ekryski

Sure, but it's about balance and setting expectations with the users of your open source framework. Being transparent and delegating responsibility. Your project can only scale as well as you can and that is limited by the number of hours in the day. It's called "open source" for a reason and typically the nature of open source is not money but shared knowledge and contributions. If you're looking for money it probably should just be closed source.

Exactly. Even at 20 hours a week you're looking $20k/month. As a freelancer that is a great rate with little overhead. There is no doubt that being the author of Hapi is a major reason why he can charge that rate. I get being burned out and/or wanting support but not recognizing the correlation just comes across as entitled.

Definitely an intentionally click-baity headline :). I am in no way affiliated with either company in the at article. Just happen to know the guy that did the VERY thorough detective work.

However if you are spending money on some of the higher end Digital Ocean servers you are getting screwed, as they are massively underperforming even compared to just a couple $5-$10 instances.

I'll also note that I am a big fan of Digital Ocean and have been a customer for quite a while now.

That's pretty smart. Effectively versioning your issued tokens. Way easier than maintaining a blacklist.

You have to be careful that you are not leaking sensitive info though, as the JWT payload is meant to be visible on the client as well.

I agree that's how we treat them with Feathers. You may know this already but JWT's are intended to be decrypted on the client so you shouldn't be be saying "if" it is cracked, more "when". The signature is only good for ensuring that the content hasn't been manipulated. Not that you are, but for others, never store anything inside a JWT that is sensitive, and if it is make sure you encrypt it first before you put it in the JWT payload.

Sounds good. Really appreciate that feedback. Seriously. I have felt a bit like we are throwing a lot at people at the beginning of the docs.

Nope. Not intentional. Looks like we had the old URL. Thanks for pointing that out. I've updated the website and the docs.