ransackdev

From what I see they all offer drag and drop UI elements with the ability to dig into the underlying code if you want to. I'm not seeing a difference between all of them other than what the flavor of the week is in terms of lanugage powering the CMS. I remember when ghost was all the rage, and many others. Again, not crapping on your project, props to you for the dedication, and if you're happy working on it that's all that matters

A plugin is a separate code module that wordpress loads, surely those are not bound to the wordpress core license. Extending wordpress with non-wordpress owned code does not grant them the right to push their license onto somebody else's completely unrelated code. If that were true, nobody would ever be able to sell a proprietary app on any linux distro. GitLab is open core yet extends the functionality with enterprise under a different, proprietary license.

sqlite or flat html files would enable the ease of self hosting without any third party external service dependencies

Ghost has this functionality and is used by many https://ghost.org/

Primo is not the opposite. From the primo site, the 3 main bullet points

- Drag-n-drop page building

> Build your site's pages by dragging and dropping your directly blocks onto the page, unencumbered by overwhelming design options.

- Visual content editing

> Update your text, images, and links directly on the page or open up the Fields view to manage your content from a structured view.

- Integrated development

> Access each block's code with a click - right from your browser. And since each block is a Svelte component, there's no limit to what you can make.

That is functionality that existed in Dreamweaver since ~2000[1]

- Quick Tag Editor

> Bring the HTML source directly into the visual design environment. Use a keyboard shortcut to quickly access and modify HTML tags around the selected object on the page.

- HTML styles and cascading style sheets

> Dreamweaver styles give you desktop-publishing-level control over the text in your Web site. Quickly apply combinations of character and paragraph styles to text with the new HTML Style palette. Easily configure character and paragraph level styles for a site and share them with the entire development team with cascading style sheets. The choice between HTML styles or CSS styles gives you unparalled flexibility and control.

- HTML Inspector

> Roundtrip HTML lets you visually design your Web site without sacrificing control over HTML source. The HTML inspector gives you total visibility and access to HTML source. Edit, drag and drop, or copy and paste directly in the HTML inspector (which now displays line numbers).

1.https://web.archive.org/web/20001012150931/http://macromedia...

Regardless of the dreamweaver comparison, please explain how this is different, or as you said, the opposite, from any other site builder out there?

Y'all remember Macromedia Dreamweaver?

Nothing against this particular project, but how many times are we going to recreate a wysiwyg cms. There must be hundreds at this point.

Even with the app, you're still relying on APNS and GCM for push notifications, so it's not really getting "proprietary infrastructure you have no control over" out of the critical path. Granted, Apple and Google push services rarely go down, but it's still funneling public safety alerts through a non-government entity, and last I checked (years and years ago) there were no metrics or insights into deliverability, retries, opens/clicks/views, etc, plus those services do have rate limits too.

The push api is a thing now, and it can send notifications to clients even when the site is not open[1]. Imo they'd be better off bringing the mobile site back and wiring up a service worker and the push api. All open standards and nobody between them and you :)

1. https://developer.mozilla.org/en-US/docs/Web/API/Push_API

> Is there something else that must happens to your consciousness that will make you dead?

Death is a thing that you don’t come back from[1], so it’s impossible for anyone living to tell us what it’s like after dying. Being knocked out, is not death. If you don’t dream at night, you don’t die every night.

1. https://en.m.wikipedia.org/wiki/Brain_death

As Morty would say, “Sounds like a cron job but with extra steps”

I guess one pro to the lack of end user repairability, due everything being soldered to the mainboard, is that the majority of components are permanently affixed to the bricked ssd and security chips.

Battery and screen are about all that could be chopped and some imo

You can use qemu/libvirt/kvm on any Linux host to run macOS pretty easily these days[1]. I run Ventura on unraid with nvidea gpu passthrough (w/ ryzen cpu even!) and it’s been fairly painless.

You can also run macOS in docker, but it’s ultimately running through qemu/kvm as well[2]

1. https://github.com/kholia/OSX-KVM

2. https://github.com/sickcodes/Docker-OSX

If our legal system isn’t prepared to properly handle such things then it should default to being illegal to collect and sell data until the legislation is created to properly protect the rights of those who put them in office and pay their salaries.

The default of “you will be violated until we get to it, if we are able to comprehend it” is a dystopia I hadn’t imagined, yet here we are.

I’d like a definitive list which contains the source for each piece of data, the means that source acquired it, when they acquired it, and proof of my consent for it to be collected, stored, and sold to other parties who then sell it off to the highest bidder.

“It came from teleco companies” is not due diligence enough for me, and it shouldn’t be for you. That answer isn’t an answer and the lack of accountability is how the companies continue to violate our right to privacy and flourish.

Still doesn’t answer my question of where my PII was acquired.

I’ve been asking where the hell these companies are getting our data to begin with for awhile because it has to be through shady means, even if technically legal.

Tracking a user and selling that data should not be able to be slapped deep down in some TOS that grants intrusion into your life at that level. I wish laws would be changed to require explicit tracking requests for this type of data, that has to be conspicuous and separately authorized in addiction to any TOS.

I wonder if these are all shell companies to hide the “origin server” for this CDN of unauthorized surveillance data.

I’m also curious how many of these are just middle men that do nothing but markup and resell, vs how many of these companies do anything to enrich the data before flipping it.

Wouldn’t it be funny if someone were to use these systems to get the location information for the executives at all of these companies, and it ended up online everywhere? I wonder if they would change their opinions on technical loopholes allowing the tracking of people without consent

The choices aren’t k8s or managed cloud offerings.

The choices are k8s, managed cloud offerings, bare vms, or bare metal.

Managed cloud offerings are expensive. Plenty of shops are still provisioning virtual machines from a minimal OS image, or renting cheap metal that can get them much further for a fraction of the cost.

Plenty of people operate in a pre-container orchestration world today and that isn’t going away.

My guess: commenter will soon claim that docker containers and yaml manifests are too complicated. That’s what I tend to see when vague comments like this are left.

Now, I saw a straw man somewhere…

Is there a learning curve to adopt k8s? Of course! What tech doesn’t have some sort of learning curve?

If you are an application developer, there’s very little of the underlying systems that you need to know about or be concerned with. Build a container image that runs your process and exposes a port. Some trivial yaml can launch that image and attach storage and network. Everything else is done for you.

Sure, things get more complicated if you have complicated deployment needs or try to run workloads in k8s in a non-standard way, but that’s true of any system.

Before container orchestration systems there was just as much complexity. You had to ship the code to remote machines, maybe with config management, but probably ssh and a git pull. You had to signal a restart, to some process monitor, init.d, systemctl, or something like eye or god. You had to check if the service was available. You had to expose ports and route traffic. You had to handle crashes. You had to reboot. You had to monitor resource usage. You had to secure the network. You had to bubble up events to be visible to operators, you had to handle phased rollouts. You had to be able to rollback failures.

The list goes on…

There’s just as much complexity deploying services at scale with or without k8s. Without k8s though (or nomad to some extent), all that complexity is scattered across various ad-hoc systems that are OS dependent whereas k8s wraps everything and exposes a common and documented api, and an orchestrator that gathers and emits easily digestible events every step of the way. It’s a framework in a sense. The same way you can jump into a rails code base and know generally where to find things, you can ship your container images to any k8s cluster and should be able to get the same results with little to no drift between each cluster.

Does everyone need k8s? Most don’t need it. But, I’ll argue that if you’re deploying services in a highly available and fault tolerant way, you’re going to be just as complex, if not more, without k8s.

So you’re saying that you can be sued for telling a story, based on your life experience, just because someone on the internet interpreted it as advice?

So then every comment ever made that wasn’t intentional trolling and fiction then. Must be a backlogged court system with all those cases of someone being held liable for the perception of another. How does one prove they perceived something as advice? Wouldn’t it be easy to throw out short of the comment literally saying, “my advice would be”.

How does this work when there are many processes running livebook, behind a web server reverse proxy like nginx, there is no sticky sessions in place (because hot spots on certain upstreams kinda defeats the purpose of a load balancer), and the user that kicked off that async pdf job on PID 1, inside container 1, refreshes their browser and is now connecting to container 2, which is running a different Linux process than where the pdf task is running in a thread? Now add in the fact that container might be on a different node/vm in the cluster, different AZ, or different region/data center.

Background worker systems like Oban or sidekiq are where you want to run your async work imo. You can still do a pub/sub type notifier model to bubble up the job’s completion, or poll. Polling is perfectly acceptable for most apps and traffic levels and is simpler to mentally grok compared to websockets and persistent connections. Websockets require a central broker to pass messages through when you scale past one process and with elixir the options are the redis pubsub adapter, or for container based deployments or those wanting to use the built in distributed erlang functions, libcluster. More complexity. More points of failure. More potential centralized bottlenecks. More things to mentally model when debugging. More dev and prod drift. Just poll, until you can’t scale your web servers any more. It’s just an http request. It’s already implemented if you’re serving web traffic.

It’s not clear based on what you wrote but are the pdf’s contents being passed in the complete message? That sounds like an OOM termination that’s hard asf to track down just waiting to happen. PDF should go into blob storage somewhere and the task should bubble up a complete message, which then is used to signal the retrieval and proxying of the file to the user. If you have to background the pdf generation, it’s slow. If it’s slow to generate a document, it’s large. You don’t want that to be pushed through memory because your system stability is then coupled to not only the contents of a document that could exceed the memory of the system, but also is at the mercy of how many users/requests are all generating pdfs at the same time, and of course you’ll have that one guy spamming the “generate” button and queuing up 300 jobs because we didn’t need indicators on the UI and who adds uniqueness constraints to internal tools ;) Disks and file systems are for passing very large messages on a system

Only people who would need to leave a disclaimer would be lawyers, and even they are saying it's out of an abundance of caution to ensure they are not viewed as giving a client legal advice.

https://news.ycombinator.com/item?id=36130359

The point is, if the original article is bogus and full of lies it should be trivial for the security community to debunk any back door claims and set the record straight, yet that isn’t being done while still calling for the original article lacking any proof be taken down.

Someone on one of these sides needs to provide evidence to support their claims. Clearly the authors of the original article have no intention or it would have been done already.

I was once approached by a company located in a major city in Ohio. They were pitching me to come work for them but the role required getting clearance to do the work, because they were contracting for the federal government.

Without said clearance, all they could tell me was they scraped the open internet and built profiles on citizens, and then would surface this info in an easily searchable interface. I declined getting clearance and going deeper than that.

If some random ass company in Cleveland is doing contract work equivalent to the things Snowden exposed, it’s happening everywhere else, and nobody has a damn clue. This was after Snowden exposed Prism.

We’re fucked.

So am I to understand that from an OpSec perspective, connecting a machine to a known compromised system, is ok to do, “because you want internet”?

Maybe because I’m not opsec and don’t know my ass from a hole in the ground, but my security recommendation would be, no, do not purposely connect your machine to a known compromised system regardless of its advertised purpose, attack vectors, attack surface, probability of unwanted exploitation, or justification as to why it’s necessary to do so, because you’re exposing yourself, and possibly corporate machine and network, to compromise. Find a trusted system (aka audited and considered reasonably low risk while acknowledging no system can ever be deemed fully secure and trust, or zero trust is a large determining factor) and consider the compromised machine as not existing at all, therefore not being an option at all, because connecting to it would go against common sense and 8th graders practice better security habits

They aren’t inserting junk, they just don’t do anything to rank quality results above the junk anymore. The junk was always there, on page 2 and beyond, and who would ever need to hit those pages. Nowadays I’ll be 15 pages deep and so far off base of the search term that I could write a better index with curl and regex.

The issue isn’t that they are watering down the cream in the milk, it’s that the cream isn’t part of the milk at all now.

Easily solved by said security professionals auditing the security of the devices, refuting the claims in the Bloomberg article, and throwing it all up on a blog with catchy “No, china didn’t backdoor servers headed to US gov datacenter racks” title.

Great article. Just like the ones before it.

I’m waiting for the articles where people are convicted of crimes…

I won’t hold my breath, for justice anyway, just for protection from my government experimenting on me without consent while policing themselves and accountable to nobody.

> it's instead about giving up and accepting a harmful situation that is perceived as unavoidable

So we could clear up the confusion about what "learned helplessness" means by instead calling it, "hopelessness", or "despair"?

Interestingly enough, the definitions of hopelessness and despair are circular references to each other:

hopelessness | ˈhōpləsnəs |

noun

a feeling or state of despair; lack of hope

despair | dəˈsper |

noun

the complete loss or absence of hope

Huh, weird

A few reasons they don't cover that sort of thing in articles like this imo:

1. Graphql brought back n+1 problems for many popular frameworks/languages

2. This article's goal is to convert readers into paying customers, never forget that. Engineers at shops with large scale systems and problems like what you've outlined are not who will be reading this article and are not people who would pay for appsignal. They likely have existing performance monitoring systems that are either too specific to their systems, too entrenched into their infra, or more advanced for their needs.

In the end this article is marketing, and effective marketing casts the widest net to get as many people into the funnel as possible. When you look at it that way, common scaling problems, like n+1 is going to buy more customers for the cost of this marketing campaign compared to the hyper-niche pool of shops worried about decoupling database:api 1:1 mappings

Funny that people call these "bugs" as if anything related to google search happens on accident.

They don't need to waste the eng resources or infrastructure on rock solid search anymore, they own the market and got all the users into their funnel of products, most locked in for life.

Search results still show sponsored listings, they still have all the users, and all the profit, and a lot less of the profit sucking operational costs it took to be good at what made them a household name, search