tristador

> When she someday establishes keys, and cryptographically proves her Twitter account, the Keybase servers will ping my apps and ask for me to make available the decryption key to her. My app will check the signed statement from myself, check her tweet, make sure the proof is valid, and then send the decryption keys to her, encrypted for her device keys.

> Keybase is not a trusted man-in-the-middle here, and no one else has keys. The only weak link here is Twitter: my assertion is like this, in English: “once someone who owns the @billieeilish Twitter account publicly proves a Keybase connection, I'll unlock it.” If Twitter gives that account to someone else or takes control of it, I'll be trusting Twitter's answer. @billieeilish is not yet a human. She's a Twitter account.

That seems decent at first pass. Keybase could maliciously not notify about her joining keybase, but everything after that seems like it follows a cryptographic path.

Is your concern that their code is improperly implemented (which seems the concern cited for triplesec)? I'm not seeing the abuse risk. Any pointers?

I'm not following. How do things work better for the non-microservice approach?

Re. teams: For any project above a certain size, you'll have teams. If that's a network boundary, a process boundary, or a library boundary doesn't change that you'll have multiple teams for a large project.

I'm not sure I get the resiliency point. I worked on a project where the dependent data service was offline painfully frequently. We used async tasks and caching to keep things running and were able to let the users do many tasks. For us our tool was still fairly useful when dependencies went down. If we used monolith then everything would be down, right? That doesn't sound better.

> 2000 extra hours during a 12 month period

11.5 hour days, 7 days a week for a year?

> I almost burned out

No kidding. Seems like a recipe for much worse than burn out.

> So in 3.8, they kept code that had deprecation warnings so that they could be compatible with 2.7. They'd like to now drop that code and be 3.9-only compatible, but they don't have enough time to do that because they couldn't start that work as long as they were supporting 2.7.

> So the dilemma is essentially how hard we push users to abandon 2.7 -- how much tax we incur on them for keeping its support.

Its fascinating to see how the details of Python 2.7 EOL are still being figured out, and nuisance of the decision are still being debated.

I think a favorable reading is that he described the category. Facebook tracked that fine under "general and administrative".

I thought Google Analytics had a decent privacy policy that would prevent Google from doing anything with GA data. But I remember some fuzzy wording like "your data" which could simply mean that Google considers GA data to be their data.

Has anyone done a good deep dive on what Google actually does with GA data?

Looking at play store quickly:

Facebook, which I've seen preinstalled on phones, has 5B+ downloads.

Google authenticator has 10M+ downloads. It's not that popular relative.

For Android, preinstalled apps are set by the phone manufacturer. I suppose each manufacturer could pick their favorite 2fa app and install it. There is some pressure not to install apps that the user doesn't need as it's bloatware. I'm not sure what percentage of users currently use an authenticator app.

The economics on that look terribly bad. Keyboard is too high or screen is too low. Keyboard is too close to the screen.

I suppose you'd adjust those but for a single piece of glass product, your sort of stuck with placement.

Honestly, what's wrong with a wireless keyboard? Or a wired one?

I like the idea of a paid social network, that removes tracking and ads, focusing on quality engagement versus quantity.

There are a few of these already, what makes this one unique?

CF is undoubtedly good for DDoS protection, but that doesn't negate the fact that it does other things poorly.

FWIW I've found more websites that prompt for Cloudflare captcha than I've seen websites offline due to DDoS. I've seen lots of websites offline because they get too popular though. Many websites that I've known were currently under DDoS attack stayed online while I used them (like GitHub using Akamai).

At the risk of Troy writing a blog post proving me wrong... does the average static website need DDoS protection? I'd guess they don't.

> However you can’t just choose to not pay for things.

Sure you can. The article even has examples.

> In the 1950s camping was an acceptable vacation. Hand-me-downs were acceptable clothes. A 983 square foot house was an acceptable size. Kids sharing a room was an acceptable arrangement. A tire swing was acceptable entertainment. Few of those things are acceptable baselines for most households today. The average new home now has more bathrooms than occupants.

> most poor people I know

I think this is the disconnect. The article is about the 50% of Americans that have nothing saved for retirement. Not Americans who are poor. It's specifically about how you can make lots of money but have nothing saved.

If we talk about poor people, then I agree with most of your comment. It's just not what the article is talking about.