raskelll

I always felt the same every since I learnt about the company. Can't think of a more rewarding place to work at.

Good fit for coarse auth at the edge (who is this? what tenant? basic scopes, and so on). I’d still keep object-level/domain rules in-app. Fail-closed for auth, fail-open for observability is the right mental model. Biggest multi-tenant footguns are header spoofing + tenant-unaware caching. The proxy should own identity headers and include tenant in any cache key.

Appreciate that! That exact failure mode is why I went with out-of-process agents. A bit like Envoy's ext_proc filter. Sentinel treats agents like separate services (timeouts, circuit-break-ish behavior, w/ explicit fail-open/fail-closed choice), so a crash/hang in WAF/auth shouldn’t take the data plane with it.

Out of curiosity: when the nginx module bit you, was it mainly crashes, memory leaks, or latency spikes under load?

The closest to OpenBSD in the Linux-verse clearly is Void Linux.

Let me revisit my statement once I've read those chapters then.

Regarding your second statement, out of curiosity, I wonder how you would characterize the 1989 series of experiments done by Fleischmann and Pons.

The arrogance I mentioned is directed towards the people who think of themselves as appropriate to speak for the century-long success story of science itself while not really addressing (and understanding) how science emerged. Science as a human enterprise has flourished best without anyone putting boxes on what does and what doesn't consitute science.

Read the whole of his "science" series. You're going to be delighted to find out that he's really fond of analogies, golfing being a particularly fitting one.