aaanotherhnfolk

They announced developer productivity analytics in the same keynote as they announced codespaces. It's not just coming, it's here!

Funny enough, after introducing the analytics stuff, they started the next section by showing that the more code you write the more security vulnerabilities you have.

Which is it, Github? Do I want to stay on top of your SLOC leaderboards so my manager doesn't fire me? Or does writing the most lines mean I introduced the most vulnerabilities so my manager should fire me? The answer depends on which product github is trying to sell you at that very moment.

Another good palette-hunting tool is Adobe Kuler.

It's interactive so you can lock down parameters you like and continue searching the possibility space

If you install any browser extension and give it host permission to a URL (or God forbid, all_urls) it can see and steal anything on that page.

This goes for everything from your pop-up blocker, to your password manager, to that silly user script doing <fun effect>. They all watch you browse in a way that circumvents good security hygiene.

It's extremely common for extensions with successful userbases (>10k installs) to get approached by folks asking to integrate a mining SDK for revenue share, or sell the extension outright so they can monetize it themselves.

Consider yourself lucky if all the extension does is steal cpu cycles. It could just as easily be exfiltrating your email bodies or watching all password input fields.

The browser extension model is broken. Expect it to slowly die. Manifest v3 is just the beginning. Soon Google will wonder why they're paying a team of manual reviewers to study every extension on the Web Store when the marketplace monetizes so poorly and doesn't contribute to the moat around Chrome.

We also decided not to use InboxSDK because it has to dynamically load from Streak's servers. If you are open source hobby project this is probably okay, but for a real business this is a potentially business-ending risk.

What do you do if Streak's servers go down? You pay them nothing and have no priority support.

What do you do if Streak pushes a breaking change and brings down your app in real time?

What about if Chrome Web Store continues to lock down the ecosystem and restricts all dynamic script loading from cross origins?

We only needed a fraction of InboxSDK's API footprint so we just built our own adapter layer similar to theirs covering what we need. Now we control our own destiny.

I think their SDK had a better value prop when Google was maintaining both Gmail and Inbox. But now that they've merged there's only one DOM to worry about. And let me just say from experience that Google alters the Gmail DOM very rarely. I think they know there are a ton of extensions leaning on it, which is why they communicated the new UI so far in advance.

My company uses gitflow and releases daily from a monorepo with a team of 40 devs. Some of us rebase. Everyone is happy.

I think that disproves just about every point in the blog post.

I have no idea what non-obvious thing, if any, we're doing to make this work. Then again I don't think gitflow is complicated either.

It's not a bug report if there's no one consuming the backlog. It's a wish list.

In my experience P3's capture tech debt, cut features, and design flaws. Those should be addressed for what they are, not shoehorned into a bug prioritization system that will never even glance at them.