Saaster

Hmm, literally the only paid feature left on the Teams plan we're using is Draft PRs. I am worried that as it looks like I won't need to pay for this service, that I, my team and my code will become the product to monetize at some point in the future.

Companies receive so many "First, you have to be on the other side of this airtight hatch, then you..." reports that anything that looks even remotely like it will just get summarily closed. My personal favorite ones start with some form of "I copied the user's cookies from device A's file-system, and..."

Just some suggestion on how to report these kind of things, because there is an actual underlying issue here worth fixing. It's good that you didn't mention the reverse proxy. Next, don't say "spoofing an HTTP request" in your first sentence of the report, that's an immediate red flag. If you have access to spoof something on the network, it's already not an issue for 99% of people and an instant low priority. Instead, say "Steam insecurely relies on a redirect response to upgrade the hosted content from HTTP to HTTPS, instead of directly establishing the HTTPS connection". How this can be exploited is now much more general than just being a spoofing issue, with both the problem and solution clearly stated.

For reference WhatsApp is ~70MB (that's considered small) and a Facebook app is ~380MB on iOS.

There are major unknowns about the long-term viability of everything from airlines, hotels to ice cream parlors. Consumer behavior will change as a result of this, and more so when the second (and third...) waves of the virus start to hit in the fall. Even if the orders are lifted, a good chunk of the population is not going to venture out but take a lets-see approach.

Also even at the end of the current quarantine period, companies are not going to pop out and be ready to go just as they were before. The economic landscape will look like after a hurricane has hit, companies that have laid off people are not going to be in a hurry to rehire them in my opinion. Companies are in general unlikely to rehire previously reduced folks (and reduced folks are likewise unlikely to want to return to previous employers), and are instead going to look for new candidates. What we typically see after recessions is massive movements of people between the sectors. The recovery will be a long hard slog. I'd love to share your optimism, but I think the hurricane analogy is apt, even after the sun starts to shine we'll be living in the aftermath of unprecedented economic destruction.

Also cancelling your credit card does not cancel your subscriptions! Try explaining to Salesforce that you don't really need to pay that bill, you see you cancelled the card...

Then explain the same thing to the factoring services, and to then to the guys that are hauling away your laptops and servers. Just cancel your service like a normal person/business, save yourself a lot of grief.

There's an interesting article in NYTimes on how heart attacks are way down https://www.nytimes.com/2020/04/06/well/live/coronavirus-doc... People just not wanting to go to the emergency rooms is not enough to explain it.

The article's comment section is full of people all saying how they're so much less stressed now, sleeping more etc. Work really is killing you! Mondays are well known to have the highest rate of heart attacks, and Saturdays the least.

The Fed won't be unloading those assets in your or anyone's lifetime.

And how's that working out for Sweden? 20x death rate to date compared to neighboring Finland which has a lockdown in place, and an ever accelerating rate of infected. Cool, cool.

Also China today is nothing like China pre-covid. Mandatory mask wearing everywhere, temperature checks every few blocks, in every shop, mobile codes to scan certifying your virus free status before being allowed to buy anything. They're not exactly planning their next Disneyland trips over there.

Because it makes literally no sense for 50 states to compete and outbid each other for a scarce set of resources when you already have an umbrella organization, the Federal government, that could coordinate the purchases and the allocation as not every state is hitting the peak at the same time. But it's seemingly every state for themselves instead. A complete failure and lack of leadership and shirking of responsibility from the Federal government, directly contributing to a loss of American lives.

Zoom's updates also runs though the entire installer again as of today.

Chrome uses an DMG, and the result is that people are using ancient versions of it straight out of their Downloads or Desktop folders.

Zoom uses an .pkg, and have now removed the one-click install script. So every update to Zoom now runs through the same multi-step Next process as well (with one of the steps inactive until you select your disk, as is customary). If you think that isn't a problem for users, you've never walked grandma through the steps while she's trying to show her screen though the phone to you.

I work in a tech company. The number of people you see who have their desktop filled with permanently mounted DMGs, launching their apps by opening said DMG and launching their trusty old Chrome version 53 by double-clicking the icon would blow your mind.

Users don't use your software as you would like them to. Zoom now requires ~4 clicks to update when a new version is released as you click through the installer steps. You have to click the single frickin' disk icon (which is the only disk 99.9% of Apple users are going to have... still you have click on it) in one of the steps for the Next button to activate. Result: I fully expect a large percentage of the users to never update their Zoom successfully again. Great win for the users, the software which you downloaded, then clicked to install, no longer executes that scary pre-install script.

Look at almost all successful companies and they're pretty "boring" under the hood: GitHub and Stripe are Ruby on Rails, Facebook is PHP, Google is Java (still almost all new code written in 2020)... it gets the job done. Yes, they do some optimizations (HHVM etc.), but nobody is considering rewriting FB, Stripe or Google services in the language du jour.

The complexity of the infra and deployments are always relative to the size of the company, and no two companies are alike there. Small or big, it's all bespoke. Even if a few pieces are shared as open source projects, there's a veritable iceberg of complexity in the form of inhouse knowledge and tooling in each of the companies, there is nothing even close to a standard deployment system in either green field startups or FAANGs today.

I'm surprised at the 12 deployments per day, if that's truly to production. There's bugfixes etc., but feature wise Slack has been... let's say slow. Not Twitter slow, but still slow, in making any user visible changes.

Plain EC2, backend in PHP.

None of the WebRTC based options just work, they're all glitchy and cannot scale up to even moderate amounts of users. We have Google Hangouts Meet for free for our org, and we still pay for Zoom because It Just Works.

So you can get the loan to cover up 2.5x monthly payroll, use that to pay your employees for 8 weeks, then the loan is forgiven? Is there any reason a software company < 500 people wouldn't want to or couldn't take advantage of that?

Oh my sweet summer child. As a pro having done this thing for decades, the industry standard in 2020 is to randomly throw margins, negative margins, and paddings on _everything_ (probably in JS/JSX) in the vicinity of the thing you're trying to position and visually iterate until things looks okay-ish. Probably by a dozen people simultaneously on the project, some of whom may have read an article on CSS once. After a year or two the whole thing is chucked out anyway. And that's all right, it gets the job done.

In my previous company we had 20 million daily active users and we ran that on 4x M4.large EC2 instances. 4 instances not because it had any significant load (probably ~10-15% sustained), but purely because of high-availability and the ability to do a rolling release update.

I updated my web service (solo dev, side project) with a GDPR compliant terms and privacy policy, got this form letter already from a few of my users. I have to tell, it's seriously depressing and I was contemplating shutting the whole side project down over the weekend.

Most people are using whatever is the default browser on their mobile phone. And if they do use a desktop, most users still struggle with the single-vs-double-click, never mind the right-side mouse button.

It's a common misconception, but consent is only one of the 6 recognized lawful basis for processing specifically recognized by the GDPR, and a company may contact you when any one is applicable. For example, if you have an existing business relationship via a contract (you bought something), or the business has a legal obligation to inform you of changes, or the nebulous "legitimate interests" basis on behalf of the business.

Those emails which ask you to click to continue to receive marketing are a red flag that those companies did not have any legal basis previously, or they're just cargo-culting other companies even though they already have a perfectly valid basis to keep in touch (like you being a an actual customer). Check out your favorite big-company SaaS signup today (like, Jira), you will still typically not see any explicit consent checkboxes, because due to a customer relationship it is not needed.

Pointer events integrate inputs from mice, touchscreens, and pens, making separate implementations no longer necessary and authoring for cross-device pointers easier. The one input API to rule them all!

Except... of course Pointer Events doesn't work in Safari. Safari doesn't even support the regular mouse event "buttons" property which has been in the specs forever, which is a constant source of Safari specific bugs in my experience. Nothing happens when you click? Oh, you must be using Safari!

Why is input handling such a pain in the behind!

I wish I could switch to the iPhone, and I've tried several times. The hardware is excellent. But these are my deal-breakers that keep me on Android (I've only ever had Google Nexus / Pixel phones):

- Lastpass or any other password manager on iPhone is a joke, requiring multiple convoluted steps and using the "share" menu in the browser because of the Apple lock-down. Lastpass on Android? Click the password field in any app or the browser, authenticate with your finger. Done.

- All the Google apps on the iPhone are of a much lower quality and behind design and feature wise. The reason I switched last time from the iPhone to Android was because I realized I don't use any of the Apple apps any longer (mail, maps, notes, music, etc.) and I use the Google apps and services exclusively because they're just so much better. And they're way better still on Android!

- Google Photos is amazing. It's hard to overstate just how good it is. And you can still plug in your phone and get your photos of the device, if you like. A recent experience of trying to backup my wife's photos from her iPhone 7 was an incredibly frustrating experience in contrast. The Apple photos desktop app is a piece of crap, somehow even slower and beachball-prone than the Apple Store app, and the backup is very confusing. Using iCloud is not a backup solution, because deleting a photo on any device still deletes it everywhere.

Unless you have presence in Delaware (offices or employees), you don't pay corporate income taxes there just because you formed as Delware LLC or C Corp. You pay a nominal franchise tax, and you're taxed in the other state(s) you operate in.

Passengers won't care, they'll be busy playing with their phones or working. All that useless time spent driving is suddenly productive, as if you were in a nice private train car. If a car passes the train on the highway outside, do you even notice as a passenger?

I think following the laws and driving calmly is a great benefit. Never once I have thought, "I'm so happy that Uber driver drove like a maniac weaving between lanes, and got me to my destination all of 4 minutes earlier. Yay".

"One day when I was a junior medical student, a very important Boston surgeon visited the school and delivered a great treatise on a large number of patients who had undergone successful operations for vascular reconstruction. At the end of the lecture, a young student at the back of the room timidly asked, “Do you have any controls?” Well, the great surgeon drew himself up to his full height, hit the desk, and said, “Do you mean did I not operate on half of the patients?” The hall grew very quiet then. The voice at the back of the room very hesitantly replied, “Yes, that’s what I had in mind.” Then the visitor’s fist really came down as he thundered, “Of course not. That would have doomed half of them to their death.” God, it was quiet then, and one could scarcely hear the small voice ask, “Which half?”

—Dr. E. E. Peacock, Jr., University of Arizona College of Medicine;

The pricing page https://aws.amazon.com/guardduty/pricing/ is a bit confusing.

"First 500 GB / month, $1.00". Not bad! <Looks at pricing example>. Oh... $1.00/GB :)

On the other hand, 250GB of only VPC flow logs sounds really high to me, for the "small" environment example.

I'm almost sure they will. They don't have much of a NIH problem (look at how many DBs they support, anyone remember SimpleDB?), ECS hasn't exactly taken off, and they're generally very good at giving whatever their customers want.

You don't have to actually offer reduced redundancy to have multiple price points. Amazon could have added an option for big corporations to pay more for the increased SLA, the existence of the improved service agreement itself being the thing you're paying for.

Actual availability numbers is often secondary to Big Corp customers. The benefit of the CYA/SLA agreement, is that when shit does hit the fan, as the manager you get to shrug and say "well, we bought the improved SLA, not my fault Amazon failed to deliver".