chavesn

Right, and how would you further verify “the person paying for your subscription”?

Genuine question, what would that flow look like?

> all of those cases very well justify a manual check, or some sort of extended identification before the user is let in.

Just curious, what would that check look like that's not open to the same vuln?

If oauth makes an authenticity claim, it should be true. Saying it's the same user when it's not is bad, clearly.

in other words: Google could make a more accurate authenticity claim than they currently do.

This problem would be worse without oauth, though, right? With plain email login, all they would need to do is "forgot password" and there wouldn't even be a way to tell.

in other words: Email login would never be able to make a more accurate authenticity claim.

> Failed startups don’t always shut down cleanly like that.

Agreed, and with the number of services and the "ease" of oauth it's likely impossible to even track. You could make a list of the major ones, but there could be hundreds per user, ultimately thousands of unique services used depending on the breadth of the startup's activities.

> NPM stood for "not my problem"

wait...

I think it's more like there's more surface area to forget when you have humans handling so many concerns, and it's not likely the part that's changed the most so it's a likely candidate for being "pushed out of the buffer" (of the human).

In a more typical model, backend devs focus more on security, while not needing to know the frontend, and vice versa.

It seems like that's the point of the story -- they were willing to tip well, and received bad service. If it came after, then drivers would have a reason to make sure food was delivered fast and efficiently.

obviously drivers would want to know it, but is that good for everyone involved? It would make more of an auction but should it even be an auction?

The ligatures are really interesting, but at a glance I process them so much slower than the raw characters, especially the ones that change the graphical semantics such as <= vs ≤. Does anyone have experience getting used to these and 1) does it end up faster? 2) once you are used to it is it harder than it was before to process the raw characters when reading code in fonts that don't have the same ligatures?

Those sans-serif spaces tho...

Keep the same amount of garbage, but make it minimalist garbage

Ok but I can't unsee that the first two say plus plus ("plus+") and the 3rd just says "plus"?

(Very cool project though)

"Hey, this looks like darkpatterns.org. ...oh, it is."