About 50 / 50 down for my repos. API unresponsive, returning 500s.
642 karma · joined March 3, 2017
Like, does this mean React would be a good choice over other frameworks that can't do this, to reduce jankiness?
I am relatively well versed in vanilla JS, but have never made the jump to a framework, as there are just too goddamn many and I never know whether I'm really gaining anything from using one -.-
I feel as though this realisation was made among certain people (probably a surprising number of them) decades ago.
The more power and influence you have, the less you are inclined to change anything.
Therefore, capitalism, if unregulated, must inevitably lead to the extinction of humankind.
Figuring out how to act as "one" on certain matters (rather than a bunch of seven billion merciless competitors who will stop at nothing to get one up on their neighbour), such as climate change, will be the greatest and most decisive challenge humanity will ever face.
It'll be interesting to see where that goes.
Enter Passport by Mycelia[0]
---
One minor thing I noticed, is that capturing the mouse doesn't seem to be working on FF 66.0.3 on Linux (Manjaro). Not sure if that's because I have a dual screen setup. I guess on a single-screen setup I wouldn't notice if I had the browser in full screen.
Edit: There is a "lock mouse" button and I am an idiot. Thank you for reading, I will leave this here for posterity.
Presumably that format was fine before bigger / more complex CSP rules came along?
I find it very difficult to work with visually. Hard to see where one thing stops and another starts.
I tried adopting CSPs on all my sites to full Mozilla Observatory[0] standard. One is a Go based Heroku instance, where I used unrolled/secure[1], though there are a few different packages achieving this. The others are static Netlify deploys using Netlify CMS. For those, you have to include a headers file (in my case I am instructing Hugo to build the site with a .headers media file included, which Netlify parses).
Some observations:
- It's a huge pain in the ass / trial and error process
- The formatting for CSP rules was evidently made to be as insufferable as imaginable. All on the same line, with commas and semicolons being the only separators, no line-breaks, tabs or anything allowed. Seriously, wtf
- When you think you've got it working, some other thing breaks in a weird, silent way
- Debugging CSPs in Firefox is nearly impossible (as for certain in-line scripts, you will need to get SHA values to tell the CSP to let them through. Chrome provides the SHA in the console. Firefox bizarrely doesn't.)
- Trying to integrate google recaptcha with CSP is hilariously complicated
- You should try to host all fonts yourself, lest you need to enable google or fontawesome exceptions for font, CSS, script and svg, because apparently that's what you need just to get an FB icon on your page to work
- Forget about React, or anything using inline-script or styles. Netlify CMS and the Netlify identity widget all require inline styles and scripts. Even generating SHA values for all of those, I could not get this stuff to work. In the end I gave up and disabled the CSP again
And this is for static sites using really simple tooling. I have yet to find a viable way to make this work.
edit (some additional notes):
- Tools like this one[2] did not generate SHA values that were accepted by the CSP. I have tried a few different tools, checked all white spaces over and over. I just couldn't get it to work. Only Chrome returned the proper SHA value.
- I tried fixing a hover state loading in improperly (it flickered on first hover). This wasn't related to the CSP, but because I had to try lots of different things, like load in an SVG sprite, or png sprite, try pre-loading, use some JS, etc. etc. I had to keep changing the CSP to work with this, too. So applying a CSP should only be done at the end of a project. At the same time, if anything breaks from one day to the next, your debugging will now include the CSP as well most likely.
---
[0]https://observatory.mozilla.org/
The only downside, perhaps, is that this of course continues the cat and mouse game, leading to more and more devices being infected with DRM (see HDCP, or browsers including proprietary binary blobs to play back DRMed content).
The only alternatives will then be free alternatives or piracy. The optimist in me wants to think that this means DRM free content will proliferate, but the realist in me is thinking that's unlikely, as the money will always be with the DRM camp.
I don't want to kill myself, because I get more joy out of being a constant thorn in the sides of the corrupt, but as a teenager you may well feel differently. And for good reason. I felt more helpless as a teenager as well and did at times ponder whether a strongly worded suicide note along with suicide would achieve more than anything else I could have done.
That is no longer true, but that still doesn't change that I did experience those feelings.
Isn't it more important to address this than to (as perhaps legislators may try) simply prohibit media that deal with these themes?
See the most recent scandal in the UK where a debate kicked off around whether instagram et al should allow content from people showing off their self-harm, etc...
People who have disabled JS intentionally are likely to be a tiny minority of security conscious users, yet, if your business is an almost 100% JS rendered webapp, why would you go through the cost of maintaining an html/css-only version?
This is of course beside the point that JS is indeed best used very carefully imho and I'd prefer an almost no-JS web, but the current market simply doesn't cater to the opinions of software dev types :/
For certain people, class, or remuneration probably matters much less than recognition, for example. If said recognition goes to whomever shouts the loudest or makes sure to 'appear' best (even though anyone with expert knowledge would immediately know this person isn't the best), then you are no longer living in a meritocracy.
I should note that I find the whole idea of a meritocracy rather flawed, as it would somehow require to perfectly equate all of your actions, every single day, in every walk of life with some kind of reward or easy-to-query metric.
That's just not feasible. And even if it was, who would want another type of China-style sesame credit on steroids?
So, then, after installation, yes, I could see how that would be a nightmare. I have never attempted it!
The tricky bit is if GRUB breaks (hint: GRUB looks for every opportunity to break. If it can break, it will) and you have to chroot into an encrypted LUKS partition. That's where your average user will be SOL. Not sure how the recovery process would work for Bitlocker or FileVault.
Because there are no real learning resources unifying all of these elements properly, I tried finding resources that taught me as many elements at the same time as possible.
For JS I found the modern Javascript tutorial to be the best: https://javascript.info/
For CSS and HTML I used this course by Todd McLeod: https://greatercommons.com/learn/how-to-create-a-website
For Go (which is what I started with after learning Python. I only knew basic programming concepts then and the course was in-depth enough) I also used a Todd McLeod course: https://greatercommons.com/learn/golang
For a combination of Go, PostgresQL and HTML / CSS (but very little of the latter two, really), I tried Jon Calhoun's excellent course on web development with Go: https://www.usegolang.com/
If you are anything like me, be prepared to spend months on this one. He is very thorough and doesn't do a lot of hand holding
Once you've worked through all of those, you need to just keep throwing shit at the wall and see what sticks. Try to make something, find out the billions of specific cases none of the tutorials you used so far covered, read a ton of stackoverflow, realise your app sucks, start again. Rinse, repeat, for years, if you are working full time next to this.
Most rewarding thing I've ever done, but there are times when it gets so frustrating. You'll be struggling with some concept for absolute ages, until you find some no-brainer solution that nobody ever mentions on Stackoverflow. It's quite bizarre how that happens.
I'd also stay away from JQuery, ORMs and any of these big convenience tools. You need to learn the things they abstract away first. After that they can be useful for quick prototyping.
I understand your desire to tune down the noise, but it's very hard to do that when you are trying to develop a web app. It's so easy to just say the word web app, but when you say "PostgresQL backed, Golang, Javascript, CSS, HTML app" it suddenly sounds a bit different, doesn't it :)
Obviously that's just the stack I learned. You can just go Node.js all the way through the stack, but that never sat right with me, I had a broader curiosity about the different programming languages working in unison.
It's also worth noting that I am still absolutely terrible at any coding and just can't believe the kind of solutions people come up with online all the time. The learning curve is endless, but once you get something working, it's the most rewarding thing in the world.
Oh and lastly, don't trust everything people say on Stackoverflow. A lot of solutions are incredibly specific and often not even the best way of going about it. It's worth comparing a few posts each time.
I worked with these folks for a while. I also work with the deaf community.
Sign Language gloves are an interesting idea, but they don't work. Sign language relies heavily on facial expressions and body language beyond the hands.
This was also tried here before: https://www.huffingtonpost.com/entry/navid-azodi-and-thomas-...
But deaf people aren't actually that keen on these solutions, as I found out when I proposed this to some of them myself.