developer2

Thank you so much for the reply; it at least helps me understand why things are the way they are. VirtualBox's own docs have said since some 5.x version that it's compatible alongside Hyper-V. However, we've had developers on the latest 5.x as well as 6.x of VirtualBox, and the bugs that appear are out-of-this-world impossible to debug. Basically, running VirtualBox with Hyper-V enabled on a Windows host will appear to work at first, but you'll very quickly run into some random weird bug (often related to networking) that cannot even be Googled because it's a unique one-time error that seems to occur purely because of which cpu instruction was being executed during a particular nanosecond.

So even WSL2 will not help us, unless we can migrate all VirtualBox boxes to Docker or native Hyper-V. Sigh. Fuck companies who produce software purely for Linux servers, who force their developers to work on Windows machines because of ActiveDirectory, and their relationship with kissing Dell's ass for hardware I could piece together from a garbage dump.

Based on the specific example (hashing buckets for a hash map/table)… just use a hashing function that uses a random seed per map/table instance during hashing to prevent insertion attacks, eg. SipHash. This prevents an attacker from being able to purposely engineer the overloading of a single bucket with too many entries, allowing the implementer to use a standard linked list per bucket without worrying about external influences. Then, if you're still worried about the one in a trillion chance that a single bucket receives too many entries… yeah, you're over-engineering and wasting your own time, and the mental capacity of every developer who comes after you to try and understand your attempts to circumvent the problem in supposedly "smarter" ways.

Holy crap. I've avoided buying a U2F/FIDO2 device (eg. YubiKey) for a few years thus far, as I'm "happy enough" with TOTP. I know the differences in terms of implementation/security, but not enough services even offer TOTP, let alone the U2F/FIDO2 protocols. It's not worth the investment right now for how generally unsupported it is.

Do most services that support such devices really only support a single key/device? Do they offer the same one-time recovery codes that are generally offered with TOTP (though the storage/security of such codes server-side is dubious), for the eventual failure of the Yubikey (not if, but when)? Surely a tiny hardware device reaching the end of its lifespan doesn't mean you lose access to your account.

I've heard WSL2 is different and better than WSL1. However, you say WSL2 is backed by Hyper-V. Which leads me to a very important question: does enabling WSL2 (which now supposedly uses Hyper-V) have the same problem that previously enabling Hyper-V had; namely that all other virtualisation software is incompatible?

At my day job, my company hasn't yet released the version of Windows that provides WSL2 (IIRC Microsoft released that in June, and my company takes ~12 months to validate and push out new versions of Windows). Many developers have tried to get away with using Docker for Desktop on Windows, which requires the direct use of Hyper-V unless your version of Windows supports WSL2, in which case Docker for Desktop will use that instead of Hyper-V.

Our problem is we have some legacy non-Dockerized apps that require the use of vagrant and VirtualBox (we've failed trying to use vagrant and Hyper-V due to lack of boxes), and VirtualBox is 100% incompatible with Hyper-V. VirtualBox has long "supposedly" been able to function alongside/with Hyper-V, but we have not had a single employee encounter success, out of at least a dozen who have tried. To the point where just disabling Hyper-V from Windows' Optional Features isn't enough to get VirtualBox to work again; it took some searching to discover that you additionally have to prevent the virtualisation stack from even being loaded at boot by running "bcdedit /set hypervisorlaunchtype off" as Administrator.

All we want is Docker to run natively on desktop; and yet, we also need to run VirtualBox VM's side-by-side. Because of work-from-home, some employees are "getting away" with running work-related stacks on their personal macOS or Linux machines, which of course have no such limitations. You can run Docker for Desktop and VirtualBox side-by-side on macOS with zero compatibility problems (and you can use NFS for mounts too instead of the buggy and slow-ass vboxfs or cifs/samba). Proving that Windows is, once again, the outsider and shit operating system that can't even do virtualisation properly (seriously, the "exclusive use of virtualisation" that Hyper-V requires is a fucking joke). We have to run vagrant on each developer's machine for the sole purpose of running a Docker daemon within it, or use shared hosting for a hundred developers on a single VM with only a dozen CPU cores, backed by slow network storage instead of SSDs, because that's what a company with multi-million dollar revenues, and thousands of employees, is willing to provide.

End of rant. I did have a question initially, which is this: does installing and using WSL2 break other virtualisation layers (VirtualBox and friends) in the same way that enabling Hyper-V to use Docker for Desktop broke such software prior to WSL2 support?

I don't know why this comment is downvoted so much. Every company I've worked for uses MySQL (or a MySQL fork, eg. MariaDB or Percona). I've never seen an installation of Postgres used in production at any company I've worked for. I've been waiting for a decade to start using it, but there have always been three issues that made Postgres an unacceptable choice for my coworkers and me, at every single company I've worked for:

1. The lack of built-in replication, requiring third-party plugins based on slow triggers, etc. Postgres finally added, after many years, off-the-shelf replication, resolving this concern.

2. No equivalent to MySQL's "utf8mb4_unicode_ci" or "utf8mb4_unicode_520_ci". Postgres finally added, after many years, the "und-x-icu" collation, resolving this concern.

3. Lack of a multi-threaded model, meaning every new client connection forks a new child process, utterly decimating performance and scaling. Expecting users to throw a connection pool/proxy server in front of every Postgres installation to work around that bottleneck is unacceptable; a proper multi-threaded model needs to be provided off-the-shelf. The developers continue to fight back on this issue, and the fact is they are wrong.

If and when that final point is resolved, I might finally be able to put together a proposal showing all of the benefits and features present in Postgres compared to MySQL; and with those above three points all resolved, I might actually be able to gain traction and support with the other senior developers, and win a plea to management.

I've had the same static ipv4 address for just over 19 months, and have been running an exposed OpenVPN server on an alternative port on that IP for the entire duration. I get no results.

Color me unimpressed that "an army of bots that crawl the entire Internet and stores what it finds along the way" hasn't port scanned every ipv4 address at least once in the span of 19+ months. That is a very long time for a limited address space.

tldr; There is no "army", or that army is armed with pool noodles.

I had heard of that idea before, and then forgot about it. Thank you for reminding me; I will be implementing that at work when I can find the time to add it to the pipeline (ie. "todo: enforce ticketed todos").

To me there are three variants of todo:

1. Personal and immediate todos. These MUST be resolved before I can even commit to VCS. This isn't a standard "todo"; rather, it marks a section of code which I've left incomplete while I jump around the code base to work on other things. I don't use "@todo" as the tag here; I use "@first-real-name" (eg. "@joe"), as JetBrains' IDEs let you define custom TODO tag names and then filter based on them. Thus, "@joe" has never made it into a commit to the VCS, as I always ensure these are resolved before I commit.

2. A true todo that is actionable, and has an extremely realistic (not idealistic) expectation that it must, or really-really-REALLY should, be worked on in the VERY near future. This is the kind of todo that would require a ticket.

3. Todos that are hypothetical, imaginative, or dreamy; ie; "I wish priorities allowed me to spend another $X days/weeks/months on this". Obviously, this is the entire reason why requiring tickets for todos is beneficial; these kind of todos need to be cut down and eliminated. It can be so hard to "give up" on something you know could be improved, but that realistically you'll never come back to on the company's dime.

I'd also like to see alerts based on the datetime when a new todo was committed to the central repository. If a todo sits in code for more than 3 months, I want that alerted. Either the ticket needs to be prioritized, or the todo needs to be deleted.

Facebook is in the slow process of finally dying. Their ownership of Instagram is sustaining them for the time being, but they are now desperate to steal some market share away from Reddit, TikTok, and WeChat. Facebook is far more desperate than they're letting on publicly. They have already been on the decline for multiple years; the competition is now finally speeding that process up dramatically.

When was the last time you truly cared about anything Facebook-related? A few Twitch streamers switching to their platform? The only reason anyone is streaming on Facebook right now is because they were offered multi-million contracts, or because Facebook is currently paying out "autoplay while scrolling through feeds" as view counts (ie. advertising payouts based on PPV instead of PPC/PPA); when that stops, those streamers will lose everything. Facebook has inflated its viewership numbers by cheating via a "loss leader" tactic, but with nothing else recuperating the losses, which only leads to financial collapse.

tldr; Facebook is finally coming to an end. Their executives know this better than anyone, so they're scrambling to pick up as many scraps as they can in order to delay the inevitable.

I don't know whether to laugh, or to instead be triggered by the traumatic memories which were buried deep within the recesses of my mind until now and assume the fetal position.

From Wikipedia regarding VP9[1]: "Parts of the format are covered by patents held by Google. The company grants free usage of its own related patents based on reciprocity, i.e. as long as the user does not engage in patent litigations."

Of course Apple refuses to add VP9; Google demands that Apple would never sue them over any patent. Any. It looks like Google/YouTube caved in, and has/will start encoding (the most recently uploaded) videos in AV1 codec, which will work on tvOS. Hopefully that will translate to Safari on macOS and iOS for those who use it.

[1] https://en.wikipedia.org/wiki/VP9

>> we pay Cloudflare millions

>> just like any other system: it will fail eventually

An analogy combining these two points: one could pay a million dollars AN HOUR to the top software engineers alive on the entire planet… and at some point you will encounter failure. Technology and humans are both fallible, end of story. This is why SLAs exist with specific uptime targets to meet, and reimbursements should that SLA be broken. Anyone who believes the rare outage is unacceptable: fine; bring that layer in-house and pay engineers millions a year to do the best they can. You'll still encounter failures–and likely more of them.

The usual cry you'll hear from some business is "we lost $x million during the downtime!". Yes, and without some company like Cloudflare in front of your business, you'd probably be losing $x million multiplied by orders of magnitude you don't even want to imagine.

"You can't have your cake and eat it too."

Which sounds a lot like the "DNT" (do not track) or Microsoft's "P3P" (Platform for Privacy Preferences Project) headers. Which both failed, because if companies were required to respect those standards, all advertising and tracking would be extremely easy for users to opt out across the board as a single global preference.

The problem is that each site can choose its own text to display, which buttons/options it shows, and how those settings are supposedly enforced. This doesn't belong in the html of a site. This is exactly what a cross-browser preference should be doing. Which should probably be a modern–and most importantly standardized equivalent–of the P3P header. Every site should have a static set of options it can request, so users are used to accepting or declining the same set of permissions regardless of the site that is visited. Otherwise agreeing to the per-site cookie banner is just as convoluted as expecting users to read Terms and Conditions policies. I have never read the text in a cookie banner, and I never will. I click the OK/Accept button immediately, just like any T&C/ULA.

Imagine if requesting webcam, microphone, notifications, or gps/location permissions were possible by a site including its own custom banner, and if you clicked OK/Accept, it immediately got access to those features. Of course browsers don't allow this, because sites would abuse it and trick users into granting permissions when not desired. Instead, your browser provides a standardized prompt for requesting such permissions. There is no reason for tracking cookies to be exempt from being required to follow the same model.

tldr; uBlock Origin removing the html element containing the "we use cookies" banner is effectively the same as clicking "OK" or "Accept", even without notifying the site/server. If there are any exceptions, they are extremely rare.

---

Long answer:

The vast majority of sites that show the GDPR "we use cookies" banner remember you clicked "OK" or "Accept" by setting a boolean value, either in its own cookie or as a key-value in your session cookie's storage (whether stored client-side or server-side). The ONLY thing the boolean does is determine whether or not to show the banner. That's it. I've never known of a company or site that changes the privacy/retention behavior of its features based on clicking "OK" or "Accept".

As I understand it this solution doesn't follow the law, as users are supposed to be able to decline cookies and somehow still maintain state; the lawmakers don't understand a session is necessary for things like logins, so of course companies compromise with a simple banner that you need to accept/dismiss to "grant permission". When was the last time you saw a "Decline Cookies" button? If you click it, does the site work as expected? Answer: probably not, or the site uses the same cookie/session strategy anyway without telling you.

Source: I've seen dozens of such implementations, and they're all the same. If the cookie/session value indicates not to show banner, then the layout/view simply skips outputting the banner. No other line in the entire code base ever reads the value of that cookie/session.

You could also look at Bitwarden. I'm not affiliated, but it's an amazing password manager (desktop app, mobile apps, browser extensions). Even better, it's fully open source; you can even run your own server to keep out a third-party being your (encrypted) sync server. I've been using it for a couple of years now, and have never had a single problem. Free for personal use of almost everything… an upgrade to include the two-factor auth you're looking for is a very cheap $10/year.

So you are capable of writing a script in Python that always catches SIGINT and SIGTERM, exiting gracefully without an exception stack being thrown by core code? No? Right… no. Python is literally the only language I've used that cannot do this. Even PHP can do it. For real, PHP is overall a shit language (it has zero async/threading support), but it still handles signals according to POSIX (eg. it doesn't override signal handlers unless userland code does it, preserving default SIG_DFL behavior), unlike Python which breaks that simple contract. The "KeyboardInterrrupt" exception being thrown by core code before userland code is parsed and executed is such an extreme bastardization of POSIX standards that Python is simply, inexcusably, broken.

I stand by my opinion that Python is not well-suited to applications written by a professional entity, intended to be shipped to 3rd-party clients. Python plays too loose with the fundamentals provided by the operating system to be a professional language.

Most of us will wind up with some form of mental or physical degradation… that may mean Alzheimer's, or Parkinson's, or psychiatric conditions, or horrific cancer (eg. prostate, breast, uterine, COPD/emphysema, etc.) that weakens us for months or years at end-of-life. The fact is, there are so many things that can go wrong regarding health in one's mid-to-late years, that expecting to manage a complex identity/password system is unrealistic.

Ugh, try address fields. I mildly regret having moved to my current home last year, as inputting this address into forms is an impossible task. The "correct" address according to the formatting standards of my federal postal service, including street address plus unit number, is 47 characters long. I can put the UNIT number on the 2nd address line (when available), which makes the first line (just the street address) 37 characters long. I've come across more than a dozen services (Amazon, Apple, pizza places, etc.) that have length limits on address lines of between 25 and 35 characters.

The worst are the companies who (somewhat strictly, to varying degrees) verify the address of credit cards. I've barely managed to always verify by shortening into a grotesque form of the address that logistically makes no sense, but is apparently just close enough to match whatever fuzzy formula is used (eg. Levenshtein distance).

Yay!!! There were a couple of steps that took me time to debug how to make it work, so I'm ecstatic that at least one person found my steps useful!!! I don't have recent experience with Google Hangouts, so I'm curious to know whether that was a native app (does Hangouts have a macOS app?), or which browser you used (Firefox, Chrome, or…)?

IMO: Python is a garbage language, and should never be used for professional applications. Try to write an app whose very first block is a try/except for KeyboardInterrupt, with or without an if __name__ == '__main__' block. Now run the program a couple dozen times, and press ctrl+c as fast as you can. You will wind up with a debug-level stack trace dump for an uncaught KeyboardInterrupt exception from the core libraries that is thrown before your first line of userland code is parsed or executed. Python runs so much internal setup code before your first line of code is even considered. It's literally impossible to write a Python program that doesn't dump debug garbage to its output, without writing a separate bash script that uses trap to proxy SIGINT and SIGTERM to the running process. Python is a fucking joke in my eyes; and this is before discussing the way async/await was implemented by gutting the core of the language in a way that makes zero fucking sense. Python is a total… fucking… joke. It has some nice features when all you care is about the syntax and ease of development, but the fact is it's a terribly broken language. Use C. Or C++. Or Rust. Or Go. Or Ruby, or literally no joke… even PHP. Python is literally THAT HORRIBLE once you understand its internals. It absolutely disgusts me to say, but PHP with its single-threaded model is put together better than Python.

tldr; Do not use Python. It makes certain tasks seem easy, but all it truly does is make you look like an idiot developer. Pick literally any other language, as Python has screwed up too many basic concepts (related to POSIX and expectations from C) to be taken seriously.

Just for you I installed Chrome to check. It worked for me. I wrote a few things to check below; I suspect your problem is item 'c'.

a) Make sure Chrome has access to cameras (System Preferences > Security & Privacy > Camera > Google Chrome checked).

b) In step 6 from my comment, make sure to try "Preview Output" in OBS's Tools > NDI Output Settings, as "Main Output" requires you to start OBS streaming/recording (which you probably don't want to do).

c) After setting up that OBS setting, clicking the NDI systray icon should show a dropdown list with a single item. You actually need to click that item in the list (it will checkmark it). If you don't do this, you'll get a black screen when trying to pull from NDI.

d) I used https://webcamtests.com/ to test – maybe try that site.

Otherwise I'm sorry, I can't imagine what the problem is.

Holy smokeballs, thank you so freaking much!!! This thread caught my eye as I've been wanting to customize my Zoom and MS Teams "stream" (ie. webcam + extra background/overlay goodies). I hate to say it, but I skipped past the OP's project and tried this suggestion of NDI first.

Amazing. It took a good 30 minutes to figure it all out, but I now have the output of OBS (in my case, just the preview itself without needing to stream/record) as a video/webcam input source for Zoom, Microsoft Teams, and within Firefox. Note: doesn't work with Discord or QuickTime's File > New Movie Recording.

And all this with me being on macOS. Not Windows, but macOS. Incredible.

Steps (should work for macOS and Windows, not sure about Linux):

1. Install OBS. Run it, and set up a basic scene for testing (eg. webcam and a text label).

2. Download/install NDI Tools for your OS from https://ndi.tv/tools/#download-tools (note: system restart required). You only need the "NDI Virtual Input" app; on macOS each app had its own .pkg file bundled in the single .dmg archive; on Windows I assume it's an install wizard with checkboxes for each component. Again, only need "NDI Virtual Input" app/component.

3. Run the NDI Virtual Input application installed in step 2. It should live in your systray (without doing anything useful yet).

4. Download/install the obs-ndi plugin for your OS from https://github.com/Palakis/obs-ndi/releases - right now for Windows or macOS it's version 4.9.0 (expand the "Assets" link). There's a 4.9.1 update specifically for Ubuntu/Debian, but I'm not sure how those OS's are supported when there is no NDI Tools for Linux in step 2.

5. Run OBS. If you're lazy and didn't read the GitHub release notes in step 4, starting OBS should popup with a direct link to the NDI runtime you also need to download/install; then restart OBS.

6. In OBS, go to Tools > NDI Output Settings. If you want to "clone" the OBS output to the NDI virtual device only when you start streaming/recording in OBS (ie. to disk or to a streaming platform like Twitch), check "Main Output". Otherwise check "Preview Output", in which case your OBS preview will be output to the virtual video device at all times without having to start OBS streaming/recording.

7. In your operating system's systray (ie. top-right on macOS, bottom-right on Windows), you should have an NDI icon living there as started in step 3. With OBS running and configured according to step 6, you should be able to click the systray icon and select that output source as the input source for the NDI virtual device.

8. Open Zoom, Teams, or hopefully other apps which will work. Wherever you configure which input source to use for video/camera within that app's settings, there should be an "NDI Video" source. Select that… and BAM – your OBS canvas is now your input source!!

That took so long to type out, I hope someone manages to make use of it. :)

Doing that grep interestingly includes "Developer ID Application: NewTek, Inc. (W8U66ET244)", which may match the other comment thread[1] talking about NewTek's NDI Virtual Input (note: the top comment there mistyped "NewTek" as "MediaTek"). So using the NDI solution may work with Zoom without editing entitlements.

[1] https://news.ycombinator.com/item?id=23406438

1. I did not mention Apple's own native apps as a perfect example. I have also noticed Activity Monitor as an imperfect sample. I'm not sure if it's a limitation of the APIs available, or if Apple engineers just fucked up. I 100% agree that Activity Monitor takes up far more resources than it should. Then again, monitoring every single process (plus thousands of threads!) running on an operating system is an intensive undertaking, so I'm not entirely sure who to blame, if anyone.

2. I will 100% defend Christian until the end of days. I respect the fact you at least know his name, assuming that you can in return understand that everything he does is amazing. Yes, some of what he does directly counteracts the weaknesses that are innate to the Apple platform (which should be called out against Apple). His most recent release, for example, offers a "Smart Rotation Lock", which swaps between portrait and landscape depending on whether a GIF or video is playing; something Apple should have built in from day one. Also, he had a volume bar in top-left corner on iPhone X and beyond before Apple even made that standard. IMO everything he does to break the "Apple philosophy" winds up getting adopted by Apple. Christian is that good.

3. Everything I said above, whether already existing at Apple or pushed towards the future, is already better than Windows or Linux. MacOS and iOS are positioned to take over the future of computing, minus one mother-fucking aspect (fuck you, Apple): gaming. Even if Metal is technically superior, vendor-lock at Apple makes Metal worthless vs. DirectX and OpenGL. This is the only thing I am willing to abdicate… Apple+MacOS+iOS needs to figure out how to play nice with cross-platform gaming.

I did this a while ago for myself; it looks like the setting can be found here[1], labelled as a checkbox "Keep my email addresses private". Note that (I think, not sure if it gets overridden if you check the box), you also need to set your "user.email" git config to use the noreply email they provide. Personally, I'd never committed to an external 3rd-party repository, and I crushed/re-imported (erasing history) my own repositories using the new noreply email. This is because I know no external users were depending on my old repositories. I suspect that if you've already pushed commits to a 3rd-party repo, it's too late (the email address is part of the commit and cannot be revoked without a history-changing rebase). In my case, I deleted my repos and re-imported, history be damned.

[1] https://help.github.com/en/github/setting-up-and-managing-yo...

I migrated from Gmail to Fastmail 2 years ago, and I agree with this. With Fastmail, I now have the wildcard address for a domain ([a-z0-9]{7}@example.com), whereby I create a new randomly generated email address for each company/site/contact. I set up rules to direct emails sent from expected addresses (sometimes by base domain regex rather than a single address) to whitelist emails to show up in my main Inbox folder. eg. My HackerNews email might be qvae82d@example.com, whitelisted to accept emails from *@ycombinator.com to my main Inbox.

The thing is you don't want to completely blackhole/delete messages received at a valid randomly-generated address, but which were sent by an unexpected sender. For that, I have a separate "Suspicious" child of my main "Inbox". The main exception I've seen that falls under "Suspicious" is that Amazon shares your account's email address with their shippers; so you'll receive a Fedex delivery notification at your Amazon address, which falls under "Suspicious" because the sender address doesn't originate from Amazon.

What I find mildly strange is that, in the 2 years since I've migrated from Gmail to a super-organized and rules-based organization with Fastmail, I have literally not received a single spam email. I credit this to having migrated my GitHub account to use their privacy wrapper, so none of my commits have a personal email attached to them. I thus suspect that most developers who receive spam have had their email crawled from commits to public Git repositories.

Of course, there is a caveat: I do not expect to be able to maintain this kind of scheme into old age. There's no way, at 60-70-80-90 years of age, that I will still be mentally capable of managing a wildcard domain. So while it works for now... at some point I will need to simplify back to a single email address. Sigh... fml in advance. :(

Aside from the specific optimizations listed in the article, and caring about improving round-trip times for remote API calls in general, the fact is that any app built properly with native MacOS/iOS APIs will be extremely fast.

Apple's APIs for macOS and iOS are simply better than those provided by either Microsoft (for Windows), Google (for Android), etc. Apple's APIs are, for the most part, very well-thought-out; their engineers have put together fantastic layers in the operating system and its UI components. The primary reason so many apps perform poorly on Apple platforms is because those apps were developed using 3rd party cross-platform tools (eg. Electron, or making an iOS app with webviews rather than native elements).

Developers who make efficient use of Apple's APIs, and who spend time to reduce their backend response time on remote API calls, will always produce an amazing product. The best example I can think of off the top of my head is the Apollo app for Reddit on iOS; it is coded with 100% native platform APIs, with no slow cross-platform garbage. It's such a breath of fresh air to witness.

This is absolutely pinned. I prefer to imagine that since we haven't noticed such comments on the regular means this power is not habitually abused to float a particular opinion/angle to the top of threads. That policy is not guaranteed to be enforced, so I'd prefer a visible indication (eg. via an icon, akin to Reddit) indicating the comment has been pinned. Transparency for the win.

Of course, a truly Evil™ company would have both options available: a visible icon for transparently pinned comments, but also the ability to invisibly pin a comment to influence readers. There is no real foolproof method, unfortunately.

Hot damn, technology is catching up with humans' manual creations. Your video is reminiscent of Adriano Celentano's song "Prisencolinensinainciusol"[1]–whereby he created a song to represent what English sounds like to non-native speakers[2].

[1] https://www.youtube.com/watch?v=-VsmF9m_Nt8

[2] https://en.wikipedia.org/wiki/Prisencolinensinainciusol

More than 3 years ago I moved from a single gmail address that had a ton of spam, to a Fastmail wildcard domain with a rule for each individual/company that emails me. I use a randomly generated, 7-character username created from a-z and 0-9 for each address, stored in my password manager. eg. The email address for my Reddit account might be rkd64id@example.com.

While I think this scheme is perfection in terms of privacy and security in knowing which company sells or breaches my email address... the fact is I haven't gotten a single unsolicited email in the entire 3+ years. Not a single message that hit a spam/junk filter, and not one email that wasn't expected based on whitelisted rules. The closest exception is Amazon who shares your email address with their shippers for delivery notifications; while I do receive 3rd party mail regarding legitimate Amazon deliveries, I've never received any spam to that Amazon address.

I have come to a conclusion as to why I have never received a single spam email since switching to this scheme. When I transitioned my GitHub account away from the old gmail address, I used the privacy option to not publish my REAL email address in Git logs pushed to GitHub. I deleted my old repos, and re-imported using the GitHub-wrapped email address. Thus I surmise that for those of us who are developers pushing code to public Git repositories, the vast majority of the spam you receive is because your email address can be very easily scraped from those Git logs.

I expect to migrate back to a single email address in the future, for a singular reason: as I get older I cannot imagine managing these email filters and password manager entries. Eventually I will need to simplify things.

Forgive the ignorant question: if the chance spikes to ~50% by one's 80s, is Alzheimer's really a disease per se, or is it just a natural progression of the brain degrading due to old age?

I mean, some people try to label the physical aging process itself as a "disease", as if it needs to be "cured" via discovering a path to immortality. Does Alzheimer's fit into that line of thinking, or is it truly a "real" disease.