y0ghur7_xxx

> If they really said that, that's amazingly weak and clumsy.

He did: https://www.youtube.com/watch?v=DJdGblrWX9o&t=273

> It would be easy to exceed its DB load with an application that serves unique content to each user, is write-heavy, etc.

Just curious: did YOU ever reach that point? I mean where a well optimized db engine reached it's limit? Can I ask you on what website?

> A serious problem with this approach is scaling.

Stack overflow runs off one SqlServer. Do you think your app is going beyond that? If yes, maybe this approach will not work for you. If no, you are in the 99,99999% of all other sites/apps that are not as big as SO, FB or google and you can use this simple way to make your site or app.

> As soon as something happens that would bring repository choice into question

I don't know. Once a project is started with postgres/mysql/orcale, how often do you change the DB?

We have some projects that started with struts, then we changed the fe to jsp, the asp.net, then HTML/JS + MVC.net. But the DB was always Postgres. It never changed. In my experience what changes often is the frontend, not the stuff that keeps your data.

I would optimize for fe/middleware changes, not db changes.

It's 2004 all over again: https://web.archive.org/web/20060525094651/http://www.oracle...

I love this approach and I used it whenever I could in the last 10 years. It's just so much easier when all you have is a DB and a JS/HTML/CSS frontend.

> Microsoft is actually trying their best to support web standards

That's good. So does every other browser since forever.

> when all other browsers break your code you will appreciate their hard work.

I am a webdev, and I use Firefox as my main browser for work. When I am done with a feature or a new page I usually test it in Chrome and it works without problems. Then IE, and I still have to tweak the hell out of the code to make it work there as well. So ms is not there yet.

> HTTPS. They can't tell what URL a user is requesting.

I am sure they have a private key of some of the CAs shipped with major browsers lying around somewhere...

it's in an iframe

You just continue to state the same thing: that OE does not protect against an active attacker. We know that. Nobody says that it does. What it does is protect against a passive attacker. And that makes it useful for some use cases.

> Opportunistic Encryption is harmful because people think it's actually useful. [...] You should never assume that 'eavesdropping' is passive.

- Google driving by with it's street view cars and capturing all your wifi traffic for later analysis is passive.

- People sitting in a coffee shop and capturing your wifi traffic is passive.

OE protects against these attack vectors. It does not protect against other attack vectors, but that does not mean it's harmful or useless.

Moreover, with pins it could be a first step to get rid of CAs.

Does someone know how to set this up serverside? Does apache support this? I skimmed through the mod_spdy docs, but found nothing about opportunistic encrypion.

This, together with TACK or Certificate Transparency could be a CA killer.

> We where unlikely to merge it because the code quality was low

Oh, so it's not because "there already is a nice implementation in EE." Ok.

It's also in disagreement with what you sad on the EE announcement:

"If the community develops code for a feature that is already in EE we will certainly consider merging it or open sourcing the EE feature. This depends on several factors including the seriousness of the merge request, the number of GitLab users requesting this feature and if the feature is useful for small and medium size organizations."¹

For at least this particular feature the community is clearly interested (just by looking at the +1 on the github issue), but you continue to handle the CE version as "demo" software for EE. Which is ok. Just say so clearly.

¹https://about.gitlab.com/2013/07/22/announcing-gitlab-enterp...

> We don't say that git hooks will be EE forever and we try so evaluate each merge request on its merits.

Seems like you sad exactly that a while ago:

"We are unlikely to merge this functionality in CE because there already is a nice implementation in EE."¹

It's your repo. You can do whatever you want with it, no need to merge PR for features that are already in your EE edition. That's why I hope someone forks it, or something better comes around.

¹https://github.com/gitlabhq/gitlabhq/pull/6883#issuecomment-...

nice. the problem i have with gitlab is not much the upgrage process anymore, but the fact that you don't accept push requests from the community of features that you implemented in the enterprise edition. for example the git hook stuff.

i hope someone who has the time and the skills forks gitlab and merges push requests of new features, even if they are already implemented in your pay-for version.

> Facebook and WhatsApp are much bigger players with massive infrastructure that Whisper Systems doesn't have.

even kik (http://www.kik.com/) works without google play services, and it has no massive infrastructure.

but even then, it makes no sense to say that chatsecure is secure and client side encrypted, when it NEEDS, and BUILDS ON closed source software of (one of) the largest data collector companies in the world.

whatsapp and fb messenger work perfectly without google play services installed. whatsapp even manages to update itself. i see no reason why TextSecure could not do it. It's an app that is focused on privacy, and as such should work without closed source software from the largest data collector in the world installed on the phone.

ssllabs test just checks your server for common ssl related problems, it does not allow you to actively exploit ssl bugs like FREAK or BEAST

With all those TLS vulnerabilities coming out in the last months, i start to wonder, is there a tool that allows me to test those vulnerabilities? For example when the "basicConstraints" man-in-the-middle attack came out, moxie wrote sslsniff to demonstrate it. sslsniff has then be updated to exploit some more vulnerabilities, but are there any demos of FREAK, BEAST, CRIME or any other being exploited to demonstrate this attacks?

> It is way to early to say there isn't a way to port to 2.0. 2.0 doesn't even exist.

That is not what I sad. What I sad is that with the info we have now it seems there won't ever be a way to port the code to 2.x.

The code of 2.x we saw is completely different from 1.x.

> Again, the code will not stop working magically just because your code is 5/6 years old.

You are right, but "the problem is future proofing. What happens when Facebook releases its Oculus Rift browser and I'm still stuck on Angular 1.2 because of my IE8 support, but only 2.0 exploits the Rift properly? What happens when candidates for jobs stop knowing how to use 1.x? What happens when I have to give this technology to non-FEDs who find themselves confused by the conflicting documentation and version-less community code? (e.g. stack overflow snippets that require 2.x but do not say so)? I've seen these problems with other frameworks outside the front end space (e.g. Spring)."¹

I have been there as well, and I don't want to get there again. At least not willingly.

¹http://www.breck-mckye.com/blog/2014/12/the-state-of-javascr...

> It sounds as though you are already set on making each system a single page application.

No, not really.

> My recommendation would be to not make a SPA, and to just use jQuery and the pile of widgets that utilize it.

So hand crafted html? Or would you render html server side? How?

> Angular 1.x won't magically stop working when Angular 2.0 is released.

But it will soon become older and older and with the info we have now it seems there won't ever be a way to port the code to 2.x. So that would make it a bad choice for a new project with a lifespan of 5/6 years.

I would not use it for a new project now, if you know you will maintain that code for more than a few years.

https://news.ycombinator.com/item?id=8961857

http://www.breck-mckye.com/blog/2014/12/the-state-of-javascr...

I see no problem with Angular, but at the moment 1.x is dead tech, and 2.x is not here yet. So it's difficult to start a new project with Angular without feeling a bit nervous.

"dog" is in the company column - "Dognost" and "Dognosis"

why?

> I have a mobile game API that does ~415rps and about 2100qps. (About 1500qps are in MySQL, more below.) We do that with one DB server with 122m RAM. While we can continue to scale RAM, we can see the handwriting on the wall - indexes will continue to grow, and we won't be able to scale vertically forever.

I don't know how many users you have now and how quick you grow, but you can buy a server with more than 10x as much RAM as you have now. You may not "be able to scale vertically forever", but if you hit that spot you reached at least 5x Stack Overflow level. Congrats!

> We use NoSQL to store certain types of info, just as SO does - Redis, Elasticsearch, and so on. The more data we store and the more we use it in new ways, the more types of non-relational DBs we use.

> I don't think we'll ever have a situation where MySQL goes away entirely, but it stops being the singular solution pretty quickly as you scale up.

Sure why not. Use what fits your needs. But I guess you used Redis and Elasticsearch for it's features, not because it scales better - for that, some more RAM would have done it.

That DB does 343M queries/day. If the average page requires 10 queries to render, that's 397 pages/second the db would be able to return data for.

This math is obviously an average, but even if you halve that number you are still very much above everything most of us web devs are ever going to build or even see.

So they have 185 req/s for all their Stack Exchange sites. Let's say half of that is on Stack Overflow. That's 93 req/s and they do it with one DB (and one hot standby) with 384GB of RAM. I don't know many sites that big, so I think that the majority of people that say "the DB does not scale" work all for online properties with more that hundreds of millions of users, or are optimizing for a problem they will never have.

> It's one feature I miss since switching back to firefox.

You can use multiple profiles in Firefox. There is even an addon to make the switch easy: https://addons.mozilla.org/en-us/firefox/addon/profileswitch....

That's why I use davmail¹ -> owa to access my corporate mail over imap instead of exchange directly.

¹http://davmail.sourceforge.net/