level

I recently left a boutique agency of 5 years and I can definitely resonate with this one. Our agency aimed to catch big fish, and we did, but since they are hard to land we'd pick up small jobs in the meantime, just like the project that you're describing here. In my perspective, this isn't someone deliberately ripping you off. I imagine they intended to ship at the cost they quoted, but the team didn't adjust their working style to match your price point.

All the variations of the logo and design mocks are clearly overkill for a $15k project. The design team had time to fill and wanted to provide lots of options for you to pick from, as they typically would on a larger project. Those variations are an expectation for $100k clients, and you got the $100k customer treatment, but unfortunately not at a discount.

The reality is, small jobs like this are effectively make-work projects for an agency. They typically don't pay enough to be an effective use of time for the agency, but are a way to stay in the black between higher value projects. Small customers become "nuisance" customers as soon as a something better is landed. The team members being swapped out as they are needed elsewhere and newly joining team members then need to re-contextualize and regain momentum, all on your dime.

Your takeaway is correct, don't be a small fish for an agency. If they're busy they won't take your work, and if do show interest, they are desperate for work.

I built a server a few years ago, and I determined it was more cost effective for a drive to fail than to use HGST. It would be more inconvenient, but having a drive fail on a home server with only 6 drives didn't seem very likely anyway.

The problem is that it's not idiot-proof. If someone doesn't understand why the algorithm is important, they might choose none. It's easy to say "they shouldn't be using JWTs if they don't know how to use them", but everyone starts somewhere, and everyone puts stupid bugs into production.

JWT is safe, as long as it's setup correctly, but safe-by-default is a better option.

That being said, I'm not going to swap out my JWTs with PASTs. I know what algorithm I'm using, why I'm using it, it is safe, and I'm verifying them properly.

Rather than maintaining a list of HSTS websites which isn't cross-browser, why is there not an optional HSTS flag attached to the DNS response? I don't know anything about DNS requests, so changing the protocol in a backwards compatible way might be impossible, but that seems like a much better way to maintain that information than with a separate list.

Probably, but contract issues could lead to a hefty legal bill as well.