Carlisia Thompson: I know, I just can’t help it. Everybody is so excited and doing such hard work. Sponsors are welcome. It’s going to be a great way to reach awesome developers in Brazil. What else? We expect 300 people, we can even fit more than that, but we think 300 will be easy to get.

[44:00] CFP is open, the registration is open, the sponsorships are cheap, cheap, cheap, cheap, cheap, because it’s a small conference and the exchange rate is crazy. So take a look at the prospectus. Support is so appreciated and needed, especially for this first one. We really wanna set the standard for it to be a yearly event and a technical landmark in the tech community in Brazil.

Adam Stacoviak: I really don’t know if – I’m on the fence. I don’t know if it would improve your business based on what I know about it. It would probably just be more headaches. If it were me, the way I would consider it isn’t because it was my dream to host the place someone goes when they have an idea, to figure out which domain to buy… That would be cool as a standalone thing. But I think I would do it, if I were in your shoes, if it raised the bar of my awareness… And even if I only broke even on the registration thing, does it help me address a bigger market? Because more people come to me. And there’s lots of enterprises out there, and you’ve already crossed that chasm from engineer to enterprise… So you’re looking to get other customer types in there. To me, that would be one way you do it. It just draws more awareness.

Dan Moore: Yeah, I mean, there’s definitely – there’s a couple of kind of things to think about with passkeys. One is how you set them up, first of all. The registration process is a little bit weird, and can kind of differ… And depending on the passkey, it might be tied to a physical device, it might be tied to an account. If you’re worried about people correlating things across like OAuth, or OIDC, the same thing is happening with passkeys that are shared. Or if it’s device-specific, then now you’re kind of tied to the device. And then kind of – I think the user experience for actually logging in is pretty good. It does – you don’t have as much control as the thing that you’re logging into; the app you’re logging into doesn’t have as much control over the look and feel, or the messaging, or anything like that… And that can be problematic, too.

[00:38:05.01] But the beautiful thing about passkeys - they are locked down in two ways, right? They’re locked down to the device or the system that holds the private key, that is actually kind of generating the challenge, and like solving the – basically… I can walk through kind of how passkeys work if that’d be helpful… But anyway, there is a private key that is held someplace, and that is what’s used to kind of authenticate you. And they’re also locked down to the domain. They’re associated to a domain, which is really, really great too, because it removes all kinds of phishing problems. Because you’re trusting the computer to recognize the domain, rather than the user, looking at the UX or looking at the URL bar.

And computers are much better at comparing character by character, and making sure that things are all correct. So there’s two kind of security benefits for passkeys, for sure.

Rachel Plotnick: January 31st. It’s at 2 p.m. Eastern. If you just search for “Rachel Plotnick and energy drinks”, it should come up and you can find the registration… It’s free, but we’d love to have some people join.

Adam Stacoviak: While we’re at it, let’s give away 20% off. If you’re thinking about going to All Things Open, you can go to the registration site and use the code mediachangelog20. And then we have some free passes, Jerod…

Jerod Santo: Display custom maps on your website for free

OpenFreeMap takes map data from OpenStreetMap and serves up the necessary tiles (in various styles) for anyone to render them on their website (or app) for zero dollars. Kinda amazing:

Using our public instance is completely free: there are no limits on the number of map views or requests. There’s no registration, no user database, no API keys, and no cookies. We aim to cover the running costs of our public instance through donations.

That sounds almost too good to be true… and it is, if nobody steps up with recurring donations. However, the service’s creator, Zsolt Ero, has taken a few steps to make sure it’s not prohibitely expensive:

There is no tile server running; only nginx serving a Btrfs image with 300 million hard-linked files. This was my idea; I haven’t read about anyone else doing this in production, but it works really well.

There is no cloud, just dedicated servers.

Justin Garrison: I mean, it shifted it to domain registration, right?

Jerod Santo: It’s now time for sponsored news!

Intel Innovation 2024 – Accelerate the Future!

Registration is now open for Intel Innovation 2024 in San Jose, CA!

This event is all about you – the developer and technologist community – and the critical role you play in tackling the toughest challenges across the industry. Ignite your passion for AI and beyond, grow your skills to maximize your impact, and network with your peers as we unleash the next wave of advancements in technology.

Hear from industry experts, technologists, entrepreneurs & fellow developers along with Intel leaders:

• CEO Pat Gelsinger
• CTO Greg Lavender

Don’t miss early bird pricing! It ends August 2nd. Register today using the link in chapter data and the newsletter and thank you to Intel for sponsoring Changelog News.

Ron Evans: It is February. It takes place at the campus of the University of [unintelligible 01:38:34.01] in Brussels. It’s kind of an anarchist conference, by which I mean there’s no registration. You just show up. So the organizers, the way they organize it is each room of the campus - you pitch. They take pitches for subject areas. Like, there’s a Go dev room, there’s a Rust dev room… And once they choose the subject areas, each one of those sub-organizers is 100% responsible for choosing the speakers, organizing them, making sure they do their thing… It’s 100% on them. The campus - they have streaming A/V. They just provide that, running throughout the day, from volunteers. There’s no corporate sponsors… It’s like a social anarchist conference, and it’s really quite amazing.

A lot of people who are maintainers just show up there and hang out. The hallway track is incredible. I’ve never even made it in the Rust room, but I’ve had the most amazing conversations with people waiting to try to get in. So I highly recommend FOSDEM. Also, the night before it begins – it takes place over the weekend, Saturday and Sunday. Friday night, traditionally they have an opening party at the Delirium Brewery, which is a classic Belgian trappist brewery, famous for the Delirium Tremens ale. So there’s people I would only see at that beer event. Like Charles Nutter.

Adam Stacoviak: Are these things that the Linux Foundation – I mean, obviously, Debian is Linux, so is this something that the Linux Foundation themselves can provide? I know they have a ton of attorneys that are involved, and that sounds like an attorney challenge, really. Attorneys tend to do business or corporation legal agreements, obviously, registration in certain places, or at least assist in that advice. Is that an opportunity for you all to leverage?

Damien Riehl: So I will say - and anyone who works with me will agree - that I am a coder, but I’m a crappy coder. I’m probably one of the worst coders you’re ever going to meet. So a lot of my work with large language models is in the textual area, rather than the code area. But in the textual area - I’ll give you an anecdote that answers your question. I was reached out by the editor of a large legal magazine to say, “Hey, Damien, I want you to write the cover story on GPT.” I said, “How long do you want it to be?” He said about 17 double-spaced pages. And I was like “Man, I don’t have time”, because my rule of thumb is one hour per double spaced page, so that’s 17 hours that I just don’t have time to do.

But then I realized, “Oh, wait, the topic is GPT.” So what I did is I created an outline of headings and subheadings, that’s about two pages worth, and I said to GPT “For each of the bullet points, give me four sentences.” Essentially, a paragraph for each of the bullet points. And it sh*t out – that was my one for the day – crapped out the 15 pages worth And then I spent the next three hours editing, moving, adding, working with the text; not accepting the 15 pages outright, but working with the text and regenerating, and then I got it out the door three hours later, and the editor is like “Oh, this is perfect. I don’t need any edits, let’s get it out the door.” So that took a 17-hour project down to three hours.

That’s thing number one, is that this is not just accepting the machine output as is, but it’s really us using the output as an assistant, much like Copilot on GitHub is using it as an assistant. These are essentially pair-coding, if you will, co-authoring with the machine.

I was doing a talk with the US Copyright Office Assistant General Counsel, and he was talking about the regulations that they’re putting out, saying that if machine-generated, therefore uncopyrightable; if human-generated, therefore copyrightable. And if machine-generated, you have to be able to disclose what aspects of the thing is machine-generated.

[13:48] So if you think about if I were to file a copyright registration with my article that I just drafted, what extent was that machine-generated, and what extent was that human-generated? Because I spent three hours adding, editing; if the machine-generated in a sentence three of the words that were unmolested by me, the other 20 words in the sentence were actually mine. Do I have to disclose what three words were machine-generated, versus the ones that I edited? And that’s with text. How would I do that with music? If I said to the machine, “Hey, generate a melody, and generate a chord structure, and generate lyrics.” And then I spent from 1 AM to 3 AM rearranging all those things, and then getting it out the door, if the copyright office said “What aspects of that was human-generated and what’s machine-generated?” I would honestly say, “I have no friggin’ idea, because there is no track changes with my DAW that I make my music on. There’s no track changes, I didn’t track changes on my lyrics that I messed around.

So I think this idea of trying to bifurcate what is machine-created and what is human-created is a fool’s errand, and we’re really going to have to reckon with that.

Ronna Steinberg: But the criteria based on which the committee ranks applications - what we try to do in the end is sort of… So to change the makeup – I think we can all agree that to change the makeup of the community, especially the Go community, but the industry, we’re going to have to bring new people in. Because right now, it’s not diverse. So we’re going to have to bring new people in, and we’re going to have to create opportunities for people to also grow. So that means that – and I think it’s kind of like implicit then that scholarships, or our scholarships at least, they go to people in different stages in their life. So we have seniors, and we have people who are beginners. We try to sort of bring a mix, a good mix of people to really create these kind of opportunities that people need. Obviously, 10 people here, 10 people there, that’s not going to dramatically change the industry.

What I try not to do is to sort of create this kind of pressure on people that essentially says, “Okay, we’re going to invest this in you, but you’re going to pay us back.” I said this before – well, I wrote this before, and then Natalie read it out loud, that “I am the sum of all the opportunities that were given to me.” I’ve been around this industry for a while now, and I feel kind of ancient in that.

I used to think that I was very talented. And the truth is that I’m okay. Probably maybe slightly above average, I don’t know; on my good days. And my bad days are horrifying. Don’t get me started. And the truth is that so many things would not have happened the way they did if certain things that have happened to my friends, or have happened to me, or certain things that happened for me didn’t happen. There’s so many small things. I didn’t even sign up to study computer science, and I was accidentally accepted. I don’t know, there was a problem with my registration. Apparently, I submitted that I apply to both math and computer science. I didn’t even plan to do this with my life. And then my mother saw that I was accepted, and then she was like “Oh, my daughter’s going to study computer science.” And that was it.

Zach Latta: Yeah. Well, so Hack Clubs are groups of teenagers that get together weekly, after school. Usually, there’s like 5 to 15 teenagers in each club. And the purpose of these is they’re like mini-hackathons that happen every week at your school. If you’re a teenager and you want to start a club, you just go to hackclub.com, there’s a whole registration process; we really work with everyone who wants to. And we have what we kind of call internally like a “club in a box” setup, where there’s a whole set of open source materials that range from workshops that you could do inside of your club meetings, to marketing materials, we print millions of stickers that we ship to clubs all over the world… And if you do this, you’d be joining this global community of other clubs all over the country, all over the world, who are all on the same mission as you.

I think that for a lot of teenagers, you don’t really know other people that share your love and interest for technology, or maybe if you have that first spark, you don’t really know what that best way to get started is. And we really believe in the hacker way, which is that if you want to learn how to code, the best way to do it is just to start writing code. And I think that a lot of kind of education programs around technology can try to be very elite, where Hack Club’s not elite at all.

[46:15] We don’t believe anyone is born with some special abilities that make you better at coding than others. We think your ability as a coder is just a function of how many hours you spent coding. And if you start a club or you join a club at your school, or come together weekly, every week you’re writing code for at least an hour - that’s a great entrypoint into the broader Hack Club ecosystem.

And the reason why we have all these other things that are happening in Hack Club too is that if you’re a club member it’s not super-exciting just to come together weekly, and you write code with the same group of people. You want to feel part of something a lot larger than yourself. So if you’re part of a club, you’re going to hackathons happening near you, there’s online stuff you’re participating in… Kind of a whole gamut of stuff. But the best way to start is just go to HackClub.com and check it out.

Mark Bates: Yeah, because you’ve got this weird system for registering code… Where what it should be is - if you’re gonna make me register at the package level, then give me a function or a method, the call that would return an error if there’s a problem with the registration. Right?

Mark Bates: Yeah, because you’ve got this weird system for registering code… Where what it should be is - if you’re gonna make me register at the package level, then give me a function or a method, the call that would return an error if there’s a problem with the registration. Right?

Miško Hevery: Yeah, so people very much think in kind of classical ways. A typical example is suppose I want to have a mouse move, I want to track the position of the mouse. The way you would do it in a classical framework, you’d say, “Oh, okay, so I’m going to create a use effect, and inside of use effect, I’m going to say document.addEventListener mouse move.” And you can do that in Qwik; that totally works. But if you think about it, that’s not what you want, because now you’re like eagerly executing code on application startup. Instead, what you want to do in Qwik is you want to say – you want to run the registration of event listener on the server. And to most people, that’s like “What are you talking about? You can’t do that. That’s in the server. There is no DOM. We’re doing SSR, that can’t possibly be done.” But the framework knows how to serialize these things, and actually, it can be done on the server.

And so people end up writing code that is idiomatic for other frameworks, and it just happens to work inside of Qwik, but it’s not performant. Because they’ll end up eagerly registering all these listeners, and pulling all the code that’s unnecessary. And so a lot of issues is like, well, you’ve got to think like Qwik, which means “Can we offload many of these things to the server side?”

The other thing that people are kind of surprised with is that all the other frameworks have these expectations, that “This is the server code, and this is the client code, and the two should never meet.” So you have to separate it in separate files etc. And so because people are already pre-trained with this mental model, when it comes to Qwik, they’re kind of confused… Like, “Wait, where do I put the server code? Where do I put the client?” Well, just put it in the same place, and the right thing will happen. And then they’re like “Really? That seems strange. I don’t expect that.”

So some of this is just behavior that they’re just preconditioned with from other technologies, that they have to kind of unlearn, so to speak, to kind of understand “Oh, the mental model is different. It is not my application running on a server, and then a separate thing running on the client. It’s the application starts on the server and then it gets moved over.” And so a lot of times people will try to do things like, say, you run this code on the init phase of the component, and they’re surprised why it’s not running inside of the client. Because, well, the component [unintelligible 00:45:09.24] on a server, not in the client, so the constructor no longer runs on the client. And because they’re used to the hydration world, where all of the components reconstruct themselves on the client, they’re kind of like “Well, why isn’t this working?” It’s like, “Well, because resumability.” We are instantiated on the server, and we continue running on the client, without reinstantiating everything on the client again.

And so there is a little bit of learning that has to happen… But once you kind of get that mental model, it kind of totally makes sense. Like, “Yeah, of course. We started on the server, then we moved to the client, but the server one was the one that instantiated the component. The server one is the one that registered the listener for the mouse move, and so the client only downloads the mouse move code if you actually move the mouse. If you don’t move the mouse, then no code gets downloaded.”

Gary Bernhardt: So going through those same things in order… The primary database is Postgres. I do love Postgres. It’s great. The backend servers are at Heroku, and they are a single-process, monolithic, one repo, one service. Fixed number of dynos though. We don’t bother with auto-scaling; we just have a bunch of headroom. The thing is quite efficient. It doesn’t need to auto-scale.

So here are the things that are actually different. Everything else is different. There is no queue. There’s exactly – there is a worker process. There’s exactly one worker process. Never zero, never two. I mean, it could handle – it wouldn’t be bad if there were zero or two, but there’s just always one, just by convention, I guess. So no auto-scaling or manual scaling on that. No queue, I think I said that…

[19:55] So the way that the worker works is that every hour it wakes up, and it sends some reminder emails and does a little bit of housekeeping related to building stuff… And then it just sleeps; it just sleeps for an hour, and then an hour later wakes up and does it again. So what that means though is that a lot of things that are often put into queues, things like sending an email, or anything you wouldn’t want to block the request flow - we just let those block.

For example, when you register an account, you don’t see a success message until the API backend has sent the confirmation email to our email provider. And it’s fine. Like, nothing bad happens. And this means we avoid all the problems with queues, like operations getting split into pieces, the before queue and after queue part, backpressure management, and migration problems where you change the data format of a queue entry, but there are potentially queue entries live in prod when you make that change… None of that stuff exists.

So whenever I explain one of these lies, I want to show the trade-offs that we could have, made versus the trade-offs that we actually did make. So the bad trade-off that we could have made was to think that we cannot suffer an extra 50 milliseconds of blocking registration or a few other infrequent operations. Also thinking we must gracefully handle any failures in our upstream email provider and be able to retry from the queue. And so we have to have a queue and workers to process that kind of stuff. But the good trade-off that we actually made is I don’t care. The users can wait 50 milliseconds, it’s fine. It’s registration. I wouldn’t do that on every page load, of course, but it’s fine. And in three years of commercial operation, our upstream email provider has never had an outage that caused them to reject an email that was going out. We’ve had like spam marking problems and stuff, like everybody does, but we’ve never actually had a problem because of this.

Jason Pearl: [44:00] Network load balancer registration is slow.

Nick Nisi: [laughs] What I did was I basically started at the front. I started at the registration desk, basically, where everyone comes into the conference, and just kind of did a walkthrough of, you know, showing them the vast hallway track, zig-zagging through that. And along the way, I was kind of hoping to run into, serendipitously, attendees and organizers and speakers. And because I was like, you know, I was just doing it and I didn’t really have anything planned in terms of like “Okay…” There was no plans, like “You stand here, and I’ll randomly run into you and talk to you about this.” I was just like going up and accosting people with a microphone, asking them some questions.

Frank Krueger: Well, it’s also neat to see it from a few perspectives. Going back to that LiDAR scanning problem I mentioned - a big step of that is the marching cubes algorithm, which turns voxels into a mesh. And it’s a pretty standard algorithm. There is one standard form of it, and then there is an improved form of it. Everyone implements the improved form of it. But it’s a little bit of hard code to read. It’s just written a little bit funny. I think the original is in C, but it’s a funny dialect to see… And it’s really fascinating to see other people’s translations of it into other languages. You can tell they copied it, but they modified it a little bit. And so I would look at the JavaScript version of it, the Python version of it, the C++ version of it, all these just to get a general, “Oh, okay, this how it works, and this is how I’m going to make my version”, yet another variant on it. But again, that’s almost rote work, too.

[52:12] I worked on that code because I was pretty confident I could find resources for it, when I was ignoring a much harder problem, which is the image registration, where all the images have to line up… Because that’s a much, much harder problem than this other one that’s been a known technique since the 1980s. And so it was fun to just spend a couple days working on a 1980s algorithm while I percolated the thoughts in my head for the other one.

Natalie Pistunovich: City registration and all the bureaucracy… That is a serious contract with them. They will not upgrade to a version two… [laughter]

Paul Jolly: [07:58] Yeah, the wiki that I referenced earlier on has got a – “mandate” is a very strong word, I think, and it sort of has connotations of power and clout… And the Tools Working Group has never really existed in that format; it’s been people who are interested and motivated to talk about tooling and improving it, getting together and working out how best to solve some of the technical problems, and also solve some of the problems around how to build consensus on the direction that certain things should take, whether it be modules or anything else, for that matter. We can talk about a few more examples later on.

So mandate is probably a little strong, but at the same time, charter is probably a little strong as well… But at the top of the wiki, to paraphrase it, is a group of people whose focus and interest is the development of tools for the Go language… And it stresses it’s open to everybody. Tooling topics include, but are not limited to code analysis, compilers, editor and IDE, plugins, language servers and standard libraries. So it’s really, really broad. And quite honestly, we’re never limited to that, and if anybody brings up a topic that they want to discuss, we’re super-open to that. And often, the group just ends up being a conduit for introducing people or bringing people onto the session in order to have the right conversation. So there’s lots of things, whether it just be getting feedback on ideas…

The Tools Working Group has been used as a group of trusted testers in the past, for whether it be Google or Go related projects, or others, for that matter… Just things like proofreading of proposals, blog posts, talking through design ideas… It’s a very, very open agenda, and open to absolutely anybody. There’s absolutely no registration or anything required. You just turn up to the call and join in.

Aaron Parecki: But it is always a good idea for every kind of app to use PKCE. I do get a lot of people confused - because of the origins of PKCE - about whether you should use PKCE if you have a client secret, for example… And it turns out the answer is yes, use PKCE even if you have a client secret, because a client secret is not solving some of the attacks that PKCE does solve. So it’s not a replacement for a client secret, it’s not an alternative, it is just how the authorization code flow should work.

Now, the client secret issue is how do you authenticate a public client, like a mobile app, or a single-page app? And the answer there is you can’t. There is no way to do that, whether or not you’re using any OAuth flow or OAuth at all; so you just don’t, and you rely on the redirect URL and the registration of that, and the fact that domain names are the other foundation of our security online, and that’s enough protection of those kinds of apps.

The main OAuth flow today is authorization code flow with PKCE, and use that for everything unless you have a very specific reason otherwise. The other flow to be using would be the device flow, which is an extension, and that’s what you’ll be using when you’re on an Apple TV, or other devices that don’t have a browser or don’t have a keyboard.

Then the third sort of – I don’t wanna call it a main flow, but the third flow that will be commonly used as the client credentials flow, where it is an OAuth client that’s not acting on behalf of a user. It’s just the client acting on behalf of itself. So there’s no user involved in the flow. It’s just the client shows up and says “I want an access token”, and then it gets one.

Mark Bates: As somebody who’s, again, written these types of tools, I also look at that as a marker… Like, before I go and start parsing this whole Go file, are they even used in the package? If they’re not using embed, why should I bother to parse this? So that to me is less egregious than setting the registration of a database driver.

Mark Bates: And a lot of people don’t think or consider what does registration mean for the conference organizers. When you get there, they often offer off-peak times to do registration sometimes; usually the day before, or whatever. Try and take advantage of those, because that not only makes it quicker for you to get in and out, but also it kind of flattens that curve of a rush of people at 8 AM coming in and trying to do it. And try to get there early. Try not to wait till five minutes before the keynote, rushing in… I mean, this huge wave of people assaulting the staff. It’s hard to take care of that many people, especially 2,000 people. Imagine checking in 2,000 people. That’s a lot.

Josh Aas: Right. So it just turns out not to be very useful. And also, there’s a lot of issues with how it’s validated. In domain validation, where you’re just proving control of a server before you issue a cert, there are pretty clear and strong ways to do that validation. When people do identity validation, it basically involves phone calls, and faxing around document copies of your articles of incorporation, and copies of driver’s licenses, and stuff like that. It’s easier to mess with.

Pretty famously, recently someone registered Stripe Inc. in some state that’s not where the normal Stripe payment company is… And since registration of businesses is by state, they had an EV cert that they had Stripe Inc. Obviously, that’s not what you’d expect, but it’s not a bad cert. They legitimately did own Stripe Inc. in North Carolina, or wherever it was that they did.