methodover

I think she might mean it's not wrong in the sense of "deeply immoral." Murderer is wrong. Physical abuse is wrong. Many things are deeply and intrinsically immoral. Tantrums aren't. They're unacceptable but they aren't immoral. At least not before a certain age.

What does GIS mean?

What was the source of your network, if I may ask? Old college friends? Church? Co-workers?

I played through COD WW2 a couple of weeks ago. The single player campaign is great.

My dad and I used to play the original Call of Duty together when I was a boy. Technically, we played CoD: United Offensive, which has the best multiplayer in any video game ever, as far as we're concerned. We used to swap war stories over dinner, much to my mother and sister's frustration, I'm sure.

COD: WW2's single player captures some of the original game's feel. And yes, the faces are great. It helps draw you into the story between gameplay.

The multiplayer has sadly evolved into something much less interesting. My dad and I won't be playing it together.

Respectfully, did you read the article? The article argues that it is not capitalism -- competition in a free market -- driving the gap between the top 1% and the rest. Rather it is the efforts on the part of the 1% to monopolize, to drive out competition and protect their position that is the cause.

The delta v required to get off Luna is way less than earth. That's one big economic advantage.

Steam's monopoly is also why it sucks, I think. It seems like a textbook example of what happens with monopolies -- it produces an expensive product that could be much better and much cheaper.

I don't know about Origin or the Battle.Net client. Origin has a terrible reputation. Blizzard doesn't like to share, they're slow to move, and even though they're great at making games, they're not so hot at the services that go along with those games, generally speaking (remember VOIP in WoW?).

Discord seems incredibly well-positioned to take on Steam directly. They've got huge adoption in the gamer community. They're great at the community management side of things, as far as I can tell. They've figured out how to provide a better voice experience than pretty much any other service out there, so they're smart. If it's possible to provide the same thing that Steam does at less cost (which I strongly suspect it is), Discord could do it and probably make a killing at it.

And they'd save game developers a ton of money.

Speaking of Valve -- there's an area that is absolutely ripe for disruption. The Steam client hasn't really improved over the years. It's missing basic features -- like sorting your game list. They completely lost the social game to Discord and Curse, and the steaming game to Twitch. Their review system is maybe their best feature, but it's still pretty bad -- vulnerable to brigading, and not a super clear indicator for me if I'll be interested in a game or not.

They're basically a CDN. For me, that's all they provide.

And they charge an INCREDIBLE amount for their services, to developers -- 30%, I believe. Do they really provide THAT much value? I doubt it. I personally can't wait for some startup to blow them out of the water.

Same in San Francisco

I don't think I've been properly differentiating between internationalization and localization, if I'm understanding your usage correctly:

Localization means doing things like displaying days and times in a friendly way to the particular user? I.e. 24 hour clock vs 12 hour, order of month/day/year in dates. Whereas internationalization is total translation?

I've been using the two terms interchangeably.

And indeed we've noticed what you've noticed: Translation isn't that important. Businesses are using us even in places where English is not the predominant language. Localization however has been really important - it's a nice customer experience to display dates and times in a manner familiar to you.

Tech lead of a smallish/medium saas startup here.

A couple years back sales convinced the CEO to internationalize for a European expansion... Starting with Turkish of all things.

It was a terrible waste of resources. We were still trying to find product market fit, and internationalization is a tricky, labor intensive problem. It's not just a matter of putting in hooks for internationalized strings in your code -- that's the easy part. It's setting up a great localization process that's the hard part. And even if you do a great job at building out that pipeline, it's a massive drag on the speed of developing new features. Every change needs to go through localization.

Don't do i18n until you have found product market fit, IMO.

Kind of amazing how much React has taken off these last couple of years. Was talking to a hiring manager somewhere a few days ago who said she cared more about someone having React experience specifically over Python/backend for the full stack position they were hiring for. Said she'd rather they learn Python on the job than React. Fascinating.

So, the UI/front0end of their app was created with and runs on Anvil, but the backend is entirely under their control? That's interesting. Very interesting.

What's the largest, most complex application running on Anvil today?

Aren't the Google and FB offices in Seattle relatively small, satellite offices?

Wow! Thanks. I should read the site more carefully. Thanks for the correction.

Btw I feel like this should be in the top 10 list right? With mitigation strategies?

It seems like an incredibly bad idea to use their API. It seems like one should just use the downloadable database. And besides, it'll be faster to just use the database rather than making an API call anyway.

Hmm, I wonder if small noises is it. The upstairs neighbors had a kid a few years back. He's loud. During the day, though. I don't often find myself waking up to the kid's noise -- I just find myself waking up. Maybe I'm waking up to the kid and just don't realize it. Hmm.

There could be a great opportunity for Google or Facebook to take the lead in managing user logins. The rest of the world could just piggy-back on one of those two. I'd love to never have to deal with password bullshit ever again as an app creator: I'll just make my users log in with Google/FB/etc.

It's interesting that you went for TRUE 2FA. I was thinking about going for email/text-based 2FA. I know it's not true second factor authentication, but it seems so much more accessible than requiring a separate device. Our customers are not at all tech savvy, generally speaking; there's no way they'd go for a dongle.

I like the idea of asking for a captcha after 2 failed logins. We had set up a pretty restrictive Cloudflare rule which blocked access to the site for some amount of time (60 minutes?) from IP addresses that got more than 5 (IIRC) failed logins within a short, sliding window of time (2 minutes?). But the botnet had a ton of machines on it. The rule didn't block nearly as many requests as I hoped it would. A captcha, though, could be set to be pretty restrictive like you suggest.

Passwords: I actually did up the password requirements (to require 10 characters), but the CEO wants me to pull back to just 8 characters. And no special characters. Our conversion rate went down a tiny bit, could be the restrictive password requirements that did it.

Keeping a record of common IP addresses and enforcing something like 2FA for strange logins: Love that idea. Would love to implement it. Can't, though. The CEO won't go for it, says 2FA lowers conversion and he's probably right about that.

That was one of the ideas that we pitched to the CEO. Only sensitive actions would require 2FA. CEO shot it down, saying it would require too much work on the part of the customer.

That... is a great idea. I'll do it. Thank you!

About the minimum password length: I did change it to 10 the day of the attack. The CEO wants us to change it to 8. We've seen a small dip in conversions (like 1%), and the longer password requirement could be why, he thinks.

We do have fail to ban type logic in place. The attacker used a botnet; requests came in from many different IP addresses.

One or two cups of coffee a day before lunch. I've tried quitting caffeine. No effect. Could try again, that experiment was many years ago.

We experienced our first successful attack at my startup a few weeks ago.

What got us wasn't anything on the top ten list. I'm pretty sure it isn't covered anywhere in OWASP to my knowledge.

Users reuse passwords across different websites. An attacker tried a database of usernames/passwords sourced from elsewhere; a small percentage (about 1000 out of more than 10M requests) succeeded. 100 of those had something to steal. Attacker used a botnet, so our IP-based fail-to-ban logic was ineffective.

We thought about lots of ways to deal with this moving forward. My boss (CEO) didn't want to implement any kind of 2 factor authentication, because it's cumbersome and will lower conversion rates. We took a different strategy which is kind of complicated to explain, but it's not nearly as secure.

Anyway. What gets me is like: Password authentication SUCKS. It's a terrible terrible authentication strategy. It's awful. It should not be relied upon. It would be good if humans didn't reuse passwords. But we do. So it sucks.

Gosh I wish I could sleep like I used to when I was a teenager. I constantly wake up throughout the night. Can't sleep in if I wanted to. Probably get 6 hours of sleep a night if you subtract wakeful interruptions.

Not sure why. I'm not overweight at all, 10% body fat. Exercise every day for at least half an hour, usually more, running, weightlifting, sports. Work isn't stressful. I don't get it.

The best idea I've heard is a system that helps people pool their money together to buy expensive single family homes, then split the lot into multiple homes or into a condo.