Adam Stacoviak: You’ve had a big November, you got Managed Cloud out there, you went GA, we talked about database imports… We didn’t touch on - because this isn’t an announcement podcast by any means, but we didn’t touch on the Prisma data platform integration that you’ve got going on. I’m sure that’s a big win for you as well, how that plugs into Vercel and how easy it is to take essentially an application to production… Like you had said, just this idea – and I think that’s what’s really interesting about where you’re going and what Vercel is doing and what Netlify is doing and what Prisma is doing in terms of their data platform… Just like enabling that future founder who’s got the next Stripe idea in their head to just build the company initially technologically pretty easily (in quotes, “pretty easily”), being able to use technology like yours, that’s sitting on the shoulders of giants. The giant shoulders, essentially, as you’ve said before.

[01:16:16.29] And hey, you don’t have to scale to a certain amount of people… If you have a billion-dollar company, if you have five or ten people, that’s pretty impossible. So I don’t know, I’m not sure about that, Sam. You’ll have to check your math on that one.

Jerod Santo: Yeah, exactly. It could be a different “It Depends.” But if you are going to test in isolation, it’s much easier to mock out if you have it, just the number of [unintelligible 00:33:14.02] down. And yeah, you can just hop off whenever you want. Now, I was actually thinking, while you were talking, of a funny – well, not funny-haha, but interesting case where I just recently tried to break the rule that I just laid down. And that is if the API or thing that you’re trying to use is so gnarly that I just don’t want to bother with its API. I really do want a wrapper in that case, and here’s an example.

Changelog Nightly, which is an old Ruby app that runs through a rake file - I mean, it’s just a Ruby app running through a rake file. Ruby 2.3. If you’re not familiar, it goes out to BigQuery every night, and it gets from GitHub archive all of the most starred repos in the 24-hour period, and stuff like that… And it sends an email out. And it’s been doing that dutifully, on a cron, for like eight years, to a few thousand people who are interested in like the bleeding edge.

Unfortunately, the bleeding edge right now also includes malware and spam. That’s one of my problems. And these people are good; they’re good, man. It’s been cat and mouse. But I was trying to modernize that and just bring it up to tools I can – because I can barely hack on it, it’s just atrophied so much. And in so doing, I upgraded from Ruby 2.3 to like three point - whatever is current. Three point one, point four, or I don’t know; something like that. And had to upgrade a bunch of gems. Everything was going swimmingly, until the BigQuery gem could not – it was abandoned, basically. The BigQuery gem was abandoned. And I was like “Alright, well, let’s go check out the Big Query gem and see what’s going on.” Literally no commits since 2019. So not recently abandoned. Like, long time ago abandoned. And it’s got some issue with Ruby 3’s TLS stuff, and cipher suites, and it’s like “Alright, I’m losing my interest at this point. Like, why am I doing this?” Anyway, so I’m like “Well, I’ll just talk to BigQuery directly.” And I did look at the code, and I was like “Oh, he’s basically wrapping some Google calls, and stuff.”

And then I realized that Google Cloud’s API has changed since then, and it’s deprecated, and stuff… And the modern way of doing it – I mean, it’s so painful to… I couldn’t figure it out. I mean, I didn’t give myself that much time… But I was like “Man, I wish I just had a new wrapper library that basically did what this guy was doing back in 2019, just for their modern stuff.” I would gladly grab that and use it. Because that cloud API, whatever Google designed over there - I’m not sure if you’ve ever looked at it… But holy cow, man, is it a beast. And I just don’t have any interest in interfacing to that thing.

Jerod Santo: [47:49] This one was dangerous, because it would scan every web page you were on. It was a Chrome extension that would just string replace straight up… And the phrase “the cloud” was used quite a bit, but not so much that you’d always recognize it. That’s the fun thing about it - you’d kind of forget that the thing was there, and then you’d see a big call-to-action on somebody’s marketing page, and it would say “It’s time to move to my butt”, or something like that. And then you get a laugh all over again, because you’d forgotten a little bit about it. But it was dangerous, because a lot of these times you’re browsing in a meeting, or with your boss, and you forget that the extension is there, and it can get real nasty.

I believe there’s a screenshot gallery. If you’re not so brave to install this one but you wanna check out some of the funnier cloud-to-butts, we’ll link that one up. PanicSteve links to it… It’s on Flickr, so that kind of dates the library as well, back when Flickr was the place you’d post these things. Nowadays it would probably be on Instagram… Safari version, Firefox version, Opera version. That was a lot of fun.

Meanwhile, Divya has found Thanos JS. There it is - a casual, but dangerous package that will let Thanos snap fingers and delete random files inside a directory. [laughs]

Solomon Hykes: Also, if you’ve signed up and you’re wondering why you didn’t get access yet, check your Spam box… Because it’s probably there.

Mat Ryer: Right. So it’s not just for learning only. But what I mean really is if you are gonna write a really simple program, I could see a case where you just use Try, because all you can ever be doing is returning the error, and you could write that program and maybe if you’re coming from a language with exceptions, maybe that would read in a more familiar way, and things. I mean, I’m just trying to explore that, because I personally - just because of the way that I do wrap, all over the place - I don’t think I would use try very often… And then I’m in this situation where, like Dave said, some of the code has Try, some of it doesn’t… And there’s a few other things that I feel like I would lose, as well.

Something that I noticed I do is the shape now of this little if err != nil check - when I scan through code, that tells me something about the landscape of this code. It really helps with scanning it, and I wonder if we’d lose that… I mean, if it was everywhere, I feel like it’s okay… But the fact that we’re gonna have a mix of it - I don’t know… It feels like multiple ways of doing something, and there are trade-offs.

Jonas Downey: Yeah, that’s right. We have a spam filter upfront, so known spammy stuff won’t even make it to the screener. It just won’t even see it. There is a spam box, so you can check that periodically to see if there’s something in there. On top of that, we do have some machinery to try to detect stuff like you’re saying, spoofed email addresses…

Alex Sexton: I don’t know if I’m answering your question directly, but if you’re building a website and you wanna make sure your website is secure, Mozilla Observatory is a really good option. It will scan your website, it will check your TLS certs (some of this is involved there) and then it will check content security policy… A bunch of different things, and it will give you a prioritized list of things to do. I would absolutely recommend putting any website you build through Mozilla Observatory to get that checklist, and score, and things like that.

Preston Thorpe: But yeah, when I came here, they have – believe it or not, actually, the state of Maine, and from what I hear, most facilities… It’s probably something that viewers will be interested to learn. They have quite a bit of internally written software by residents. That’s actually a fairly common thing. And I definitely was not aware of this prior, but the Main State Prison had a resident there that wrote pretty much all the software that it runs on to this day. So all the account sheets, the inventory for the woodshop, and inventory for the kitchen, and a system where you scan a barcode in the back of your ID, and use that to access your account to purchase things from the commissary… So there was quite a bit of this handrolled infrastructure at the other facility. And the administration here was aware that that existed. And when I came here, they had been made aware that I was someone that could replicate this. And definitely someone that could maintain some of this stuff here.

[01:10:04.06] So the system, the point of sale system that they use for the [unintelligible 01:10:09.08] is written in – it’s vb.net. Let’s say it’s VBA. Yeah, it’s definitely VBA, because it runs on Access, and Windows 8. So to this day I still maintain a point of sale written in VBA, on Windows 8, which is the absolute bane of my existence.

But yeah, so the staff here asked me to build a real-time – something to keep track of what everyone’s position in the facility is. So when you come back to the unit, you scan your ID, and it will check you in to the units. Because currently you have to sign out, and there’s people whose jobs it is pretty much to maintain these clipboards with everyone’s current location, so that if something happens, they have to count everyone, they have a record of where everyone is. So they wanted that built. So yeah, I built that RFID-based system; I made that pretty much production-ready. And that – they pretty much abandoned wanting to actually get it set up, because I think they were just… The guy who wrote all the previous software at the other facility ended up getting out, and now they’re in a position where they don’t have anyone to maintain it, and I think they’re just trying to avoid that happening here. But I’m actually pretty grateful that they had asked me to do that, because writing a full production front, full stack application definitely I think is being on the list of projects that I completed by myself. I definitely credit quite a bit of my ability today to that.

Johann Gyger: So we started to harden the pipelines. And a colleague of mine and me tackled this problem, and we thought about “Well, we’re already building containers… Let’s create those attestations, those manifests, sign them, and put them into a content registry as well”, and that’s what we did.

So we didn’t do this only with provenance from Salsa, but also for the SBOMs. If you have a look at vulnerability management, what you’re currently doing is you’re scanning your images, for instance, and you check it with a vulnerability database in one step. And what’s going on right now is this step is becoming two steps. First you create the SBOM, with all the components of your image, and then in a second phase you are scanning or checking against vulnerability databases. And this is a way more powerful possibility, because it gives you more options.

You can check for instance just the SBOM and check what’s being deployed in production; you just have to know which artifact is being deployed in production, you don’t have to scan it at runtime and then get the SBOM and check it against a vulnerability database.

Eric Bailey: Yeah. Yeah. I want to echo again your comment on like not knowing where to start, or like thinking like it’s too big… Another resource that we created is on the a11y accessibility project, a11project.com. We have a checklist, and again, this kind of speaks to my belief that this sort of knowledge you shouldn’t have to pay for. So it’s an open source free, relatively plain language breakdown of the web content accessibility guidelines, and it is presented in a checklist format. You don’t have to observe the checklist, but you can definitely scan through it… And that gives you a really good kind of like 10,000-foot view of things you should be on the lookout for as considerations for things like color, for things like hierarchy, and reading order…

And the whole goal there was to try to take this very dense, arcane, honestly, sometimes cryptic messaging when you read the letter of the law, and distill it down into something that a project manager can scan and incorporate into their acceptance criteria, or you as a developer can read and be like “Oh, okay. That’s what they mean when they say this.”

Break: [00:39:20.02]

Jerod Santo: It’s now time for Sponsored News!

3.7 million fake GitHub stars

How much weight do you put in a project’s GitHub star count? Probably too much…

Socket researchers have uncovered 3.7 million fake GitHub stars, highlighting a growing threat linked to scams, fraud, and malware, with these campaigns rapidly increasing over the last six months.

Based on this research, Socket is launching a new “Suspicious Stars on GitHub” alert that utilizes the low activity and clustering heuristics to detect packages associated with repositories that have fake stars.

if you want to get proactive alerts and check your entire organization for suspicious star packages (and 70+ indicators of supply chain risk), install the free Socket for GitHub app in just 2 clicks (link in the newsletter). Whenever a new dependency is added or updated in a pull request, Socket analyzes the package’s behavior and security risk, alerting you before any malicious code has the chance to land in your project.

Matti Ranta: Yeah, so we’re starting to deal with issues of like spam, more heavily involved DDoS, and file hosting, and virus and command control stuff on our site… We’ve had to build – I’ve built some automation around like detections… Because a lot of this [unintelligible 00:38:54.29] is pretty easily detectable. There’s patterns, and you can check out IP ranges against linked lists, and everything, to be like “Hey, this is kind of suspicious.” And everything [unintelligible 00:39:06.25] completely lock people automatically. But a lot of it is just from the software itself. We’ll send web hooks to our detection system on every comment, and feed it into our engine to be like “Hey, this is kind of weird. There’s lots of links in here.” Or we’ve looked at the link and the domain is like a malware link… Then we’ll like restrict that account, send a ping, and “Maybe take a look at this”, and… They won’t be able to like post anymore until it gets reviewed.

[00:39:49.20] And [unintelligible 00:39:49.11] web hook file to get scanned, yes/no, “Maybe somebody should take a look at it.” But some stuff that we’re discovering is being able to like put onto the roadmap of Gitea itself - detecting username or bio changes. Right now we have database triggers to be able to send “Hey, this has been updated” to our engine. But we’re using our experience on Gitea.com to feed into the software itself. Instead of having to have the trigger in the database [unintelligible 00:40:22.26] maybe build out web hooks for user changes. So if somebody changes their biography, their URL, it can get sent somewhere.

Jerod Santo: [00:11:55.00] So… Finding curators, and finding tastemakers, and letting them keep up for you. I mean, that’s kind of what we do with news. That’s what we’ve done for a very long time. Obviously, Tyler’s plugged into the Changelog already, so we’re not here to promote what we do necessarily. Everyone who’s listening to this already has found us, and is at least listening to a little bit of what we’re up to… But you know, find more people like that in different niches, and then let them do that work, and support them and what they’re doing. And that way you don’t have to. It’ so much easier than keeping up yourself.

Now, of course, you still want to make your own informed opinions about stuff, so sometimes when you find a new thing, you have to look into it. And maybe Jerod thought it was interesting, but he didn’t really dive into it. And you’re thinking, “Wow, maybe this is worth diving further into”, and so you go do your own follow-up, and stuff like that… But I don’t know, I think that you can also do that with individual blogs… I mean, that’s a lot of what I do, is I just read individual engineering blogs, and I find the stuff that I think is interesting, and I pull the thread. And I think that that’s manageable for folks via RSS, and not having to check it daily, or hourly, as we do with other things that we think are important… Like the Hacker News homepage - you pretty much don’t have to go to the Hacker News homepage, and you’ll be just fine. Let the Hacker newsletter come to you once a week, and see the best stories, for instance… Which - that’s a great aggregator of the top stories on Hacker News throughout the week. And then you just get it once on the weekend, and you can just scan that real quick, and be relatively up to date in that way.

Same thing with Peter Cooper’s newsletters… If you’re in Go, Golang Weekly, if you’re into JavaScript, JavaScript Weekly… I mean, he does a great job, and has for many years. I mean, how long has Peter been putting out those weeklies?

Andrew Atkinson: Yeah. I’ve heard that, and I think that’s what a lot of folks say, that if you don’t really know… And actually, I tried to directly address that in writing about the JSON storage options in Postgres when I was writing about that too, where it’s like - well, imagine there’s an example app for the book… And I was like, imagine you wanted to store a bunch of metrics about a new feature area, and you didn’t really know which metrics you would have, what their data types would be, what you might store as a value for those metrics… It’s kind of a mini-example, but it sets up – it’s using the JSONB column as a column, the data type within Postgres, which you can index, and you can get good performance off of for querying.

But you can also do things like - there’s an open source tool called JSON Schema Validation, or something… Now I’m kind of forgetting the name. But what you can do is, you can kind of do no schema, or NoSQL at the outset. You can just slam a blob of - as long as it’s JSON-compatible text, into a column. And then you can actually come back later and add type information and even check it automatically with a constraint. So you can say “Well, we actually have these few keys within here. They should have these data types. For any new inserts or updates or deletes, we’ll check them against this schema.” It’s sort of like a ninja move maybe, but it’s like “Oh, you want no schema? We can do that. And then we can add a schema later.”

sam boyer: I think that’s the thing from No Silver Bullet from up on 40 years ago… The No Silver Bullet paper, essential versus accidental complexity. What is necessary to the problem you’re trying to solve? What is an extraneous result of frameworks you’ve used, misunderstandings of the problem you were trying to solve, bad scopings, boundaries etc? And then yeah, how worth it is it to try to actually chase the essential complexity of any given problem? …which does suggest something practical, right? And it’s not groundbreaking, but understand your problems first, understand your users, make a reasonable guess based on what you know right now about what you think both the sort of essential nature of the problem you need to solve is, and what aspects of that are most likely to change. Do not get sucked into the rabbit hole, because you cannot predict the future, and don’t try. And then make an estimation about the quickest and dirtiest way that you can roughly approximate what you think that essential part of the problem is, that will fit inside of the time you have to solve it in… Times two, because - give yourself some buffer, because nobody can estimate. [unintelligible 00:36:35.08] And then go and make a thing, and get in the feedback loop.

Work through all of the different things we’ve talked about; look at the number of lines, try to organize things in a way that makes some sort of sense in your head, work on your instincts about why you would organize things together… Keep a notebook about why you chose to organize the things in the way you have. Or part of the documentation. Come back and check those assumptions later. As long as you take the outlook that achieving simplicity is an art, and not like a form of measurable engineering, I think it’s a lot easier, because then you accept that it’s something you’re going to work on, and improve, and hone your craft, and not this end outcome that has to be hit in every case.

Jerod Santo: It’s official: advancements in computer vision have rendered CAPTCHAs obsolete as new research shows AI bots are 15% more accurate than humans at picking which images have a [bridge|sign|bicycle] in them. The researchers recruited 1,400 participants to test websites that used CAPTCHA puzzles, which account for 120 of the world’s 200 most popular websites. The bots’ accuracy ranges from 85-100%, with the majority above 96%. We mere mortals check in at a pathetic 50-85% accuracy and we answer slower than the robots to add insult to injury.

I’ve surmised this for months now as we’ve been unable to ward off spam account creations on changelog.com no matter which shiny new CAPTCHA service we tried.

Adam Stacoviak: Yeah, the last time I installed Debian I recall getting asked to scan the system, I think, if I recall correctly. It was like some sort of request to say “There could be non-free software for you to install.” I think it was like a system check of sorts. They’d be like “Okay, do you have Wi-Fi and other peripherals that might need it?” And it’s an option to let me install it. Is that what you’re speaking to, just that angst of like, okay, Debian the base version is really like all free software, but you can opt into the non-free versions of firmware and whatever else might be needed?

Adam Stacoviak: Since we’re mentioning Changelog Nightly though, and the spamminess of it, I do want to highlight a spam situation, the most recent one… I think it’s actually a student, and the person’s handle on GitHub is rsriram9843. He has, or they have, I’m not sure their gender - Desktop Tutorial, Project 3, Project 1, Project 4, Develop Demo… So check those out. They seem to be pretty popular, because they’re in the latest Nightlies top new repositories. There you go.

Austin Gil: That’s a good question. So a lot of the OWASP recommendations are like obscuring file names, or not using the file names from the client, because that could use disallowed characters, checking file types, checking content, and the [unintelligible 00:59:38.03] or the MIME type of the file, and sort of like filtering that way, preventing certain file sizes… So if you have a system that’s like only scanning PDFs, you don’t need gigabytes of data… Versus an application that is going to be doing like video editing - you may need to support multiple gigabytes. So this is where you get into like more bespoke decisions around what your application is.

But ultimately, you can have malware scanners running. Like, basically receive the file, write it to disk, run a scan on it, but that can take a long time, and therefore you can’t really build a system that does that within the request/response cycle, because a request and a response has to be quick. Basically, just the time it takes to upload it, and then I need to know that it’s there. So you would want to build some sort of background process that then requires a database, that keeps track of all of the metadata about the file: the file name, where it exists on disk, what the MIME type is, and then some sort of other information of whether it has been scanned or not, and then you’d have some sort of background process that says, “Okay, check the database, look for the files that have not been scanned, pull them off of their location, download them, scan them if they’re good, put them back, mark them as green…” And then this kind of comes back to “Are you going to be presenting these files back to a client somewhere?” Because if you are, you want to be able to upload those files, you want to be able to tell people that their files are uploaded, and you have a record of them; so you might show that to people on the frontend. But if they have not been scanned, you want to show them the metadata, but not provide a link to download that, because you don’t want to – even if you protect your system, even if malware gets into your system and you have a way of quarantying it – quarantining it… [laughs]

Justin Searls: I think there’s a couple worthwhile reactions. One is, when we say multiclient, we’re mostly talking about phone apps. And the industry has changed quite a lot since the app stores were new, where to build any application at all would have required not only an API talking to native Objective-C code, or Java, and Android land… But it would have to really sip the data, because the computing constraints were so narrow. And now we’re in this other world where, if anything, with tools like React Native, and with the advent of much more mature UI frameworks for those different clients, I’m not as concerned as I used to be about that exact question. It was something I worried a lot about in 2014, when I was thinking about when you need an iPhone app, because everyone was like building those, and now what it is is “Oh, it turns out that we can actually run pretty far afield with just responsive web design and a mobile website.” And if you need an application – nowadays when I talk to clients or prospective clients for Test Double, it’s almost always not that “I need my entire gigantic website of 800 controllers and every single thing that you could possibly do through the web”, it’s “I have a very specific use case, where these people who are doing site inspections need to check for these particular things, and they need to be able to scan barcodes really quickly, and they need to be able to do this or that.” And so the scope of functionality that’s needed by mobile applications tends to be much narrower, and it tends to come much later in the lifecycle of applications than it did 10 years ago.

And you asked me a bit ago, like “I seem to be coding a lot. why is that?” One big reason is I’m not a believer in progress. I’m not a believer that this industry is getting better over time, and like innovation is happening… Because when you’re outside tech, everyone’s like “Oh, look, we’re getting smarter and hotter all the time. And all these new technologies are coming out. It’s great!” I honestly feel like in many ways the industry has regressed since I’ve joined it. And it’s worth thinking about, when we ask questions like this one, of - that may be what Tom shared is completely conceptually true, but I think the industry has changed where now the likelihood that you’re going to need to build both a web client and two native mobile applications, and maybe some third client, on day one, or near day one, with full-fledged functionality - even as I say that, I struggle to even think of like how often I’ve seen that in recent years.

And so I would instead say - if somebody had that consternation or that frustration, I would say, “Well, if you’ve got a small team, and they’re careful, and they’re experts…” For example, when I do a Rails application in this way, the controller is kind of the controller, in terms of my search feature is going to take a query string from users, and then it’s going to go and figure out what are the results, and then it’s going to call stuff that does all that hard work for me, and then the last little line is just going to like render a template from that piece of data… And I could just as easily respond to a JSON format, or header, and just convert that to JSON and have like a quick presenter just do that. And in well-factored Rails applications - well, yes, building the whole separate API as a bunch of separate endpoints really never works, because you end up with two code paths doing the same thing…

[40:10] If you’re really careful about being rigorous in how we structure the data that flows into the templates, that data - the controller and the route is asking the same question. The inputs are the same arguments, that might modify the answer… And then the answer is factored in a way that’s like - it’s the same answer, it’s just different shapes to present it to the client.

So I’ve had really good luck of doing exactly what you’ve struggled with, and I’ve seen a lot of teams struggle with, of just “Okay, cool, well this particular set of routes needs an API response now, so be able to respond to JSON requests, as well as to web requests.” In fact Turbo, which I’ve been talking about, has a Turbo stream feature, where those action cable little partial page snippets are also just another kind of request, right? It just goes through the same templating, it’s just that it knows it’s only a document fragment, instead of the whole document.

So that’s, I think, more functional than going out whole hog on day one and saying “You know what - we just need a full­-fledged API.” It’s just like saying “We need microservices on day one”, or something like that, “because we’re afraid that in the future we’re gonna have more complexity.”

Jen Looper: Yeah, there’s a lot you can do in open source. I’m hesitating on this question because there’s this push for a lot of communities to go forth and contribute. And it’s like, the amount of spam – because I manage these huge repos now on the Microsoft account, so that’s a big, prestigious thing, to have your contribution accepted into a Microsoft repo. That’s nice. But things like Hacktoberfest… Fortunately, they allowed us to opt in and opt out of Hacktoberfest, but it’s extremely rough for maintainers when we get loads and loads of low-quality contributions.

What I’ve pointed people towards is looking for folks who are looking for translations. Our Microsoft student ambassadors are from all over the world, and they’ve been really helpful in helping us with translations on our curricula. So that’s a nice way to contribute. Or to go and do a check review of it, and put your name on it as a reviewer. Or to help us write some of those quiz questions, those kinds of things.

So I think open source contributions are awesome, but you kind of need to look for where your help is – I wouldn’t say needed, but where people are looking for help.