jamesboehmer

Awesome job, this looks fantastic, and has all of the UX gaps I wish existed in Bear and Obsidian. However, my 2 biggest pain points with those could use addressing, and I would happily pay a high one-time price and upgrade fees over the years if they could be solved: 1. My corporate laptop is locked down, so no apple app store installations. Could this be made into a brew-installable app and licensed another way? 2. Related - every corporate laptop I've had for the last 10 years prohibits app store and icloud storage. So Bear notes (which I subscribed to) can't sync. Obsidian has a sync service, but I don't trust it (would prefer apple or dropbox), but unfortunately the plugin ecosystem is messy and difficult. There is no reliable community-supported plugin for syncing with dropbox on mobile. If you could make syncing with dropbox possible on desktop and mobile, that would be the ultimate gift to the community.

Why don't you go ahead and give birth then, tell us all about your experience.

This looks fantastic. I would sponsor for AWS IAM auth.

I wasted my time trying podman and switched to colima. It's the only usable free alternative that's a true drop-in replacement for docker.

I do the same as the person you're responding to. There is no '+' in my email, I just create random strings @mydomain. It's impossible for a scammer to know they all go to one inbox.

It may partially be because of vendor lock-in, but I think the real reason is security. For example with Apple's Secure Enclave hardware, you give secret-generation responsibility to this chip, and can never see the value. I use it for SSH private keys, which are meant to be disposable/changeable. As much as I want to own and control all my data, I personally think this is pretty good footgun protection, and I'm ok with being unable to export my passkeys from 1password (and for the record, 1password does not prohibit TOTP exports).

pip is so easy, but unfortunately i've found that if you add package signatures to requirements.txt, pip chokes on it when installing it later. And subdependencies aren't always named perfectly, e.g. they might specify ~=1.4, and a subdependency that what was once 1.4.0 is now 1.4.27, and incompatible or compromised.

conda is so heavyweight installing whole pre-approved builds. and the command line options I find extremely frustrating.

I need supply chain security and perfectly reproducible builds, so poetry was the only real option.

I think the point is that building any kind of tool to enable this is surface area for an attack. The design choice is to remove any possibility of that happening at all.

In this day and age, why does Thunderbird still ask for my password to store locally instead of using a standard OAuth flow? Every time I consider using Thunderbird, I just can't bring myself to enter a password. It feels like such an antiquated violation and gaping security hole.

This has never happened in the United States, and every expert out there says there is no sign of any kind of effort or legislation to do so. Involuntarily losing access to old cars is an imagined problem.

There's a gigantic difference. You stare at a handheld device when typing. When you're driving you need to feel what you're touching, otherwise you have to take your eyes off the road.

Are you against 2fa, or against being compelled to use it? Why?

Yet.