debussyman

> who then build quite a lot of snowflake software

So close! People building snowflake software is a consequence of it not being a generalizable problem, not the cause of it. Everyone organizes their notes/todos differently, and though the variations may seem slight, they are best solved by a blunt and unopinionated tool.

> It takes some time to get used to

Non-starter. A text file is the hammer of the digital world

I love LiveView + Svelte!

(I gave the talk at ElixirConf 2022 on how to combine them, but the live_svelte contributors have done the work to make it a reality)

IMO there is always a need for client side state, especially for apps with rich UX. I also live in NYC where network connectivity is not a given, especially in transit.

One super powerful feature that the authors don't cover is being able to use Phoenix's pubsub, so that server-side state changes that occur on other servers also get pushed reactively to any client. It's pretty typical to have multiple web servers for handling mid/high levels of traffic.

I like this approach, I've always thought that IaC could be generated by scanning application code. Although I share the skepticism that IAM is the best place to start.

I'm curious though how well an LLM performs for newly released AWS services? This is where I've experienced the most arcane IAM definitions personally, but I wonder if GPT 4 is trained well enough on newer sources.

The problem with venture-funded neobanking business model today is that growth is expensive. CACs for traditional US banks have always been high (ever gotten an offer of several hundred dollars to open an account?), and it's even higher for an upstart with no brand equity.

On top of the high CAC, the pressure for growth is strong for venture-funded businesses, leading to more spending on marketing.

While the author does list opportunities to generate revenue, in my experience the annual revenue per user is at least 10x lower than CAC, meaning you can't generate a profit for decades, even discounting fraud losses as 0.

I worked next to the founders a decade ago and tried the first versions of the project (before Apple acq). Loved the concept, but it hasn't really lived up to the promise.

Very neat! AI using AI!

The post says "If you stored secrets on our platform during this time period, assume they have been accessed" so I'm guess self-hosted customers weren't impacted.

The method of attack sounds like CircleCI's production cloud (probably AWS) was impacted - "the targeted employee had privileges to generate production access tokens as part of the employee’s regular duties, the unauthorized third party was able to access and exfiltrate data from a subset of databases and stores, including customer environment variables, tokens, and keys."

But I am surprised that their SOC2 auditors didn't raise exceptions about their lack of controls. Sounds like a pretty immature program, they only talk about 2FA, MDM and SSO which is basic stuff. Where is the SIEM? Or CSPM? Or any alerting!? Yes there are SOC2 automation platforms out there that rubber stamp stuff, but at CircleCI's scale I'd expect more scrutiny.

Interesting to hear your work on Satori, thanks for sharing! Curious if you've done the same analysis for Immuta?

We haven't set up a public test suite or bug bounty program yet, but will look into this, it makes a lot of sense.

mystery solved

Thanks, I'll reach out next week!

Sounds good, travel safe