throwaway66666

Is it buggy? Is it insecure? Is it slow?

If the answers to those questions are no. Then you the problem and you should look for employment elsewhere. You are unhappy in that job, and you rewriting the codebase would potentially make the above questions answer to a YES, inflicting damages in the company.

Now, if the above questions have yes as an answer. Talk to your manager, explain how it won't scale, how it is hackable, and the bugs you found - and get the blessing to make things better!

Do not badmouth the previous maintainer/author you do not know the circumstances that led them into creating such a codebase.

Forget about Lunar Water man, that's so 2002.

Let's distill moon stuff and make MOON BEER and MOON VODKA.

Oh yeah, <<Celebrate with a shot of "Yuri G." the world's first and finest Moon Vodka>>

Eh, I might be off topic, but to me Greece seems helpless and beyond saving.

Here is a personal anecdote. Before finishing university, I got a job offer by a very prestigious international company. I accepted, and decided to register myself as a freelancer so that I pay my respective taxes.

But... they would not let me do that. The person at the freelancer (TEVE) office, explained to me, that since I did not finish my university I was not allowed to perform that work, remotely, for a foreign company. Doing so, would mean that I am stealing job opportunities from people like his son (yup), who finished a similar school and now are unemployed.

I went again, and again, and I was shooed away with a similar excuses. Even though according to government websites my case was legit, and there was a special clause for people working for foreign companies. But apparently something written online at a .gov website doesn't account to anything - the people at the kiosks know better. Finally, months later, I decided to hire an accountant.

It so just happened that they knew her personally. I got my license less than a week later. After 4 months of stress, being told to my face I am breaking the law and I am stealing their sons jobs, I finally had my own freelancer company registered to my name. I joked that I should register as a heart surgeon instead, it seemed that with knowing the right people it was definitely possible.

....

When I was leaving the country to come to the states, I went to the same office to de-register. Apparently the phone lines where down, but the person there wrote down my name and swore they would de-register me. Three and a half months later, and while I already had moved to the states, a letter that fined me for not paying taxes and for not paying my company fees for the last 3 months, was delivered to my parents house. Apparently I was still registered as a company owner. Oops. My dad for some reason paid that fine and didn't tell me until months later, to not "stress me".

Fucking hell Greece. I could go on and on....

I am genuinely curious about the tech start-ups that give you "street-cred" in SF. At most of the places I hang out at they dislike techies and blame on them the rising rent prices, monoculture, in general the cultural demise of the city.

Actually at most parties or bars I have to "hide" that I work in tech, or come to terms with "that guy who works in tech... but hey he's ok, unlike the rest of the lot".

So, I 'm honestly wondering where you guys get high fives for being part of a unicorn around here! (referring mostly to the parent posters)

I have it as a rule to stay away from companies that position themselves as "We 're like a family". Yes this company is exactly like a family where dad keeps all the money, gets to beat us up, or put us up for adoption if he loves the other kids more.

When i was 18 my dad gave me the envelope himself. Which I promptly turned to shreds and instead voted what I wanted.

Truly nature's goths! (referring to the gothic subculture that has a fascination for the macabre and dark :) )

This reminds me of a silly joke. 2 friends are talking, one of them has just lit a cigarette.

-"Dude, how much do you smoke? And do you like porsche cars?" -"Around a pack a day. And yeah mate, I love em!" -"Dude a pack per day costs $12. If you stop smoking, you can buy a porsche in under 10 years just from the savings from cigarettes alone..." -"Oh damn, never thought of that. Do you smoke?" -"No, never!" -"So, where is your porsche parked?"

-----

Now jokes aside. Unless you work towards a goal (eg new laptop at the end of the year), and you actively keep track of the extra savings it's very easy to blow the $4 saved per day on a whim, without even realizing. Your mindset changes to "I can buy drinks for my friends, I 've been saving this week it's cool", and you end up where you started. And that's fine, there is happiness to be had over buying your friends a drink.

Any chance for EB3 green card for university drop outs? (assuming X years of studies finished and many many years of progressive relevant experience). Thanks so much.

Is having your phone on airplane mode the same as it being turned off? (still trying to ping towers regardless?)

Also, if a phone has no antenna/no data connectivity/no GPS, but has wifi functionality. What is tracking situation there? I assume one could forward calls to the phone through wifi or is that a terrible idea?

China was severely impacted.

Their big web companies are so far almost all based on US products that were banned in China. They also failed to capture any international audience and are mostly only successful within China. Baidu, a copy of google. Weibo, a clone of twitter. QQ a clone of Facebook. WeChat a clone of Messenger. Alibaba a clone of Amazon. Etc etc

China started properly innovating, countering brain-drain, and going beyond copying what was successful in the west only in the recent years.

please check the comments at this very page. Some people claim that everyone involved is a charlatan, one specifically says "F... ICOs" and someone else that all ICOs could disappear and no value would be lost.

EDIT: I agree with you that they are not serious opinions worthy of consideration, so your point might stand.

We are now somewhen in the 90s, somewhere in the US. Welcome.

People are getting scammed when buying things online. The elderly are sending money to Nigerian princes. There are rapists and murderers on chatrooms preying for victims. Kids addicted to online games drop out of school. There is deviant pornography turning young men and girls into perverts or enticing them to post nudity online.

I strongly believe we must protect the public, and we must put severe regulations on the internet. Noone should be able to just set up a website or online business. It is far too dangerous. Aspiring e-entrepreneurs must be required to file a goverment-reviewed application, and be represented by an attorney throughout the whole process, as well as undergo background checks and pay various fees to state and federal agencies.

If all goes well, within 1-2 years (depending on backlog) they can have permission to put up a website. Every year they must renew their website license, and according to what kind of content they wish to host they will need different licenses (eg different if you want to serve video, different if you want to have chat) /s

Makes sense right? The internet seemed like a weird crazy unregulated space back then. Except that.... that would have killed all of the amazing innovation that happened in the past 25 years in the US.

My point is. We must protect the public, of course. But it is never as simple as pulling out the torches and pitchforks screaming "BAN BITCOIN. BAN THE DARKWEB. STOP ICOs". We cannot risk stifling innovation. Because if we do - innovation will still happen just... somewhere else in the world. And no government wants that.

-

EDIT: FYI - in case you think I am exaggerating, the scenario I described above is similar to today's internet situation in mainland China. You need an ICP license (granted by the government and renewed yearly) in order to be able to have a publicly accessible domain name. If you want to serve back visual content (images/video) and user-to-user communication (chat or public text posts) you need to undergo extra delays and checks to prove that you are trustworthy and can censor content. Certain websites from outside of China (eg google, fb) are just banned.

My comment above (about the bribery) was a joke. I am surprised that people took it at face value.

But no matter the joke, in no other language you 'd see packages like "is-true", "is-false", "ifAnd" (because && is too difficult /s) and "ifOr" (because... what's that "ll".... wait, is it "II" ? Um... How do I type it that vertical || line thing again?? /s).

The problem is not with users creating "useless" packages, the problem is with the community embracing them and having completely redundant one-liners gather million of downloads every week.

It just feels... icky. As if the whole's thing is put together with duct tape and bubble gum. We didn't resort to these kind of things when we had to support IE5.5 and 6. What went wrong from 2010 till today?

Seeing "is-true" rely to "is-object"... Why? Seriously, why? Maybe I am being completely narrow-minded and bitter.

If that is so please teach me and I 'll try to be better. I am not trying to provoke only to learn.

I have a (conspiracy) theory, that JS developers bribe and pay each other to include their projects as useless NPM dependencies, so they can rack up downloads and go to the next employer with a

"My package has 2 million downloads, I want x% more than market rate" attitude.

It's like the equivalent of influencer marketing, but for code packages. Of course I could just be a crazy old man. Who knows?

Another thing that is very admirable and bold is that he had no actual idea that he discovered a RCE vuln but went ahead and confidently contacted google.

How many would stop at "Eh I managed to fire requests to a hidden RPC service in google, but couldn't figure out how to make it do anything useful to qualify".

Put yourselves and your work/findings out there people!

You 'd be surprised how good modern hardware is. We are being hit with between 1.5 and 2 million requests per minute (steady traffic no spikes except increased usage in the weekends), and our analytics solution runs on just 2 main servers and costs $3k per month (total associated costs except human labour which is 1 engineer working on it part time now).

We talked with a famous analytics company and they gave us a quote of 1 million yearly to work with us. So how did we get it down from 1m to 35k?

We pretty much do the thing the article suggests (roll-ups section). We compute data hourly. Alongside with the hourly computation we also dump some extra data that can be used to compute numbers for the day (eg unique user ids, from unique user ids per hour), then from the day we get per week and then per month. We also have less moving pieces (our stack is way more traditional), and we manage our own hardware (key for keeping costs down)

When you get data back from the system you only hit the pre-computed cache, no query touches the main system from the dashboards. We only allow queries running in a 30 minute window to run on the live system - to ensure that no crazy load is going to be built on top of it and we use that to mostly catch anomalies on the real time data. (our parsing time is good too, between 10 seconds and 1 minute compared to the 2-30 minutes the article gives).

However this is the "You are alive but you 're not living" angst of analytics. All the data is there, but you cannot freely prod it for answers and patterns. If you want to get an answers about past data, you need to go through an overly complex process of raising a new cluster and ingesting old backups, multiple times, then waiting for a few days. It get's relatively expensive, slow and at times will demoralize you and make you back off from getting the answers you need. You could try keeping a smaller cluster that only gets % percent of the data (eg only 2%) for finding trends, drawing heatmaps etc and that one can run in realtime but your CEO will say that's a stupid idea to your face and it's realtime-all or nothing.

You might say that's a situation you can live with provided the absolutely insane cost savings, but when the company goes at a nicer retreat for only a selective elite few that easily costs 20k, or runs an over the top kitsch open party party/recruiting that costs 80k, and you are being dragged into a meeting on a monday morning and confronted; Why did the "3k per month-3 billion requests per day" system cost 6k this month? (because we had multiple clusters in parallel computing historical data for the past 6 months that you asked for). You just get bitter you didn't give the analytics company the 1 million they asked for and be done with it.

Eastern european living in San Francisco now. It's the lifestyle. Back home I would go out once per week, drink 2 beers max, walk-to-and-from (4-5 euro total cost of a whole week's entertainment. Bang for your buck!). If you wanted to drink more you 'd pre-game at home, drinking unlabeled homebrewed vodka! Food? You cook it yourself (or mom would since I lived with my parents), put it in the refrigerator and warm it up every day at the week.

Now in SF, I order sushi twice per week. Go out at least 3-4 times per week and lots of times pay for drinks for friends etc, never walk when going out always rideshare. And it's not only about alcohol and food of course.

I could be saving way way more if not for this lifestyle. That's how it goes. Everyone who tells you otherwise are lying to you and worse themselves. Basic human nature. The moment you make more money, you want to take your girlfriend/boyfriend to a fancier restaurant. You want to buy the nicer phone. Except for rent prices which are insanely high, the regular cost of living is not that much higher than living in eastern europe. Actually funny enough when I first moved here, I was shocked at how cheap everything seemed - of course taking into consideration the high salaries. In many cases actually eastern europeans pay more for certain things because for some unknown reason 1 dollar turns to 1 euro, instead of 0.75 of a euro or whatever the price at the moment is. Our petty $350 salaries can sure take it!

Mate, people here have a favorite whisky!I now have a favorite whisky. And as any self-respecting adult it needs to be fancy, not the cheap stuff. Ardbeg, tastes smoky, like swalloing in dim campfire and most bars here will charge you $16 for a glass. There you have it, how people aren't saving money.

It adds up. But I also have a friend here who on a 120k engineer salary and saved 100k in 2 years. Only eating at work, living on a shared room with 3 more people in treasure island. Reimbursing bus fares to work etc. The other side of the coin. Almost everyday I say to myself that soon I will do the same, and sure enough every day I don't. Just like not going to the gym and forgetting to call mom again.

This is pretty neat! Fatigued after so many "this vs that" framework talk nowadays, very refreshing to see someone just using what they feel comfortable with and building an all around awesome project.

Just honest high-quality craftmanship and lots of fun :) Props to the creator.

Got it. So the above example that I gave with SQL is pretty much the same thing as GraphQL. Assuming you would have a SQL resolver that just like the GraphQL resolver filters out things that should never hit the DB. So GraphQL is a middleware for safely querying the database openly by untrusted 3rd parties. Thanks that explains a lot, it's a pretty interesting idea actually

I understand and agree with you with the issues about REST. But I still don't understand why GraphQL is not unsafe. For example, assuming that we have an endpoint that returns a list of users but skips banned users. Would I have to do something like query{user(banned:0)} ? That would be pretty unsafe as well. So how is graphql different than executing limited queries on the server?

I have 2 very naive questions about graphql. I am not trying to poke holes or antagonize, I just want to learn.

1. First one is, if graphql is a query language - why not use an existing query language that many people are familiar with already? Eg instead of doing "query{ users(limit: 10) }" why not just send in the request's body "SELECT * FROM users LIMIT 10;" Or an ORM like query and have the server execute that (after of course parsing/sanitizing/normalizing it first)?

Why do we need one more ORM like language/abstraction on top of already our language abstractions? If my backend is in Postgres and ElasticSearch, can't I just have the client shoot sql and ES json queries instead? Why the new language?

2. How does it secure against the client trying to make super heavy queries? I always find it funny (and it is a good lesson) when an intern writes an ElasticSearch query that tries to return a 300gb JSON object back to the browser and crashes everything in the process (not production of course). I 've read that GraphQL has built-in checks for timeouts and query complexity, but if I am able to write optimized and highly performant SQL is there any guarantee that the GraphQL layer will output the same results?

tables are evil /s

Pay attention to the tags they themselves added to their report. Namely, "#SPAM IS WHY WE CAN'T HAVE NICE THINGS". Oh npm...

I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me.

In my company we take the stable version of the library we want to use and we self-host it. We basically have added a cache that we manage and control what goes into it instead of just trusting a manager. Especially for server-side deployment this is mandatory for security. Things like let's say ffmpeg etc - we never get from random packages but we host them ourselves.