zemo

why would they buy something that no longer exists? https://theonion.com/new-york-times-to-cease-publication/

The Onion reporting that bigfoot was spotted riding a log flume at an amusement park is, you know, an obviously untrue statement that readers are aware is untrue, told for amusement. Alex Jones saying that Sandy Hook parents are faking it and their children were never killed is ... it's different, man. It's a different thing.

look at their about page, they have access that you don't have. They literally don't understand.

honestly I order from five or so places with regularity and at each of those places there are two or three things I actually order. Most of the time I really don't think GrubHub is providing any value that merits giving them a cut. I know that I like the orange chicken at the Chinese place near me, the white pie from the New York pizza place, the drive-through burger from the burger place, etc, etc, etc. I don't really need a menu. But yeah, if I'm in a new place and I'm doing a whole browse and search affair, looking at a new menu, reading reviews and all that, I just use Grubhub. That's just not actually most of my delivery. Most of my delivery is "I don't feel like cooking dinner tonight" -> order from one of my regulars.

> And to be frank, many restaurant workers don't have the best English skills and may be in a loud environment, making phone calls more difficult.

Yeah I dunno this argument feels very alien to me, because even people with poor English skills know the names of the items on their menu. It's not like I'm calling them to have an in-depth conversation, I'm just naming items off of their menu. Also I call in for pickup for like half my orders and pick up myself. At a bunch of places the food is cheaper if you just call.

c'mon man he means adding notes to the order like "put the sauce on the side" or "my building has two entrances, use the one on the left", you're being ridiculous.

> Same way you do for a public company. From trades and valuations.

no, it's not the same, because the information is not publicly available. They are the same in that in both cases you multiply two numbers together; they are not the same inasmuch as your ability to know those numbers is vastly different. To say they're the same is misleading.

> Same way you do for a public company. From trades and valuations.

how do you know what trades took place, and how many shares were traded, and at what price?

I just call them, it's not like the phone company takes a cut when you order on the phone.

> Given a per-share price

how do you know the per-share price

people dramatically overestimate how difficult it is to write a program that controls docker for you. This is one of those things where you can write like two pages of Python and ignore... all this:

> Tealok is a runtime we’re building for running containers.

If you have one machine and docker-compose is falling short, really, just write a Python script with the official docker Python package, you'll be fine.

to flip an egg?

people generally don't use metal tools on enameled cast iron, which is plenty strong

> why would Yooden Vranx have "lots of" chestnuts on his spaceship? And why "of course"?

hmmm, these might be what they call "jokes"

upgrade clients and testing the application logic, changes to the queries themselves as written, the process of detecting the regression and getting MySQL patched by percona, changes to default collation ... all of these things have nothing to do with whether the instances are in containers and whether the containers are managed by k8s or not.

> It’s Python. Does L1 matter at all?

depends on the type in question. If you are fetching and operating on a large number of records then it can matter. But otherwise the answer is more often that it does not really matter.

> Nike (the shoe company)

as opposed to Nike, the Ancient Greek goddess of Victory, who contributes essentially nothing back to the OSS community

Christian is an umbrella term that describes many differing sets of beliefs. This is an oversimplification but Protestants for example believe in Sola Fide, the believe that salvation comes from faith alone (https://en.wikipedia.org/wiki/Sola_fide), whereas Catholics believe that salvation requires "good works", the sort of thing you're likely thinking of. So ... different groups hold differing sets of beliefs with regards to what loving your neighbor means and what is expected behavior. This is a huge oversimplification, the "Salvation in Christianity" (https://en.wikipedia.org/wiki/Salvation_in_Christianity) and "Good Works" (https://en.wikipedia.org/wiki/Good_works) pages can help orient (or disorient) you.

channel of channel is a normal pattern, although it more commonly looks like a channel of struct vals, and the struct type has a field that's a channel. it's lets you send requests that are completed, whose values can be awaited on out of order, to avoid head of line blocking. something like `type request struct { params, reply chan response }`, where you send those requests on a channel, they get dispatched to some worker, and then the worker does the work and puts the result on the reply chan. But two is as high as I've ever found useful, I don't think I've ever seen a use case for a chan chan chan.

depends what you're talking about and what your criteria is. In gamedev, studios typically use a retopology tool like topogun (https://www.topogun.com/) to aid in the creation of efficient topologies, but it's still a manual task, as different topologies have different tradeoffs in terms of poly count, texture detail, options for how the model deforms when animated, etc. For example you may know that you're working on a model of a player character in a 3rd person game where the camera is typically behind you, so you want to spend more of your budget on the _back_ of the model than the _front_, because the player is typically looking at their character's back. If your criteria is "find the minimum number of polygons", sure, it's solved. That's just one of many different goals, and not the goal that is typically used by gamedev, which I assume to be a primary audience of this research.

in all fairness that's what 95% of web application projects really should be.

> if you think "I already have to do JWT so I don't save anything by not using them everywhere" rebuts the post

I have never believed that and I don't think my comment ever suggested I did, I mentioned "you might have jwt-handling tooling already" as one concern among many, not an entire argument. It really seems like you've honed in on a single point and, as you would say, misapprehended my comment. That one argument is not reason alone to use JWT and I really don't think my original comment ever implied I thought it was the entirety of the topic.

right so then the argument is less about "should you use JWTs" and more about "should you use stateless session tokens".

> JWTs are motivated by migrating authN into its own independently-scaled microservice

that's definitely one use-case, although I don't actually think having auth in a separate microservice under your own custody is the dominant use-case. The auth being in an entirely separate database means PII is in an entirely separate database, which can be a useful access control mechanism, or in the case of using a third-party auth service, means that there is no PII in databases under your custody at all. It makes the situation of "developers can access all data created by the software that they work on" really easy to implement while also maintaining "developers do not have access to all of the PII" as an access barrier. I think "I just use Auth0/FusionAuth and don't think about it" is actually the dominant use-case, and every third party offering that kind of developer experience utilizes stateless session tokens to make that happen.

> If you just use your framework session system, you don't ever think about refresh tokens.

right, but now the problem of keeping PII data access rules separate from your application domain data is an additional thing you have to engineer and think about securing, so I think the article is underestimating some of the negatives of that tradeoff; I've never seen a framework with a built in session system that did a good job of keeping access to the PII separate from the application data.

refreshing the refresh token is always a database hit, and in the case of using a third party like Auth0 or FusionAuth, you can invalidate refresh tokens at the individual and at the user level. Saying "the refresh token is the real token" as the article does is pretty misleading; the refresh token always goes to the same system that would accept the username/password, but the jwt itself gets carted around to other systems. So again, in the auth0/fusionauth case, the refresh token is sent to auth0/fusionauth, not your app, so even without any particular knowledge of what's going on, the application developer is forced to utilize them in different ways. There's a big assumption in this article that you're talking about a monolithic system where logins are processed by the same application that handles all requests. Even if you do prefer to structure your application as a monolith and avoid microservices, once you delegate auth to a third party or a system separate from your app, the bearer token versus refresh token thing starts to matter a lot.

I think there's a cyclic thing that's been happening for years where people in the security community like to talk about how bad jwt is, but then not produce anything that meets application developers needs in a meaningful way. I spent years avoiding jwt and ultimately found avoiding jwts wasn't actually a good use of my time.

External services use jwts pretty often, so if you have to handle jwts anyway, using jwts means that there's only one primitive, set of libraries, and concepts for your devs to know.

"You don't need all of that!" sure but you probably already have it somewhere in your codebase and it's pretty universal. You also probably don't utilize every feature of http itself, that isn't a cogent argument against using http.

JWTs are supported by a large number of tools, libraries, middleware appliances, etc; there's a huge ecosystem out there to support it.

You also might delegate auth to a third party like Auth0 or FusionAuth so that you don't handle any PII, because all of the PII is handled by a vendor, and you only store application-specific data.

"You want to implement logout" means a few things; in most apps you just ... have the client forget the token and you go about your day and it's fine. "but what about if a nefarious actor stole the token!!!" you might say, but hand-rolled session tokens have the same problem.

"You want to turn off access for all users" is something you can do in http middleware; e.g., I have used middleware that do things like "only allow through requests that have jwts with the 'admin' role in their claims because we have turned off the system from users for downtime", and that works fine. (specifically I wrote a traefik plugin to do this in an afternoon).

"You want to ban a single specific user really quickly" is a thing JWT won't do out of box.

> The reason to architect for scalability when you have 5 customers is so if that exponential growth cycle hits, you can capitalize on it.

If you have a product gaining that much traction, it’s usually because of some compound effect based on the existence and needs of its userbase. If on the way up you stumble to add new users, the userbase that’s already there is unlikely to go back to the Old Thing or go somewhere else (because these events are actually rare). For a good while using Twitter meant seeing the fail whale every day. Most people didn’t just up and leave, and nothing else popped up that could scale better that people moved to. Making a product that experiences exponential growth in that way is pretty rare, and struggling to scale those cases and having a period of availability degradation is common. What products hit an exponential growth situation failed because they couldn’t scale?

> I wondered why they had chosen the voice of a middle aged woman, and whether that was about being woke

really weird line of reasoning. Siri, Alexa, Google Home… etc.

there’s a huge gulf between saying “I think that guy is wrong” on a web forum and sentencing them to death in an extremely public and slow and painful manner. Nobody is being crucified here. It is intellectually dishonest to see criticism as crucifixion.

you’re using “he loves the movie” as some sort of defense, when the movie is a pretty standard sci fi cautionary tale. You know the saying:

sci-fi author: I wrote about the Torment Nexus as a cautionary tale

tech bros: Finally we have built the Torment Nexus from beloved sci fi story “Do not build the Torment Nexus”

Enjoying a story is not justification for recreating any artifact that occurs within the story. Her is quite clearly a cautionary tale, not meant to be instructive. https://www.bloodinthemachine.com/p/why-is-sam-altman-so-obs...

so yes I do think it’s very relevant that when you say “he liked the film”, the contents of the film is an admissible area of inquiry.

what do you think Her is about?

you have to be willfully missing the point when he said Her was his favorite movie, tweeted just “her” when the Sky voice was announced, and when they repeatedly tried to get the voice actor from Her. People who do underhanded things don’t just come out and say “look at me, doing the bad thing!”