

[4]: https://openid.net/specs/openid-connect-core-1_0.html#Client... 9. Client Authentication

[5]: https://openid.net/specs/openid-connect-core-1_0.html#Refres... 12. Using Refresh Tokens

[6]: https://openid.net/specs/openid-connect-discovery-1_0.html OpenID Connect Discovery 1.0 incorporating errata set 1

[7]: https://www.rfc-editor.org/rfc/rfc7523.html JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants

[8]: https://www.rfc-editor.org/rfc/rfc7636.html Proof Key for Code Exchange by OAuth Public Clients

[9]: https://www.rfc-editor.org/rfc/rfc8693.html OAuth 2.0 Token Exchange

[10]: https://www.rfc-editor.org/rfc/rfc8628.html OAuth 2.0 Device Authorization Grant

[11]: https://www.rfc-editor.org/rfc/rfc8705.html OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens"

If you dont have patience for RFCs and specs, just go play with open sources IDP or better start from OpenID Connect client and server library, and try to integrate it into your "hellohell" app ;)

Very soon you will find out why developers keep building their own IDPs and how simple OpenID Connect can become a full time business

Go back here and here http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo...

And reflect yourself

Trust nobody

If you are looking for TLDR:

1. Define policies using declarative language Rego

2. Deploy OPA alongside your service as a sidecar in Kubernets

3. Make your service queries OPA when it needs to make policy decisions, passing the current state/context as input.

4. OPA evaluates the policies written in Rego against the input and returns a decision (allow or deny) back to your service.

Found it's hard to convince everyone around to use OPA/Rego and wrap into a managed service. The main objection - wrapping another DSL (domain-specific language) is hard.

However it was relatively simple to convince my team to use featured complete Go library Ladon https://github.com/ory/ladon

Ladon is inspired by AWS IAM Policies.

{

  "description": "One policy to rule them all.",

  "subjects": ["users:<peter|ken>", "users:maria", "groups:admins"],

  "actions" : ["delete", "<create|update>"],

  "effect": "allow",

  "resources": [
    "resources:articles:<.*>",
    "resources:printer"
  ],

  "conditions": {

    "remoteIP": {

        "type": "CIDRCondition",

        "options": {

            "cidr": "192.168.0.1/16"

        }

    }

  }

}

All policies are loaded on the app start, stored in memory (not DB) and checked with the help of small middleware which triggered the following function.

func (l *Ladon) DoPoliciesAllow(r *Request, policies []Policy) (err error)

https://github.com/ory/ladon/blob/972387f17e29c529ad3ff42a84...

Very negligible perfomance hit. Code is very simple, hackable, and can be subject for further optimisations.

Ladon is very fast. It's possible to run all user groups against all CRUD routes, and get the basic permission matrix or build some simple UI forms to test condition for better control.

P.s. Feel free to ping me in private @reactima (github, telegram) if you want to discuss the edge cases for the above.

Exciting time for distributed, transactional task queue projects built on the top of PostgreSQL!

Here's the most heavily upvoted in the past 12 months

Hatchet https://news.ycombinator.com/item?id=39643136

Inngest https://news.ycombinator.com/item?id=36403014

Windmill https://news.ycombinator.com/item?id=35920082

HN comments on Temporal.io https://github.com/temporalio https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

Internally we rant about the complexity of the above projects vs using transactional job queues libs like:

river https://news.ycombinator.com/item?id=38349716

neoq: [https://github.com/acaloiaro/neoq](https://github.com/acaloi...

gue: [https://github.com/vgarvardt/gue](https://github.com/vgarvar...

Deep inside can't wait to see some like ThePrimeTimeagen to review it ;) https://www.youtube.com/@ThePrimeTimeagen

Looks great!

Reminds me Obsidian DataView but with charts https://github.com/blacksmithgu/obsidian-dataview

This whole ideas to have data, visualisations and knowledge base in one private offline place is very appealing

I dont want to start a rant against Tableau. It's a powerhouse. It's a great superior software. But when it comes to optimizing cost and comparing the total cost of ownership and opportunity to stop paying for Tableau server license we voted in favor of Superset and mix of Reactjs+Echarts widgets.

https://www.tableau.com/products/server

If you have money, dedicated team of data analytics who are already familiar with Tableau - no need to torture them with other tools.

Had a very good experience with Superset.

Superset allowed us to replace Tableau and not looking back

Took me a while figure out how to embed it into my app using Superset Embedded SDK.

Superset Embedded SDK - "Embedded SDK allows you to embed dashboards from Superset into your own app, using your app's authentication. Embedding is done by inserting an iframe, containing a Superset page, into the host application."

https://github.com/apache/superset/tree/master/superset-embe...

Superset is based on very high quality and well maintained chart library eChart

https://echarts.apache.org/examples/en/#chart-type-linesG

Community Roadmap

https://github.com/apache/superset/projects?query=is%3Aopen

Huge respect to Preset.io and its team for contributing to the project and keep it in a great shape

https://preset.io/blog/

Superset source code is very easy to read and understand, and as a result it's possible to implement some advanced caching techniques reduce the load on charts.

No BI is perfect.

Watching Superset for years gives me confidence the project will work as supposed down the road, and eventually some of its packages can be reusable for all kind of visualizations and data hacking.

Our main approach to visualisation is to start with eChart and simple Reactjs wrapping and spin off Superset on subdomain for power users, and later see which one works better. Same look gives a very pleasant experience.

I can't recommend enough Zitadel and its OIDC library. Code is very well-writen and informative.

Highly encourage everyone jump into source code and explore how IntrospectionResponse struct work with all related code around

https://github.com/zitadel/oidc/blob/main/pkg/oidc/introspec...

// IntrospectionResponse implements RFC 7662, section 2.2 and

// OpenID Connect Core 1.0, section 5.1 (UserInfo).

// https://www.rfc-editor.org/rfc/rfc7662.html#section-2.2.

// https://openid.net/specs/openid-connect-core-1_0.html#Standa....

type IntrospectionResponse struct { Active Scope ClientID TokenType ... exp iat nbf sub Audience ... aud ... JWTID ... Claims map[string]any }

If you want to explore the difference between identity providers, click through

https://github.com/nextauthjs/next-auth/tree/main/packages/c...

Azure is the most insane ... and it's a lot of fun to compare them all against each other.

Next go though PKCE (Proof Key for Code Exchange) and look how code_challenge, code_verifier works or at least see interfaces .

Ory Fosite is a great alternative too https://github.com/ory/fosite

Support PKCE #59835 in x/oauth2 https://github.com/golang/go/issues/59835

Scott Brady's content is great for undetstanding the topic

SPA Identity and Access Control with OpenID Connect https://www.youtube.com/watch?v=rP3St0GU_Bk OAuth is Not Authentication https://www.scottbrady91.com/oauth/oauth-is-not-authenticati...

SPA is a landmine ..

OAuth 2 0 and OpenID Connect for Single Page Applications Philippe De Ryck https://www.youtube.com/watch?v=XoBtUn4XczU

The deeper you go into the topic the more you will discover. It's an ultimate "rabbit hole" - web, native, SPA flows, PKCE, JWT, session storage, custome middleware for your favorite flavor of backend framework, etc

IMHO The best An Interactive Guides

Flexbox https://www.joshwcomeau.com/css/interactive-guide-to-flexbox...

Grid https://www.joshwcomeau.com/css/interactive-guide-to-grid/

How to write a comment on Hacker News, follow these steps:

1. Find the thread you want to comment on and click on it.

2. Scroll down to the bottom of the page and locate the comment box.

3. Type your comment in the box.

4. Click the "add comment" button to submit your comment.

5. Eat, sleep, repeat https://github.com/playwright-community/playwright-go

Appreciate intend capture, michaelt!

Suntory Time! - Lost in Translation https://www.youtube.com/watch?v=FiQnH450hPM

Keyclock is a great project. Much welcomed by all my friends from bloody enterprise caused 1. it’s written in Java and 2. well tested by their cyberops teams.

Same observation. Hope Zitadel can do it right with zitadel/typescript repo. Huge respect to Ory for showing how it can be done.

Nope. Just a note from my own research. I’m heavily relying on HN comments to weight in alternatives.

Thank you for downvoting, guys ...

Same experience with ZITADEL and Ory. Posted more details on ZITADEL below in this discussion.

Found Ory (Kratos) customised registration flow as something over-engineered for my personal use cases.

Very impressive ecosystem nevertheless.

Show HN: Ory Kratos https://news.ycombinator.com/item?id=31679811

Most HN comments are still relevant

Keycloak is a non-brain solution for my enterprise, in-house friends.

Would like to cheerlead for fully opensource Zitadel project here however.

https://zitadel.com/

https://zitadel.com/team

Main repo https://github.com/zitadel/zitadel

Zitadel team clearly understand OpenID, Auth0, Keypass, etc specs and have all previous experience to implement identity management right for SaaS, B2C and B2B project scenarios.

SaaS Product with Authentication and Authorization https://zitadel.com/docs/guides/solution-scenarios/saas

Simplify Your SaaS: Multi-Tenancy and Delegated Access Management with ZITADEL Organizations https://www.youtube.com/watch?v=Cx_WgyY4TOo

ZITADEL Roadmap https://github.com/orgs/zitadel/projects/6/views/1

Zitadel took a very good direction into allowing to "build my own login and register ui"

Sprint Demo - ZITADEL 2.28.0 https://www.youtube.com/watch?v=hpQ4zrV48LY

[Epic] Login API and improvement of Register API #5015 https://github.com/zitadel/zitadel/issues/5015

https://github.com/zitadel/typescript

Previously had a look at Ory, Keycloak and many others.

Found those solutions either to be more "enterprisy" and over-engineered rather than something which can co-exist in my small team brain.

Related - Caddyhttp: Enable HTTP/3 by Default https://news.ycombinator.com/item?id=32768454

As all-in-Golang user, wish Tier to succeed too!

Want to say Thank you for putting all artefacts online. Same applies to Lago!

Admire your focus on Stripe and beginner friendly approach from the day one

https://github.com/tierrun/tier/blob/main/pricing/schema.jso... https://docs.tier.run/docs/resources/mapping-to-stripe https://github.com/tierrun/tier/wiki/Stripe-Glossary

Lago backend is built with Ruby and GraphQL ... which is kind of deal-breaker for me. No time to invest in Ruby ecosystem. I'm only using opensource products which I can fork and debug later on. https://github.com/getlago/lago-api/tree/619a7a53f98d9a19908...

Lago is much closer the production ready however. Solid stand-alone tool already.

Tier like projects gives me hope to give SaaS user better embedded billing experience and more control in the future.

My biggest scare - successful open source projects are getting too many extraline of code overtime.

Ex. Sentry with 25+ containers inside https://github.com/getsentry/self-hosted/blob/48c855aa3def45...