Bamafan

They don't just "not like the US".

The US is actively terrorizing their homelands.

What nuance needs to be added to blowing up hospitals?

All that.

I've told people who scoff at $32 million "for a website" that $32 million might actually be low, depending on requirements.

My takeaway is that most people assume a university professor never "brushes up against the floor of society" (as you put it).

This article is good for enlightening people that this is far from the case.

I'll bet you use Azure though (even if you don't realize it). I guarantee you use apps/websites/services that leverage Azure.

> For whatever reason, the industry press never liked Ballmer, and I guess they like Satya

Ballmer made several missteps:

1. Fruitless foray into mobile with acquisition of Nokia and Windows Mobile and Windows Phone strategies.

2. Billion+ dollar acquisition of Skype that basically went no where.

3. Remember a company called aQuantive? Don't worry, neither does anyone else. Ballmer's MS purchased them for $6 billion.

That's off the top of my head, but I'm sure there are more examples.

Long story, short:

1. Realize the world is moving beyond Windows

2. Cede mobile OS to Android/iOS, that battle is lost.

3. Realize, next great revenue stream is the Cloud (Azure).

I think it's useful as far as making the amount stick in the brain. For like 90% of America a stat like that is a hugely disturbing figure.

> It's not even really a city, but more just a place where exurbanites congregate from 9 to 5 to conduct commerce.

Definitely not the case. Lots of people live in the city of San Francisco, though it's also true a lot of people commute in from the South and East Bays.

There are good things about the city, but the homeless problem (and really, that's what I think this is about) is a very serious issue that makes the place much, much less desirable.

I think the part that you may be missing is that View 1 (embedded view) is hosted on DocuSign's domain.

So the view may be designed by the client, but it's not hosted by the client. It's hosted on DocuSign.

Then View 2, is the "dashboard" view which of course isn't designed by the client.

In an ideally designed embedded View 1, it should not be possible to get to DocuSign's "dashboard" (View 2). Sessions should be tracked in DocuSign's API and View 1 refreshes should return the user to hosted View 1 or should return an error.

Even if they added this feature, the API bug would still remain (it would just be covered up by the UI).

A sophisticated enough client user would still have access to the all data associated to the API user.

I'm curious as to how HelloSign guards against this. Do they have some sort of session token that sends you back to the signing page on refresh? (i.e. similar to guard to avoid submitting shopping cart purchases twice).

When I read retrospectives like this, I wonder how many apps have this bug and don't know it.

Whether an API is "good" or "bad" often is dependent on the requirements of the calling client. At the beginning of projects when client requirements are unclear, it is often hard to determine whether a supporting API/library truly meets your needs.