I'm a senior engineer and have no degree. I never get offended by people making comments like this. If we're both in similar roles, making quality contributions, and are progressing in our careers, the only difference between us is, I didn't spending 50k-100k on a degree.

Sounds more like a knock on the person making the comment than it is on me.

Seems like everything is a hot button topic these days. Even things like movies get connected to a hot button in one way or another.

Couldn't agree more. Squash merges to main ONLY.

That way, I don't care if your branch contains 100 commits or 1 commit. I don't need to worry about commit messages like:

- fix 1

- fix 2

- dfljfdlkfdj

- does it work now?

Do whatever you want with your commits on your feature branch. Just make sure the title of your PR is clean and follows our formatting. Git history is always well formatted and linear.

It's the ideal solution.

Captcha is only effective at annoying legitimate users. If there is any incentive to do so, bots have no problem bypassing/solving them.

Seconding this. Many sites are broken or inaccessible to me in qutebrowser lately due to Cloudflare captchas. I'd rather allow some bots in than lose the ability to use the site my preferred way.

Is this your experience as a sysadmin or a user? As a sysadmin, this is an absurd statement in contradiction of my everyday reality.

There are dozens, if not far more, of captcha solver API's for extremely cheap. Captcha is very shallow bot "security" theater, they just deter the cheapest attempts.

latest greatest versions of captcha are more resilient to these types of services, but it's a cat and mouse game. I would recommend that you, as a sysadmin, learn at least the most basic things about this stuff.

> I would recommend that you, as a sysadmin, learn at least the most basic things about this stuff.

This sort of language is inappropriate and unnecessarily combative.

In any event, no filter screen is perfect. Getting rid of 80% of bot traffic is a good thing, even if you can't rid yourself of 100% of it. You can't let perfect be the enemy of "pretty good."

People use CAPTCHAs because they work--even if imperfectly. Of course, you have to stay on top of the latest implementations.

The GP comment was appealing to their own authority in a condescending way, I feel the tone was matched, but thanks for the feedback.

What you’re saying is true, although you can do simple blocks on user agent + geo ip alone and accomplish blocking a majority of bots anyway without captcha - but I’ll digress - that is not the topic of discussion. I’m not at all arguing that CAPTCHA doesn’t stop bot traffic - in fact my first comment says the opposite. Most bot traffic is extremely “dumb.” A mistake people make, which the gp comment seemed to, is that it stops bots dead.

I think it depends on how determined the actor is. I see all the range from your simple scripts to full on mimicking real user behavior that I can only really spot from the honeypots they hit.

You'd probably catch most the low hanging fruit for sure, but you would cause friction for real users.

I say this as someone who has enabled captcha on some of our more critical endpoints, there's definitely a place for it.

My website's contact form has a reCAPTCHA and it still gets spam sent through it (though vastly less). They pass the reCAPTCHA somehow. My contact form literally only emails me and they still do it.

Memorizing CLI commands and typing/editing them over and over can be very time consuming.

Use k9s for example. Let's say you want to determine where the value of an environment variable is coming from.

1. 'kubectl get deploy -n example' (find the name of the deployment in question)

2. 'kubectl describe deploy example-app -n example' (determine where the value for the env var is coming from)

3. 'kubectl get cm example-app-config -n example -o yaml' (check the value of the referenced key in the config map)

This is a very basic example but you can see where it lead to slow debugging that is made even slower by its propensity to typos and the need to look up command syntax. Once you get comfy in a well designed TUI, you can fly through this process in 10 seconds.

Also sends everything you type to Google. Depends on whether you care about that or not.

IIUC this is only true if you "Allow full access"

From 3rd party keyboard agreement:

> If you do not enable Full Access, developers are not permitted to collect and transmit the data you type. Any unauthorized collection or transmission of this data without your permission would be a violation of their developer agreement. Furthermore, there are also technical limitations in effect to prevent unauthorized access.

Wanted to read more about this. Source of the text seems to be a pop-up in iOS if I understand it correctly: https://discussions.apple.com/thread/8519296?sortBy=rank

what do you lose if you don't give it "full access"?

gifs / stickers / search stuff

I doubt it does. If it did, it'd have learned basic declensions of basic words in Czech and Polish, because I've corrected it a million times already.

This is a very optimistic take on why Google bothers with data collection.

Turn off its internet access? That's what I do for my keyboard (owned by Microsoft but I'd probably still do that if it was made by the pope himself)

The problem is creating a single point of failure.

There's no doubt a VM in AWS is exponentially more redundant than my VM running on a couple of Intel NUCs in my closet.

The difference is, when I have a major outage, my blog goes down.

When EC2 has a major outage, all of the blogs go down. Along with Wikipedia, Starbucks, and half the internet.

That single point of failure is the issue.

Single point of failure means exactly opposite of what you think it means. If my work depends on 5 services to be up, each service would be a single point of failure, and correlation of failure is good for probability that I can do my work.

I see what you're saying but I have to push back.

"If one thing I need is going to be down, everything might as well be down."

If I have a product with 5 dependencies and one of them is down, there's things I can do to partially mitigate. A circuit breaker would allow my thing to at least stay up and responsive. Maybe I could get a status message up and turn off a feature flag to disable what calls that dependency.

On the other hand, if all my dependencies are down AND the management layer is down AND the AWS portal is not functioning correctly, I'm pretty much SOL.

Massive centralization is never, ever a good thing for anyone other than the ones who are doing the centralizing.

So if you can just run without one service, what's stopping you to remove the dependency altogether. Why would you only want to remove the dependency when service is down.

So e.g. to get real my application depends on AWS's EC2, RDS, EKS, S3 Cloudflare's DNS, and Redis' instance. If any of those stop working it will go down. If everyone is within SLA, they might as well go down together than separately.

This is a really interesting point, because I could see a situation where your application requires integration with say 10 services. If they all run on AWS, they either all go down or all run together. If they're all self-hosted, there's a good chance that at any time one of the ten is down, and so your service can't run.

+1

Working with ADO pipelines is painful.

- Make change locally

- Push change

- Run pipeline

- Wait forever because ADO is slow

- Debug the error caused by some syntax issue in their bastardized version of yaml

- Repeat

If you have worked with HCL in any serious capacity, you'll be happy they didn't go that route.

Here's some fun examples to see why HCL sucks:

- Create an if/elseif/else statement

- Do anything remotely complex with a for loop (tip: you're probably going to have to use `flatten` a lot)

Stuff like HCL and Ansible YAML makes me want to require mandatory training in Ant contrib tasks for developers creating them:

https://ant-contrib.sourceforge.net/tasks/tasks/if.html

  <if>
    <equals arg1="${foo}" arg2="bar" />
      <then>
      <echo message="The value of property foo is 'bar'" />
    </then>
    <elseif>
      <equals arg1="${foo}" arg2="foo" />
      <then>
        <echo message="The value of property foo is 'foo'" />
      </then>
    </elseif>
    <else>
      <echo message="The value of property foo is not 'foo' or 'bar'" />
    </else>

</if>

https://ant-contrib.sourceforge.net/tasks/tasks/for.html

  <for param="file">
    <path>
      <fileset dir="${test.dir}/mains" includes="*.cpp"/>
    </path>
    <sequential>
      <propertyregex override="yes"
        property="program"  input="@{file}"
        regexp=".*/([^\.]\*)\.cpp" replace="\1"/>
      <mkdir dir="${obj.dir}/${program}"/>
      <mkdir dir="${build.bin.dir}"/>
      <cc link="executable" objdir="${obj.dir}/${program}"
        outfile="${build.bin.dir}/${program}">
        <compiler refid="compiler.options"/>
        <fileset file="@{file}"/>
        <linker refid="linker-libs"/>
      </cc>
    </sequential>
  </for>

Yes, programming with them was as fun as you're imagining.

That looks so terrible, but they could have been so easily transformed into an S-expression language similar to Lisp:

    (if (equals foo "bar")
      (then (echo "The value of property foo is 'bar'"))
      (elseif (equals foo "foo")
        (then (echo "The value of property foo is 'bar'")))
      (else (echo "The value of property foo is not 'foo' or 'bar'")))

That’s not a Lisp-like language I particularly like, but it’s not flat-out insane like Ant appears to be.

Advocates for the inappropriate use of XML (basically, anywhere it was used as anything other than a markup language) have lot to answer for.

I don't think that email he posted from legal@google.com is legit.

Look at the first sentence of the first paragraph and the first sentence in the second paragraph. Two grammar errors which are a dead giveaway it's fraudulent.

> Thank you for your assistance and understanding during your recent support call, regarding a ficticious request aimed at accessing your Google account.

Comma doesn't belong there and "fictitious" is misspelled.

> To follow all guidelines of the internal review properly. Please keep a secure note with the temporary password which your support representative has provided to you.

Out of place period. Should be a comma.

Legit, canned emails like this (especially from legal@google.com) would be proofread much better than this. It's fake.