thecatapps

I remember being so excited about Cloudflare's releases that I'd check their blog every couple of weeks for what new thing they were cooking up. This was before I actually had to use them to serve production clients.

When it came time to launch (2023?), the initial setup was using DNS/Cache, Workers, Workers KV, R2, D1, Durable Objects, Access, and Queues.

My first hint was that the Typescript library to access their API was simply just wrong. API requests through the library would fail, complaining about missing fields or invalid types, even though the types said my construction was correct, and I received dismissive replies when raising it in their Discord.

Then there were the D1 issues with random requests failing.

Then there were the Durable Objects issues with syncing clients in our collaborative editor.

Then there were the KV and (by extension) Access outages.

Eventually it made sense to switch it all over to AWS. Today, I trust Cloudflare for DNS, Cache, DDoS protection, and not much else.

The "AI psychosis" that may or may not have infected Cloudflare and caused this reminds me of Github's, except Cloudflare has a much much bigger moat.

This thread is about a nine hour outage in the middle of the east coast workday for Github Actions.

Except when Github’s down, of course. I’m saying it’s incomprehensible to me that people would rather put their trust into an organization as enshittified as Microsoft where they get their codebases added to an AI, have an awful experience (the code review UX, for example), and deal with consistent downtime, rather than put a few hours every so often into something that they loathe to do. That does not seem like a good trade-off at all.

Why? Like I wrote in a separate comment, it's not a mail server, it's a Postgres database, a Golang app, and backups (and some providers will just handle that for you!)

Except it's not down more often and it's not a heavy lift. It's not a mail server, it's a Postgres database, a Golang app, and backups (and some providers will just handle that for you!).

I've never understood this argument. Even if self-hosted things were offline more often (which I've never found to be the case, I've had Forgejo + runners running for a year now with no downtime), the real benefit is that you yourself can work to bring it back online when it does, rather than waiting on a large, slow-moving organization to figure out what slopped PR caused their global service serving ungodly amounts of RPS to go offline again.

While you're 100% correct, I'm not holding my breath on that remaining infrastructure being available anytime soon.

I was expecting, at the very least, to see Apple make their App Store 18+ checks available to developers at WWDC this year. Yet, there's still nothing except the self-reported (useless) "Declared Age Range." Apple has the best integration story of all of them, and could bring it to their entire ecosystem (native iOS apps, mobile Safari, all of MacOS), yet they haven't. Why?

Also, nothing comes to mind regarding browsers, android devices, or non-mobile devices. As far as I'm aware, no one seems to be in a rush to make this available. With non-Apple hardware, I can see it being trickier, but still, I haven't seen many (any) attempts. Why?

It probably doesn't help that many don't see the difference between "deep-state surveillance digital ID verification" and privacy-preserving ZKPs to verify age.

It's probably very obvious by now, but there's something to be said about companies with the "SF Quirky" vibes:

- The OS Redesign

- "Sexy Legal Documents"

- Emails with "<relevant hedgehog meme goes here>" as the subject line

- Having a merch shop with action figures of your CEO

It works both ways. When you're looking for adoption and making very pro-user moves, I guess it can be a benefit. However, when you're now looking to grow revenue and making very anti-user moves, it's insult to injury.

I'm the last person to say that tech "shouldn't be fun" or something overly-broad like that, but if your messaging doesn't match the decisions of leadership, you're gonna have a bad time.

Agreed. While I don't entirely care enough to rip it out of any existing products, I certainly won't be adding it to any new ones.

I remember people cheering about their "OS" web redesign, which was the most confusing and unnecessary UX complication when I needed to go track down a session replay to debug something (They've since added navigation to the top right.)

Wake me up.... when sloptember ends.

What's most surprising to me is that this is coming from a company that directly markets towards hackers and makers.

Like when you think of the App/Play store lockdowns, the new ReCaptcha attestation stuff, and other things that have a more authoritarian angle to it as of late, you can at least see how it happens: most of their consumers aren't technical and don't even know how to argue against it or why they should care.

With Bambu on the other hand, I'd think a good portion of its customers do actively care about this kind of thing. 3D printing just doesn't have the same market reach as computers and smartphones.

Also, it seems to me like there's eventually going to be a turning of the tide on all of these pushes (app stores included) and companies that are making these kinds of moves aren't seeing that writing on the wall.

Anyways, yeah, my next purchase will be a Prusa.

With all of the discourse around hardware attestation, digital ID, and age verification in recent weeks/months, is there actually any good solution to the problems these existing tools (Privacy Pass, WEI, Fraud Defense, uploading IDs) claim to solve? Are there open and privacy-preserving standards that can solve the problem of bots and minors? If not, what would be required to establish one, and is it realistic?

Businesses will do what businesses will do, but it seems to me having something to point to and saying "do this instead" is more effective than "this sucks and isn't even about security, don't do this at all" even though it's true.

It's been a while, but from what I remember you need that extension for any highlighting at all, and that screenshot is with it installed. Also, if I recall, it's something about that extension using an outdated treesitter parser or something along those lines.

I'm extremely glad to see something like this. I've tried to use Zed so many times, and this might sound neurotic -- but there are just so many little theming things that make a difference to me.

For example, https://imgur.com/a/ia2GCgg -- top is VSCode, bottom is Zed. Both using Svelte, and using a similar theme.

- Angle brackets are a different color

- Capitalized built-in components are a different color

- Boolean props are a different color

- Brackets are colored differently than text.

The inspector is a game changer, clicking into these specific things in the preview they provide is super helpful.

App Clips -- very underutilized but also very cool. https://developer.apple.com/documentation/appclip

I'm failing to see why they didn't just adopt Private Access Tokens (not that they're great either), where they could have at least:

- pretended that it wasn't all about invading peoples' privacy.

- done a good ol' fashioned "but Apple does it"

- pretended to be standards-oriented

- advertised it as something completely transparent to the end-user

Seems like that would've caused a lot less backlash while still achieving the goal of having some form of device attestation -- but I'm guessing that's not the real goal.

I remember when I was in high school (2016? 2017?), I found a super simple XSS in the assignment submission form and told the programming teacher. Canvas then proceeded to lock my account and got me my first (only?) detention. Good times.

God I hope that's included. As silly as it sounds, having NFC inside passes require a custom entitlement/approval from Apple was my breaking point for ditching iOS development altogether. The form for requesting said entitlement was broken (at the time, at least), and I didn't understand why .pkpass files had to be signed at all - I still don't.