0xEFF

I do the same as GP on a regular 2 hour drive up I-5 I take.

The vetting process is the same as if I were driving up I-5 with a gear head friend of mine having a conversation with them as we go.

It literally says spy cam in the product title.

No company reflects “we’re family” in contracts or compensation packages. That fact alone tells us the message is and always has been bullshit.

I think it’s reasonable that 95% of people would choose generational wealth for their families given the opportunity.

Is it really unquestionable?

Even so, the suggestion is a good one. Modern proxies have gotten much better at handling auth and processing the traffic as the GP describes. Service meshes have these features built in now when a few years ago we had to roll our own solutions with haproxy or nginx.

A bank is a bad example. The only thing we use bank websites for is to check our transactions and transfer money.

My business checking account has started offering partner promotions from the transfer screen and I’m tempted to switch to another bank because of it. Their developers and designers were tasked with delivering that component. At the same time they took away their mobile app and mobile check deposit because it was not secured properly.

Most bank websites and apps are examples of teams and organizations focusing on the wrong thing in my opinion.

See for yourself, 4.0 is clearly improved over 3.5.

Every access and id token issued by oidc already has an issued at (iat) and expiration (exp) fields.

Splunk has delivered this level of innovation and quality since 2007 when I first used it.

We used Splunk to associate a change request ticket number all the way through the change control process to the Puppet log output tagging each change to the original business purpose.

It was like magic for auditors back then and I rarely see that depth of tracing automated changes to business purpose in the field today, though we get close with gitops.

It’s historically been abbreviated AAA “triple A” for Access, Authentication, and Authorization. Each being a separate system, VPN’s and Firewalls traditionally controlling access for example.

RedHat has traditionally.

The platform slack with over 10,000 users uses linen. It’s good. Wonder how long it will last though.

There are loads of startups offering platforms as a service for about half the cost per year of one devops engineer.

No, the best organizations have a happy path laid out for org chosen tools and a platform that supports adding in “non standard” tools / libraries by individuals and teams as needed, with a defined path toward those additions become the new golden path standard.

Edit: the term service principal is current and isn’t specific to Kerberos

https://istio.io/latest/docs/concepts/security/#principals

Not at L6. Scarface is right, most of the time the org just knows something is wrong and they don’t know what it is exactly or how to fix it. Sometimes they don’t even know something is very wrong, while working on a defining problem 1 the L6 also identifies related problem 2 the org thought was minor but is actually major.

None of this is specified, there are no specs to execute up front. Much of it is defining the spec yourself and collaborating with the rest of the org to find out if other people agree with the spec.

This is a good analogy. For more context in the past 5 years working with customers in the Bay Area I’ve not encountered one who mentioned linkerd let alone ran it in production.

More than half those companies ran istio in production at large scales.

The sweet spot is for someone with deep experience to lay down the skeletal structure of the tests, rpc, infra, lifecycle, etc… then hand it off to a broader team who could learn the intention behind the decisions.

Why are discussions of web development and JavaScript unique in that we can’t discuss alternative methods and trade offs without the discussion devolving into personal attacks and defensiveness?

Yes, it’s meaningful. If Google doesn’t fix search in the next decade then Bing (or some other winner) will be the service earning Google’s ARR in 11 hours.

These reasons related to deployment, but there's also lots of value in the security aspects of the control plane.

  * automatic service account for each workload
  * automatic service to service auth to 3rd party services
  * the audit log
  * role based access control
  * well defined api
  * the explain subcommand
  * liveness and readiness probes
  * custom resources

The list goes on, but the big ones for a small team just getting started are workload identity and security.

A single EC2 instance is an equally bad trade-off on the opposite side of the spectrum from over architected SQS, SNS, etc…

The ideal trade off is a single Kubernetes cluster with as much in the cluster as makes sense for the team and stage of the project. As you say, toss the app on a single node to start, but the control plane is tremendously valuable from on the onset of most projects.

Is it really easier? Yes.

The project I’m currently building is an enterprise b2b SaaS and I’ve gotten it fully functional without writing a single line of JavaScript. By functional I mean it looks and behaves like there is JavaScript, because there is with HTMX, but it’s abstracted away to the point of taking none of my time, which is what matters.

There’s no way I could learn the JavaScript ecosystem in a day. Maybe I could get something functional in a day but the technical debt would be too costly. I’m not sure any human could learn it in a day with acceptable technical debt trade offs.

For my situation of an enterprise app that’s mostly declaring resources in the backend via API, it’s been much faster to write in my preferred backend language only. I build the API, make a command line tool in the same language that calls the API, then add a basic HTML form for the demo and it’s great.

What is it that Tailscale provides over plain vanilla wireguard? Is it a static address somewhere to connect to?

Given a cloud service account you can call the provider’s token service, get a bearer token, then use that bearer token to call any other cloud service configured to trust the provider issuer. Most cloud providers support this today with oidc.

Yes for a host key. It’s like accidentally publishing the tls key for https://accounts.google.com

The host key is the only thing ensuring you’re actually talking to GitHub.com when you push code.

To add to sibling comments, it should not have been possible to make this mistake. That it was possible is concerning.

I’m a business owner with payroll married to a attorney.

I’m comfortable doing exactly as GP described to make payroll.

It’s difficult to square creating both the most successful product and the most successful company in history with the idea Jobs heading the company into the abyss with the appliance model.

For production servers, the trade offs Debian makes are better than the trade offs Ubuntu makes.

This has held consistently true for as long as Ubuntu has existed.

In recent years this is also true on the desktop.