jongjong

Haha seems you have found your arch-nemesis ;p

I wasn't familiar with the RoR implementation. We may have been talking past each other. I'm thinking about it from an access control PoV.

There are alternatives to JWT which work on the same principle but personally I haven't found any reason to move off a well established and popular format to some unknown format whose drawbacks aren't as well understood or which limits interoperability.

I checked with Claude. It seems that RoR's default is in fact its own custom implementation of a similar mechanism but with encryption instead of just signatures. This is a good approach if you want to store secret data in the session but personally I only store non-sensitive info and I prefer using JWT HS256 which is fast/cheap compared to full encryption. I try to keep my signed data light, especially if it has to be sent over the wire frequently.

I find the JWT approach more minimalist; it's only for determining account ID and privilege level, nothing else and it doesn't have to be secret. I feel like storing anything more than the bare minimum required to determine access to resources is overkill.

If you don't have any connections to vouch for you/your product, you need a perfect landing page to get those first few users who will then recommend.

Well I guess it's slightly more honest than US social media. In this case the government doesn't keep their involvement a secret.

In any case, the landing page needs to be perfect. Anything less and you have 0 chance.

The most important innovation is in sales and marketing.

If you don't have brand recognition, your landing page has to make up for that. Making up the difference seems to be getting more difficult with each passing year. People are extremely cautious and getting increasingly so.

The average B2B user nowadays is literally triggered by anything remotely unfamiliar.

My point and previous commenter's point was more about managing the session data, not the session ID itself.

You're right that now it seems a lot of these session stores like Redis have improved. It seems they now enforce TTL and even provide sliding TTL on read. I haven't touched on this feature in a while but it used to be a major pain before.

These niceties add overhead behind the scenes but manageable... But IMO, it still falls short of the simplicity of just checking a JWT signature. In many situations, the revocation list would be relatively short compared to the number of sessions; it's a lot easier to manage... Also, critically, it's not a Single Point of Failure because the system will keep servicing users even if the revocation list is down... It just won't be able to ban users until it comes back up. This is usually a lesser concern.

This shows the limits of intelligence.

Claude trying to organize and collaborate, expecting reciprocity only works if other agents are as intelligent as you and share your values... And almost certainly neither is ever true in the real world where there are so many agents.

Another point is that managing session data on the server-side is a pain... If your app server goes down, stale session data would be left behind in your session store; it can easily become orphaned... So you need to set an expiry on it to ensure that it will be cleaned up no matter what... But you need to keep extending the expiry while the user is still online. God forbid you create the session data before you set the expiry on it and the operation that sets the expiry fails (e.g. server crashes at the precise moment or some error occurs which causes it to be skipped)... In practice, it's hard to avoid stale/orphaned session data.

And yes, you need to store and manage more data and your session store is an additional Single Point of Failure... With JWT the revocation list is an optional... Your system can keep running without it; it just won't be able to ban users. It's a cleaner separation of concerns without SPoF.

JWTs have so many benefits over session IDs, I could write a book about all the benefits. Sure, there are some tradeoffs but the negatives are typically pretty minor or hand-wavy.

Exactly, it's like saying that Postgres is insecure because it allows SQL injection attacks when untrusted user input is injected into the query directly.

Yeah well it's definitely a footgun built into the spec but ultimately an library implementation mistake.

Yes but it only impacts your stateless app servers which are easier to scale. Your backend services/stores are protected and not affected by the attack.

Not really. Being able to verify a user's signed identity immediately without having to do any database or memory store lookup first is valuable in itself.

With session IDs, anyone can spam/DDoS your system much more easily; they don't even need to be authenticated to waste your computing resources as they can send plausible-looking session IDs and your system will waste a ton of resources querying your session store or database to figure out that the session doesn't exist... It adds a ton of latency and wastes CPU cycles across multiple systems. Also stateful systems like Redis are harder and more expensive to scale than stateless systems like application servers. Not to mention that they may be depended upon by other parts of the application so hitting those too hard can be more disruptive. And that's kind of best-case. Some people use a database to store their session data...

At least with a revocation list with JWT. If the JWT says that the user is user1234, then you know that this is a real, previously logged-in user, they have an account at stake, you can afford to spend a bit of time/resources to check them against your revocation list... And if they are on that list, you can ban their ass and they're done! They'd have to create a new account of they try to spam you again. They can't spam without a valid JWT and they can only get that by authenticating with your server first.

Sure with JWT, some computation is spent on verifying the signature but it's very cheap using the default algorithm and only touches one system... And you only need to call another system once you know that the user is valid.

JWT is much more robust for DDoS prevention because of this. But yeah, you don't necessarily need a revocation list. You can use short JWT expiries with frequent token refreshes. Revocation list is good if you need immediate ban.

The people who are upset about JWTs probably got burned by trying to use them in a weird way. Some people try to store sensitive data inside JWTs... WTF, the idea would never have entered my mind! Sensitive data should stay on your server. Encrypted or not! JWTs are supposed to be signed, not encrypted! You shouldn't even think to put sensitive info in there. Also, WTF is wrong with people who accepted algorithm "none." Most of these people who tried to tweak the defaults had no idea what they were doing in the first place.

I've never had any issues with JWT. There's a group of incompetent developers who like to point to a tool as a scapegoat to distract away from their own failure to use the tool correctly.

I think the irony is that the people who make these blanket statements may be idiots themselves and that's why they think everyone else is an idiot. They can't imagine that other people don't have problems using those tools. It's a skill issue.

Some people here built embarrassingly parallel distributed systems with consistent hashing load balancers. JWT is easy by comparison.

To me, it sounds like a child putting their shoes on the wrong feet, getting blisters and concluding that nobody should wear shoes.

JWTs are extremely useful for storing basic non-secret authentication info. Session IDs are not as good for most situations and force unnecessary database or memory store lookups. JWT is a more versatile authentication construct because it doesn't prevent you from doing that extra lookup but it also doesn't force you to.

It's far better than a session ID in the sense that you can store an accountId inside a JWT and be confident about the identity of this user... The fact that you can get such confidence without any external lookups; just by looking at the token, is incredibly useful on its own. You can already seperate out unauthenticated guest users from authenticated users and you can tie their identities to real accounts without even checking the DB or session store. Banning is a separate concern. Being able to quickly, efficiently and reliably identify a user from the server-side is a necessity.

The only real downside of JWTs which people point to is that they cannot be easily be revoked... But if you really need the ability to revoke quickly, you can easily have 10 minute expiries on your tokens and request refresh every 3 minutes or so... So if you want to ban someone, there would be a 10 minute delay which is acceptable for the vast majority of scenarios... You should handle rate limiting as a separate concern anyway if spam is the issue.

For certain systems, a user may be making hundreds or thousands of requests in 10 minutes so you're saving a HUGE number of session ID lookups and it means that you don't need to run and maintain a separate Redis service or whatever else. Not to mention the additional latency which is added when you need to check Reddit before each operation.

These blanket statements against JWT are not new. People have been misusing them and blaming the tech because they don't want to acknowledge that they made implementation mistakes.

Any technology can be misused. It's foolish to misuse a perfectly good piece of tech and then use that as the basis to promote some alternative which has been through less battle-testing and which probably has even more gotchas which are yet to be discovered.

As a senior engineer with 15+ years of experience, I've seen this cycle over and over again. The new tech is always presented as fool proof and it never never never is.

Yeah. They've had their time.

I agree with this for complex problems which cannot be vibe coded with AI. So definitely it's an essential skill for any human engineer.

> Hell, no. Masses work, because they have to.

100%. Most people can be very happy with very low consumption. What people want is not to work. The happiest time in my life was when I was earning a measily $40K per year in passive income from crypto and didn't work. It was the lowest salary I ever had, least I ever consumed and happiest I'd ever been. The purpose of consumption for most people is to soothe the pain of working. If you don't work, you don't need to consume anywhere near as much. When my wife quit her job 10 years ago, our rate of savings stayed the same because we spent less and quality of life went up significantly for both of us.

Anyone who enjoys working is delusional. What they call work is not work; they're living in a parallel reality where the economy rewards them for playing the big boss and sitting on their asses and watching their money compound... Everything they're doing is meaningless; it only serves as a narrative device to justify the handouts that they'd be getting regardless. Just look at Steve Ballmer of Microsoft; he probably made more money after he resigned from the CEO role. It's incredible really when you look at Microsoft's product offerings these days; even Bill Gates knew to dump MSFT and now has less money than Ballmer. It's like the economy punishes people for having common sense.

Not only is it not impossible, it's precisely where it's heading.

I think even mass-market companies are going to thrive without customers. They don't need customers. The government will start handing out billion dollar contracts to these companies for doing almost nothing and they're going to focus on investing and the government money is just going to keep going round and round in circles between all the chosen companies.

Yes you're right. The decreasing desire to socialize is somewhat leading the change and likely driving the increase in quiet carriages. It's a feedback cycle, like a lot of things. Smartphones are probably upstream of that trend but also a feedback cycle. Smartphone reduces need for interaction, lack of interaction erodes social skills which lead users to spend more time on their phones.

You occupy a very unusual place seeing such extremes of both sides.

I've only interacted with people with that level of wealth in a professional capacity. In my personal life, I know a lot of people who own multiple properties and businesses including some of my own family members but I don't think I know anyone with a private jet. The top of the range I know have big boats and big houses.

I feel like there is a social boundary between the old money and the new money.

The new money tends to be much wealthier and they don't like the old money folks. In theory, they could both talk with each other about exotic holiday spots, fine dining and boating/yachting but there is a different discomfort. And it's not about tech understanding because a lot of children of old money went into tech. I think the discomfort is that the new money folks see the old money folks as spoiled brats... But IMO, this is a result of the new money folks not seeing their own privilege; not granted by daddy, sure, but granted by the system itself.

My view is that nobody earned anything. They were chosen by luck of birth, chosen by a rich friend, chosen by a rich investor, or chosen by algorithm or a combination thereof. Usually based on highly superficial aspects. Their efforts have very little to do with it besides providing plausible narrative cover.

Yeah, the latest models are really good. For implementing leetcode-type solutions, Claude Opus is smarter than essentially all engineers I've ever worked with and smarter than me as well. The one area where I beat it hands-down is technical decision-making; it sucks at architecture, maintainability, performance and scalability.

Agency seems to correlate with the ability to make good decisions. It's kind of surprising how much agency is required to make good technical decisions. It's not even about business domain knowledge; a lot of agency is needed even in a pure tech context.

Made me chuckle. I think I know what you mean about "expressing strong emotions" - This is how a lot of Europeans view Americans specifically.

I think the Australian version of naivety is more about meritocratic ideas and flat social hierarchies. Australians aren't usually loud or opinionated. European CEOs may not like it if an employee reaches out to them directly. In Australia, the startup CEO usually tries to be friends with the employees so it feels natural to reach out to the CEO directly and they often reach out to you. In Europe, I get the sense that CEOs believe that they're too important to talk to employees. This has been my experience at startups of similar sizes.

Yeah I suppose this is the stuff which you only start to understand after you've been somewhere more than a few years. It also makes you appreciate certain things about where you're from which you didn't even notice and used to take for granted. The European class system combined with a deep cynicism towards tech was a huge surprise to me... Especially for Germany which I thought would be an engineer's paradise.

Australia is extremely egalitarian. I think even more so than the US. In both Australia and the US, you can usually talk to the CEO of the startup directly; they actually like to talk to their staff directly. But in the US, the power differential is usually much bigger, I am more cautious about what I say.

In Germany, there seems to be a more rigid hierarchy and the founders tend to avoid talking to employees directly; they tend to communicate mostly through middle-managers, even in relatively small startups.

It's disturbing to think that there are people getting paid huge amounts of money by governments, using taxpayer money to f around with politics of other countries... Meanwhile I've been trying to raise a $100K seed round for my startup which I've been working on for 14 years during nights and weekends... and I never even made it the interview phase of a tech incubator. WTF is wrong with people?

Yes 100%. I was born upper middle class. I have a BIT from a global top 50 University. I understood this after working in cryptocurrency sector in Germany.

After I left Australia and moved to Europe, I realized after some time that 'the matrix' had demoted me into a lower social class. I had to work harder for less money and had access to fewer opportunities.

Then I joined the crypto sector and the people there seemed almost mentally deranged. I didn't understand it at first. They had a way, way, way more cynical view of the world than I did. In retrospect, it feels like they had been under attack by the system, in secret... And they saw any outsider as an enemy. I felt like I was disliked for not being cynical enough. Like my subtle optimism was a signal that I didn't belong. It made me a target.

Then I came back to Australia after having a really tough time and switched back to mainstream tech sector and it was like everyone I worked with was living in some fantasy world. Like 10x more naive than I ever was, all colleagues with master degrees and PhDs... Work was a lot easier too. More forgiving. Also, I was liked. People were almost too nice to me.

The difference is privilege. I can see it very clearly now. It's absolutely not based on culture or race.

Society is highly stratified and I believe there are mechanisms built into the system to prevent people from different classes to meet.

I feel like there is some kind of operating system which manufactures cultures to create separations... Traditions and taboos separate people to prevent them from sharing their experiences and to maintain blind spots which serve to hold the system together. I think I understand why rich people don't like to hang around regular people.

Have you ever wondered why people don't talk to strangers anymore? I went to a train museum recently and noticed that the carriages on old trains had seats facing each other; I sat on one side and thought to myself that it must have been awkward for people to stare at each other in the face, sitting so close to each other, with nothing and nobody standing in between them... for such long trips. Carriages were split between 'smoking' and 'non-smoking'... Nowadays carriages are split between 'normal' and 'quiet'... And the number of quiet carriages seems to have increased over time... It's like there are forces in society which try to prevent people with different experiences from sharing their experiences. This is masked by superficial differences; superficial mental and physical differences are fine but experiential differences are not.

When I watch modern movies, they seem to show characters from an elite perspective. Even characters who are depicted as poor seem to share elite ideologies which makes the characters not believable.

Also, beyond values, there are some material distortions; I've seen too many detective series were the cop is living in a luxury penthouse.

It could get really smart but I'm confident in my thesis that surplus intelligence beyond a certain level doesn't yield any real economic benefits.

At scale, I can see a benefit in terms of being able to process large amounts of data intelligently to gain a competitive advantage in terms of accruing nominal gains but I think that as long as AI is pursuing dollars, those gains won't translate to real value to the people who control the AI. At best, will translate to more political control; but with added risks and threats too. I suspect it will look more like controlled decline with a small number of entities getting an increasingly large slice of a rapidly shrinking pie.

I think AI may just figure out really complex ways to legally steal people's money. It will probably look all legit on the surface, it will look like the majority of people are just freakishly unlucky and a tiny number of elites are just extremely lucky... But it will be AI behind the scenes orchestrating seemingly random events; choosing who gets lucky and who doesn't.

Might end up literally like a game of monopoly. One player could dominate the game and start receiving all the money but, if you look at the big picture, none of the players are doing anything economically useful; just sitting around a board and moving pieces of paper amongst each other.

It's like the industrial revolution. Many kings and emperors did not like the idea of industrialization because they were already living a luxurious life and understood that it would not benefit them and would only create risks and problems for them personally. They could already afford as many human servants than they needed, what was the point of replacing them with machines to provide the same service they already received? It would give their servants more free time? To an emperor, that would have sounded more like a problem than a solution. It's a bit like that with AI. The people who control AI won't benefit from it beyond what they already have. If it doesn't serve a social cause then it serves nobody.

Open source models don't need to be anywhere near as good as Claude Mythos or even Claude Sonnet to 'win'.

Open source 'winning' just means that there exists at least one open source alternative to closed models which is as good as, say, GPT 4... I mean, we're essentially there already with Google Gemma models.

As a software engineer, I didn't notice any difference in my productivity since Sonnet. Of course Opus is better and I'm sure Fable is better yet, but we're already hitting diminishing returns in terms of economic value.

I went from Cursor running one of the earlier GPT models to Claude Code on Sonnet and that was essentially a 5x productivity boost for me. Before Claude Code, I only used AI for small snippets. With Claude Code + Sonnet, I could trust it for entire sub-tasks... But I still don't trust Opus with full end-to-end features. I'm not sure it will ever get there. It probably doesn't need to.

Companies need software engineers to have a certain moderately high level of talent but above that level, they really don't care AT ALL. They don't even notice the difference, even if the gap is significant.

Unless they send in their fully automated war drones.

Yes, this is completely true unfortunately but not the only way.

A good honest approach is just to build a few complex but essential tools so that other engineers have to keep coming back to you. It's a good way to stay relevant. You become really good at identifying misuses of that particular tool and it makes you look way smarter than you are when you can identify bugs in other people's code in mere seconds. This tends to happen naturally as you become more familiar with all the common gotchas that people tend to run into when using your tool.

Ideally you want your tools to be reliable and useful but complex... That way, whenever other devs run into bugs while using your tool, they keep coming back to you and you can point out their mistakes. The mistakes must be almost always be on their side for the strategy to work; this is key. Your code has to be rock solid.

If they find a genuine bug in your code, hopefully a small edge case, you have to be very humble and apologetic about it and you should praise the developer in the team meeting for identifying this complex bug.

This approach is better than getting credit for fixing your own buggy code; that only works with management and junior devs but other senior engineers will hate you.

The approach of building complex but reliable tools gets you credit over and over (often much more than twice) and the approval you get from other devs eventually finds its way to managers' ears. Smart leaders know that this is a better signal than flashy demos.

The leaders who just dish out praise onto specific devs for producing prototypes quickly tend to learn their mistake sooner or later. Many young founders tend to go through this phase though when they praise superficialties.

It's frustrating as someone who has worked hard to produce succinct, secure software that I can't use it to prove my software's correctness but big companies with insecure code can use it to fix their tangled mess.

I already tested all earlier models against all my open source projects and they are yet to find a vulnerability so I'm keen to try out Mythos.

I've been waiting to be vindicated for years and finally we have a tool which can do it with high confidence but I don't have access.

Also, my code is minimal and highly succinct so it would prove correctness with even more confidence since each library/module and integration fully fits in the context window.

Like the Protobuf.js fiasco is just pure vindication for me because I was being looked down upon for choosing JSON as the interchange format. Turns out their software was insecure all this time... With a literal remote code execution vulnerability!