briandoll

Looks like great roll-out of this feature and notice to legacy plan holders. Note that these legacy plans are over 3 years old (https://github.blog/2016-05-11-introducing-unlimited-private...) and you're still able to keep them, you just don't get access to some new products/features.

Ah, bummer, thanks for letting us know. We'll look into the magical CSS incantations necessary to fit those in well on mobile. Cheers

JAMstack on https://www.netlify.com/

Anyone interested in the evolution of bicycle technology who is also in the bay area should visit the Marin Museum of Bicycling and Mountain Biking Hall of Fame: https://mmbhof.org/

If you want the "simple" dev experience of a monolith, but the technical advantages (or just plain reality of your distributed systems) of services-based architectures, Tilt is a really great solution: https://tilt.dev/

It makes both development of services-based apps easier, and the feedback/debugging of those services. No more "which terminal window do I poke around in to find that error message" problem, for one.

For anyone else trying to move off Medium - it's more complicated than it sounds (there is no single chronological index of your content, for example) - we wrote up some tips and tools we used recently: https://www.reifyworks.com/writing/2019-02-27-some-tips-on-m...

Great lawyers who know this (startups, consultancies, M&A, compensation, etc.) space well are few and far between, especially if you don't want to work with a giant firm. A good specialist will take your call to discuss your situation and present some options for you, though.

Call Gabe: https://groundworklegal.com/

Tidelift is insanely exciting and I can't wait for this to be the primary way open source software is built, sustained, and matured.

Funding for open source is a crucial topic for everyone here. Nadia Eghbal's lemonade-stand [1] - A handy guide to financial support for open source - shows the myriad of solutions that have existed over the years, and none have really stood out.

Unlike foundations who spend significant portions of their funding on executives and other services for a narrow subset of the OSS ecosystem, Tidelift is doing something novel by doing something simple. Make it easy for companies to buy a subscription to open source software that carries added commercial benefits [2] and then take that money and pay the maintainers. That's it.

For companies and maintainers alike, this seems ideal.

[1] https://github.com/nayafia/lemonade-stand [2] https://tidelift.com/subscription

Tidelift has a compelling approach to this: https://tidelift.com/

The Planet Money podcast had an episode on this recently that was really fascinating: https://www.npr.org/sections/money/2018/04/27/606528176/epis...

It wasn't about Amazon specifically, but the sophistication of these scams are really intriguing.

Love seeing Google Spreadsheets used like this. Many MVP 'products' would do well to be a 'simple' spreadsheet first.

sheetsee.js is great for visualizing data in these spreadsheets too (can make a graph on a website from data in a google spreadsheet in a few lines) https://github.com/jlord/sheetsee.js

How Benford's Law was discovered is fascinating - one of my favorite Radiolab episodes: http://www.radiolab.org/story/91699-from-benford-to-erdos/

Been really enjoying using Feedbin (https://feedbin.com/) to keep a curated list of things I actually want to read, but often miss via Twitter or even Facebook.

Leave. You'll line up lots more clients, and if they want you badly, they can hire you back, as a consultant, at your given rate, on your time schedule.

Related introspection: Engineers, built businesses, not apps: http://emphaticsolutions.com/2010/12/10/build-businesses-not...

On this theme, now is a good time to re-read the incredible letter Steve Albini wrote to Nirvana about potentially producing In Utero, which includes his perspective on royalties, etc. https://consequenceofsound.net/2013/09/read-steve-albinis-pr...

One way to protect against this is to not have SSH keys on your laptop. I've been using Kryptonite https://krypt.co/ lately, which is sort of like two-factor for SSH keys.

Or just use Netlify: https://www.netlify.com/

We published this because there are lots of legacy tools that approach this problem with two specific weaknesses:

* Many tools just scan a text file where you declare your dependencies, which misses transitive dependencies and won't tell you exactly which versions are in use

* They use incomplete datasets for vulnerabilities, like CVE. Most OSS projects don't create CVEs for vulnerabilities, so it is a mostly useless datasource.

Besides having a complete view of the dependencies, we have a research team that is finding and disclosing new vulnerabilities all the time, which you can see here: https://www.sourceclear.com/registry/explore

The package manager decides which packages are used based on how dependencies are specified. For example, you might ask for library-A >= 1.1, but a transitive dependency specification (a dependency of a dependency) may specify library-A >= 1.0 && <= 1.6. If versions up to 1.7 are available, you'd probably get 1.6. Probably. Because with some package managers, if you have version 1.5 sitting around in a local cache, it may use that instead.

Basically, never try to guess what the package manager is going to resolve. Just let it do its job, just as it does for your production builds, and use that information to look up any associated vulnerabilities.

I haven't worked with Haskell myself (and we don't currently support Haskell), but it looks like Cabal is the package manager, which resolves the full graph of dependencies for your project.

Most dependencies are specified like "network-info >= 0.2" (taken from a random example: https://github.com/bitemyapp/blacktip/blob/master/blacktip.c...), which means you don't know which version will actually be used until you build the project. Which is our point in this blog post. If you just scanned that text file, you'd just be guessing at which versions of open source libraries are actually being used.

A specific disclosed vulnerability found in an open source library. As you might guess, most folks don't file CVEs (https://cve.mitre.org/). Our research team maintains a database of vulnerabilities that includes published CVEs, but also includes vulnerabilities we've identified.

Here's an example of some vulnerabilities that we discovered, disclosed, and now have in our database: https://blog.sourceclear.com/copy-paste-vulnerability-disclo...

The full vulnerability database is online here: https://www.sourceclear.com/registry/explore

SourceClear identifies libraries you use that have security vulnerabilities in them. We also do the extra work to find which methods in those libraries are the vulnerable methods.

When you scan your python projects now, we can actually tell you if you have a call chain to those particular methods in the vulnerable library or not.

Most security tools aim to scare people about the sky falling. Here we're taking a saner approach and letting you know if you're directly impacted by a vulnerability or not, so you can update at a more leisurely pace.

Moxie gave a great high-level talk on cryptography and Open Whisper Systems at Webstock this year too, for anyone that's interested: https://vimeo.com/124887048

Maybe focus on addressing critical societal issues instead of blaming a blog platform? This narrative is insane.

Martin Fowler's blog: http://martinfowler.com/bliki/

If anyone is looking for a lawyer, I'd highly recommend Gabe Levine: http://levinebakerlaw.com/attorneys/gabriel-levine/

He's shares some advice on his blog (http://mylawyergabe.com/) and gave a great presentation with Mike Monteiro called "F*ck you, pay me!": http://vimeo.com/22053820