711 karma · joined January 14, 2014
def foo(*, a, b): return a+b
If you are using something like token auth (you mentioned JWT), then you are not using cookies, at which point CSRF is not needed. This is because the user's browser isn't automatically sending the cooking containing a session ID on every request to the server.
That said, you can implement session auth with DRF REST APIs, which accept a session cookie on requests. For this, I believe you would receive/send CSRF tokens via HTTP headers.
XSS is not something you would worry too much about in an API endpoint. It is something you should worry a lot about in your client side SPA though. If using something like React, your templates will be auto-escaped, and thus you have to go out of your way to make it a problem.
I'm very happy to see it out for Python!
The data going into each "mailbox" either needs to be immutable, or deep copied to be thread safe. This obviously comes at a cost. Sometimes you just have a huge amount of state that different threads need to work on, and the above solution isn't viable. Erlang has ets/dets to help deal with this. You will notice ets/dets looks nothing like the mailbox/process pattern.
Erlang is great, but it is hardly the "one true way". As with most things, tradeoffs are a thing, and usually the right solution comes down to "it depends".
The point of the outbox pattern is that a durable record of the need to send an event is stored in the DB as part of the DB txn, taking advantage of ACID guarantees.
Once you have that durable record in your DB, you can essentially treat your DB as a queue (there's lot of great articles on how to do this with Postgres for instance) for some worker processes to later process the queue records, and send the events.
The worker processes in turn can decide if they want to attempt at least once, or at most once delivery of the message. Of course if you choose the later, then maybe your event is never sent, and perhaps that was the point you were trying to make to the interviewer.
They key takeaway though is that you are no longer reliant on the original process that stores the DB txn to also send the event, which can fail for any number of reasons, and may have no path to recovery. In other words, at least once delivery is now an option on the table.
- Laying direct blame on someone may lead them to trying to hide problems to avoid the pain/shame in the future.
- Related - everyone makes honest mistakes. Creating and environment where people feel ok admitting to these is a lot more ideal than the alternative.
- Teams should be encouraged to take collective ownership, such that if someone who works with xyzelement sees them failing to prioritize, they need to do something about it, even if it's just raising a concern early in the project with those who need to hear said concern.
That all said, sometimes people do need direct feedback (in private), especially when they are struggling in general with their job.
It does a great job at explaining intermediate/advanced caveats and gotchas along the way.
For web development, it's more than powerful enough for anything I need (Python/Django/PostgreSQL work).
I'd probably be annoyed if doing anything CPU intensive (e.g. compiling C++ all day, ML, etc). Memory has never been a limiting factor as I don't run VMs.
Filling prisons with drug users is probably not the answer, but just letting people do as they please because they are addicts with issues doesn't guarantee great outcomes either.
The biggest downside of Gevent IMO is that it enables the magic of turning sync code into async code via monkey patching things like the socket lib. This lack of explicitness can make things a bit difficult to reason about, without a good mental model of what Gevent is doing underneath the hood.
Accepting God created the universe just moves the big questions one level of indirection upward: Why does God exist? Why does God exist with the characteristics that he does (e.g. why is God X instead of Y)?
It's unclear how this is more satisfying on an intellectual level. It's only more satisfying on an emotional level, as it usually comes with the belief of a personal God that loves and wants the best for you, not to mention an afterlife.
OTOH it's quite slow when used for deployments. There's no way you would be getting 5 second deployments with it.
My favorite middle ground between shell scripts and Ansible is Fabric (https://www.fabfile.org/).
Human's are social creatures - do whatever it takes to get some face time in with someone near by.
Something which may or may not apply to you, is that in the past, I also felt quite empty, simply because software development had become my entire life from sunrise to sundown. Once you realize your entire identity is based around one thing, specifically work, it's quite jarring to realize and hollow that is.
What kind of radiometric dating is used for sediment? Is it not possible for older sediment to shift around and cover newer stuff?
> To invest mechanically without thinking about what’s actually happening in the world is cargo cult behavior.
This is why it's suggested that unthinking mechanical investors invest globally, not just in the US. For example, VT, a single set and forget index fund has 40% international exposure. That's to speak nothing of the S&P 500 companies that do business internationally.
Of all of the SPAs I've worked on, 90%+ of the "state" is just server side data, pulled down via APIs, to display to the user. Other state libs don't bother to take into account common things like cache invalidation, or loading states, but it's all built in to React Query.