This article is specifically about privacy. E-mail is well-known to have very poor privacy, to that point that it is often singled out by privacy-related regulatory schemes (like HIPAA) which require additional privacy-protecting measures (like user-level encryption). And email’s privacy weaknesses are the same as those pointed out by the author of this article: you must trust the operators of the federated nodes, and in a federated environment you may not even know all of the nodes you are trusting.

There are also federated platforms that provide decent privacy. Matrix supports E2E encrypted messaging so the server only knows who you talk to and not the contents of the messages. The only system I have seen that obfuscates the receiver is bitmessage which works by sending your message to everyone and everyone tries to decrypt it to see if it was sent to them.

It’s not completely one-to-one (at least, with modern email systems, as opposed to getting local unix mail federated on whatever machine you have a shell on thirty years ago), since there’s no sense of users on the local node being closer than users on a remote node anymore. A better match would be usenet, since the number of hops matters more.

(Of course, if you don’t look at the local timeline, the fediverse doesn’t have much to do with locality except in terms of general visibility of remote hosts, which you as an unprivileged user have near-total control over.)

Honestly, my hope is that the fear factor of this, convinces more people to consider alternatives.

I’ve setup gitlab (a few years ago) for a client, and it was a fucking pig. I’ve looked at your solution too, and wasn’t completely sold on some aspects of it (sorry, dont remember what right now) - but these things obviously work for some people, and getting out of this mindset that “GitHub is just what all developer use” is crucial to me.

Monoculture should scare people a lot more than the boogey man from Redmond.

This line from the Bloomberg article sums up the issue:

San Francisco-based GitHub is an essential tool for coders.

This is honestly like claiming “Windows is essential for technology companies”.

Microsoft is a different company now their open source strategy recently is quite good.

I’m getting awfully tired of people saying there’s nothing to worry about because they’ve been nicer for the past handful of years. They have been antagonistic to free software for decades.

Microsoft changed their tune because it became profitable to do so. If it becomes profitable to be dicks again, they will be dicks again.

I’m glad we have a kinder, gentler Microsoft. Don’t kid yourself about their motivations.

That would be very cool that as @nickpsecurity mentioned, RedHat take a shot at gitlab.

Let’s not go there, because if we bring up XML, then somebody will mention DocBook XML. Once that happens, it’s only a matter of time before somebody else suggests SGML, and nobody gets paid enough to mess around with SGML.

JSON is fine.

Yep, I use Algo to set up an IPSec VPN. It generates macOS and iOS configs which can be configured to automatically connect, with SSID exclusions e.g. for home and work.

Before Algo I used Streisand, and had to go through similar trickery as the OP to make it auto reconnect. When I saw the Algo way I realised that it’s both simple and pretty smart.

(Caveat: I don’t know if Algo generates similar auto connect setups for non-Apple OSes.)

Do the alternate package managers use an alternate package repo?

An “ecosystem” that encourages and embraces “modules” to check if a number is even, and then another one to check if a number is odd, needs more than a different CLI tool to download the same shit code.

Yarn is an alternative dependency resolver, but it uses the exact same package ecosystem as NPM.

How do you mean? I’ve very limited experience, but it beat the shit out of Zookeeper last I used it on almost every metric.

Depends on how you use it, and whether you are lucky enough to always take the discussions that are too complex or novel for StackOverflow off the platform right away, or not make them there in the first place. (E.g., effectively, depends on how much trust you put into the platform.)

As I mentioned on reddit, most of the stuff that got deleted for me are actually my own questions, quite disproportionately, where I’ve spent considerate time on doing the research, and where the answer is non-obvious.

If your question doesn’t meet metrics, the StackOverflow company will automatically remove it without any human intervention whatsoever, and block your own access from it, until/unless you have 10k. Is that really fair, after you’ve spent several hours doing the research and formulating a clear-enough question, which is so clear noone has even bothered to provide an incomplete and misunderstood answer for it? There’s really no reason for this.

The toxic part is that when you bring up these kinds of things on meta, they school you into not posting questions that “don’t belong” in the first place, and your meta questions themselves quickly gain -15 downvotes (not -15 rep, but -15 actual downvotes, within a day or two), and get automatically deleted promptly, so, the next person wouldn’t even have anything to refer to (and neither will you have the text in case you wanted to repost elsewhere).

I still don’t understand how I’m supposed to get ‘rep’ to upvote something, and I’ve never had the time to understand their internet points system to do so. I’ve been ‘using’ stackoverflow since it came out to beat expertsexchange and usenet, etc. But yea I probably have like 1 rep. I understand why they hold voting, but it always makes me sad when I want to upvote a good answer or downvote a terribly wrong one and I can’t. No idea what the route is from user to community member and no desire to read up on it… which maybe makes me not a community member. :)

Yeah, I use it as a troubleshooting step or to ensure Internet access is disabled. Certain apps, like Amazon or FB will almost always get a force close from me because I also use them infrequently.

Yay performance tag!

I’m on the fence with ORMs. On one hand they do stuff like this that doesn’t make any sense (doing the validation even when fields aren’t changed). On the other hand they help me catch a bunch of other common mistakes, like SQL injection.

Having this mistake originate from the ORM instead of my own custom written SQL actually means I can potentially fix this for everyone who uses that lib, instead of just for myself. Changing the validation code to not fire when those fields aren’t changed would be good. Better would be having the validation code assert that there is a constraint in postgres.

it shows one of the reasons I’m a little weary of ORMs and other interfaces to SQL that have a lot of magic. Very easy to shoot self in foot performance-wise.

The danger of not using ORMs tough, is that at some point, you will map data to domain objects and you want structure and… suddenly, you’ve got your own ORMs.

That being said, I prefer systems that have a strict boundary between the domain model layer and the query layer and a rather explicit mapping phase. Which means that I’m not a huge fan of ActiveRecord.

IMHO it’s less about ORMs but more about ORMs that try to hide SQL from you.

This is less about the weaknesses of ORMs in general, and more about a particular feature of ActiveRecord, validates :uniqueness, that frankly shouldn’t be used at all. Its weakness to race conditions is enough reason to argue for its removal from the framework. Uniqueness constraints of any sort need to be done in the DB layer.

[Comment removed by author]

• An auditing framework such as paper_trail that records who initiated changes
• A multitenancy system that isolates data through scoping

But this is neither :)

This is where global, per-request state is necessary

Doesn’t that sound kind of contradictory? Global vs Request.

Even if you make it global, we’re talking about data that’s specific to the request being handled. Why not just add it into the request object instead? I’m not familiar with Rails, but don’t web frameworks generally have something like that?

The paper trail and multi-tenancy stuff could be handled with something like Python’s WSGI middleware, or Java’s Servlet Filters, right? Something that can modify a request before it gets handled by the application code.

There’s no need for global state in those cases.

And having a well-defined place to do it, that automatically takes care of clearing data after the request, is a welcome addition.

Automatic clearing of data is only a benefit if there’s data that needs to be cleared. In other words, it’s not a real benefit when you can just not use global state.

I don’t think so. A TSDB is all about saving the history of changes over time. Systems like Redux or Vuex are about providing a structured way to mutate state in an asynchronous system. So at the end of it all, you will only have one version of the state.

Hahaha I’ve been using vim for years and have been typing :wq all this time.

I think you mean :x<cr> :P

But that’s the point - you often want it but not always. So just ask for it if you want it.

I try to be as actively ignorant of JavaScript as possible, not because I dislike the language but because everywhere I’ve worked the JS people all did frontend and I really don’t like writing CSS :(

[Comment removed by author]

There are only two kinds of languages: the ones people complain about and the ones nobody uses. –Bjarne Stroustrup

Ugh, ditto. I find the hard problems in JS are actually hard problems in any language. Building a UI is my weakness, but I enjoy working with Vue.js, while I honestly can’t wrap my head around Cocoa. To each their own.

It’s like the real sheep thing to do is bash X and Y, and heavy handidly telling people to switch.

(Alluding at the Rust discussion here too, though I love Rust.)

I like ones with short yet emergent stories - like Faster Than Light. You start to care about your own people and want them to survive. You really feel regret when one gets eaten by a randomly generated mutant spider attack you could have avoided :)

This is like the “monkey-patch everything onto jQuery.prototype even if it doesn’t have anything to do with jQuery” fever that only recently broke.