Readit News logoReadit News
Sir_Substance commented on Docker to rate limit image pulls   docker.com/blog/scaling-d... · Posted by u/AaronFriel
Sir_Substance · 5 years ago
Hrm, based on this: https://docs.docker.com/docker-hub/orgs/#add-a-member-to-a-t...

I see that Docker doesn't actually offer an AWS-style enterprise account that one can use to hand authorization to developers without requiring those developers to make individual accounts.

It feels pretty sassy of docker to give everyone 2 months to shove credentials everywhere when docker themselves haven't done the minimum to make enterprise accounts realistic. Instead, they're adopting the github model of "oh, just ask everyone to make personal accounts and then include their personal accounts in the org team". That has problems.

Firstly, it puts employers in the unpleasant position of attempting to compel employees to make legal agreements with third parties (docker, in this case). The correct way to do this is AWS-style, where the org itself makes /one/ agreement and then delegates that agreement via access keys. This is the minimum I expect from enterprise account systems, hard fail for docker.

Secondly, it's a clusterfuck to manage. You end up with an org filled with random-arse account names that you can't really audit, and you don't know who has access to what. If employees leave the org, it's hard to ensure that their access is revoked because the access takes place entirely outside the standard account domains.

Github has recently improved this a shade by adding ADFS authorization to org accounts, but that involves asking employees to tie their personal (and all github and docker accounts /are/ personal) account to their work ADFS account, which is a shitty half-solution.

All things considered, docker made this problem for themselves. They've spent /years/ working hard to get everyone to make docker accounts and push everything to docker hub instead of fostering an ecosystem of registries by different orgs for different purposes. All of a sudden it's now "too expensive" and they're dropping the hammer on everyone to sign up and push credentials everywhere with very little warning, whilst not doing their half of the work by making a proper delegated authority account system.

Doesn't fill me with confidence for their future as a stable platform on which to base a business.

Sir_Substance commented on Ketamine that's injected during arrests draws new scrutiny   abcnews.go.com/Health/wir... · Posted by u/seigando
Sir_Substance · 5 years ago
If it's ok for us to deal with violent people by:

a) gunning them down in the streets

b) beating the shit out of them

c) injecting them with hilarious overdoses of drugs and crossing our fingers

then why would we pay for police?

If that's ok, we might as well go back to old west times and just have everyone carry revolvers, possibly calling the town apothecary with his bottle of ether if we think we need it. It'll be way cheaper than maintaining a standing police department.

The whole point is that police are supposed to be trained and equipped to handle disturbances without harming the person being detained. There are options for this, including that so rarely used tactic, defusal.

Like, we pay police overtime. Cordon the person off, give them space but don't let them leave, wait until they get hungry even if it takes 12 hours, and then bribe them with pizza to come quietly. Build rapport with them over the entire incident. How often do we see that strategy deployed before we fall back to injecting ketamine?

Sir_Substance commented on Google forced OnePlus to decimate a Fortnite launcher deal, claims Epic Games   theverge.com/2020/8/13/21... · Posted by u/0xedb
RonanTheGrey · 5 years ago
I don't find it particularly interesting to argue over whether Google and/or Apple or Goople are monopolies/duopolies.

I think however it is obvious that something has seriously pathologically gone wrong in the mobile software market and these two companies are behind it.

I also don't think that appeals to "is that legal" are all that satisfying -- (Apple's free speech lets them silence whoever they wish, of course) -- but does that seem right to you?

For problems like these I tend to start at the end and work backwards. What would we want an ideal ecosystem to look like? And working backwards, what policies, laws, and cultural rules were made in order to get there? What products were built, and/or sold, in order to build that outcome?

Then we do those things.

I watch these conversations again and again devolve into whether these companies are monopolies, but I think that discussion is beside the point. Is it right?. Why do I only have 2 choices? Why do I get to choose only between Global Hoover or Comical Evil? And why if I choose one of them, do I give up all choices that follow?

Solving problems like these relies on establishing a common ground about what we want to see, and agreeing that what we see isn't that. So -- what do we see wrong now, and what would we fix?

Sir_Substance · 5 years ago
>I also don't think that appeals to "is that legal" are all that satisfying

I've always used the rule of thumb that if the best thing someone can say about their behavior or decisions is that they aren't illegal, that person is probably the arsehole in the situation.

Sir_Substance commented on I accidentally built a nudity/porn platform   elazzabi.com/2020/08/11/t... · Posted by u/elazzabi_
UncleMeat · 5 years ago
But what are the features you don’t need? That is not the same set for all users.
Sir_Substance · 5 years ago
Yep. The late 90's and early 2000's was littered with people trying to make "light" copies of MS Word. The problem is that journalists need the wordcount feature, and teachers need the wordart feature. Remove either, you lose a demographic.

That having been said, there are a lot of products out there that made their product intending it to be free, and then when they hit 1m users they started thinking "hmmm, if I could get a dollar out of every user, I could buy a house". They try to stuff a monetization model in sideways and damage their product in the process. Taking a moderately successful product that's crippled by attempting to shoehorn in monetization and redesigning it to have reasonable monetization from the beginning might be a better strategy.

_m7bj commented on Short on Money, Cities Around the World Try Making Their Own   bloomberg.com/news/articl... · Posted by u/walterbell
cameronbrown · 5 years ago
This seems like a horrible idea. How does nobody realize that you can't just "will" a currency into having value? A piece of paper won't produce value... At least bitcoin gains it's value from traders buying USD with BTC.
_m7bj · 5 years ago
Local councils can create some value by allowing people to pay council taxes, fees and fines with the issued currency. Enough to peg it 1:1 with the USD? I'll be honest, I don't know how countries like panama manage that, so hell if I know how a council would do it.

Fundamentally, this is what underwrites the US dollar as well. If you don't pay your taxes you (eventually, provided you aren't connected enough to avoid it) get arrested. You can generate your wealth in corn or software or boat building, but you have to pay your taxes in US dollars. You can't barter your boats for corn and pay your taxes in corn. Thus, (almost) everyone in the US needs some US dollars to avoid being jailed. This is the foundation upon which the value of the US dollar is built.

Of course, making sure it doesn't blow up in the councils face in a few months/years time due to lax issuing controls is a different matter.

Sir_Substance commented on The creeping scourge of tooling config files in project root directories   github.com/nodejs/tooling... · Posted by u/flaque
wwright · 5 years ago
requirements.txt has a lot of deficiencies for package management (compare to the various features Yarn or Cargo offer). The biggest weakness is transitive dependency locking: even if you specify the exact version of the dependencies you want, Pip can still resolve to a different version of their dependencies, and even then there’s no verification that the content matches what is expected beyond the version number (other tools use a content checksum). This can cause a long tail of reproducibility and maintenance issues.

It’s also a tiny subset of what the parent describes.

Sir_Substance · 5 years ago
When I first set up my requirements.txt's, I usually set up a venv, install the things that I need and then run "pip freeze" to get a list of all deps including transitive deps, and put them all in the requirements.txts.

I do sometimes feel that people are making rube goldberg machines out of their package management in an attempt to avoid just writing down all their deps.

Sir_Substance commented on University to require residents wear ‘BioButton, to track health   clickondetroit.com/news/2... · Posted by u/avonmach
Sir_Substance · 5 years ago
Leaving aside my visceral reaction to attaching mandatory trackers to people:

>The “BioButton” is wearable technology that monitors your vitals, including temperature and heart-rate, in real time. It can last for up to 90 days. It’s meant to be worn on the chest and connects to your mobile device.

Once again, technologists attempting to make covid solutions have forgotten that not everyone uses smartphones. On top of that, what're the odds that this doesn't work on any version of android older than oreo, or that don't have google play services installed?

Sir_Substance commented on On Open Source, licenses and changes   blog.frankel.ch/on-openso... · Posted by u/nfrankel
ensignavenger · 5 years ago
The problem with the WFPL is that it may not be legal in many jurisdictions. I would encourage you to dual license with the WTFPL and a more legally vetted license, such as MIT, to allow your software to be used in a wider variety of jurisdictions.

And thank you for writing open source software!

Edit: The CC0 may be a more legally valid license that accomplishes the same thing.

Sir_Substance · 5 years ago
I've always been a fan of the sqlite licence: https://sqlite.org/copyright.html

Basically sqlite is public domain if your country recognizes that kind of thing. If it doesn't, then sqlite doesn't care and will never pursue you. However, if /you/ care, sqlite will sell you licence. This licence costs $6000, looks very official and shiny and whatnot, covers all your bases as if public domain did exist in your country, and sqlite uses the money to continue funding development.

I'd be inclined to do something very similar with an additional clause stating that if dedicating to the public domain doesn't free me from liability, then see $6000 licence. (I thought sqlite had this, but either they've removed it or I misremember).

Sir_Substance commented on Linux Mint drops Ubuntu Snap packages   lwn.net/SubscriberLink/82... · Posted by u/jonquark
still_grokking · 5 years ago
As a user I don't like neither Snaps (that for sure as this is Cannonical only) nor FlatPaks (as they seem conceptually a "80% solution" which combines the problems of package systems with the problems of self-contianed apps, but don't improve on anything).

For me the only acceptable solution besides proper .debs are AppImages. AppImage doesn't try to "replace" the package management for desktop apps like the former two candidates. It tries to complement package systems for some special cases (like for example commercial software, or for the cases where the user "just wants to try something out" without "polluting" the whole system with a lot of dependencies).

For my desktop needs AppImage is like "Docker, the good parts". A simple self contained format that runs everywhere without any further dependencies. Compared to that Snap and FlatPak are bloated annoyances.

Sir_Substance · 5 years ago
I also prefer appimages as the "least worst" of the three.

However, a quick note: As someone who unofficially maintains a linux port of my companies software, I have considered packaging it as an appimage, but there's one problem with appimages that kills the concept.

Appimages are read-only[1]. I'd love to package my companies product that way, but we already have update-delivery infrastructure that works on windows and mac (and linux), and it assumes it can write to the "install folder". Changing the entire update infrastructure specifically for an OS we don't officially support is a non-starter.

From a developer perspective, I would love the ability to update an appimage's contents in place. However, as a user I'd also like the ability to set it read-only to block updates if I desire. Flatpak's mandatory updates are one of the key reasons I dislike it. Never the less, if the goal is to smooth the path for proprietary software to support linux without making half a dozen different packaging solutions, in place updates need to be supported.

[1] edit: according to comments below, they now have an update mechanism, but it's still a totally appimage-specific process, so my problem remains :/

Sir_Substance commented on Dark patterns in GDPR consent boxes   arxiv.org/abs/2001.02479... · Posted by u/vincent_s
qwerty456127 · 5 years ago
I just click agree and then flush the cookies regularly which usually is much easier than find the way to deny. The EU should better force them to respect the do-not-track header - this would be a way handier. I hope the law gets an upgrade soon requiring everybody to offer an easy "deny all tracking and proceed" button. The only case when I actually don't mind to be tracked (by the first party only, anyway) is when I register and sign-in.
Sir_Substance · 5 years ago
I use ublock origin to selectively block the consent boxes. I've never yet seen a website which says "our backend has noticed you have not yet consented, you may not continue".

u/Sir_Substance

KarmaCake day2635December 8, 2014View Original