Is this a stab at the fact that there's no hashing? Or that the credentials are pointless when you could just generate a random url to authenticate, since the HTTP channel is encrypted anyway?
On the bright side, this project acknowledges the killer issue with these kinds of marketplaces: scalably managing quality, scope, and disputes.
But on the other hand, I see nothing but assurances and a woefully low cut that I can't imagine could keep this train chugging without shoveling time (=money) into the furnace. At ~$140 revenue a pop, if even 4% of projects go off the rails, the "insurance" policy already puts the company in the red -- forget profit.
There is a huge problem to solve here, for sure. I want someone to solve it. But I'm not seeing a solution.
Perhaps it's worth considering that maybe the reason that checklists aren't the norm in the FOSS "meritocracy" is that they hinder progress, for a certain value of progress. Maybe there was a stealth project that could have been OpenSSL, developed with scrict adherance to checklists, but OpenSSL won because it didn't have that burden? I suspect this applies more broadly to startups, too.
Maybe checklists are a silent killer in the natural selection of the software ecosystem, and that's why so much of our software is tripping over peacock feathers?
First, in the real world private registries are used for builds containing source, sensitive keys, and so forth. There is a use case here.
But second, no enterprisey company will use a service that bills like this, because
-$4 and $250 per month all rounds down to zero, so it's not a selling point
-$4 signals no support when the shit inevitably hits the fan
-$4 signals this company will tank along with your data in a month
An enterprise company with actual money will take an hour or two of dev time to boot up one of the open source registries (https://github.com/dotcloud/docker-registry) and stay in control.
Source: working at a Docker startup for almost a year
Because space isn't this thing where you eject stuff like a garbage chute.
I recommend reading up on rocketry, orbital mechanics, and modern space programs because a) it's really cool stuff! and b) you'd quickly realize how ridiculous, dangerous, and counterproductive this suggestion is.
Just classic marketing psychology, of the "stopped beating your wife yet?" variety. By pondering why Google missed the forecast you automagically dump the blame on Google instead of the shitty forecast.
Vocab is hardly more twisted now, though; journalism has always chosen its words deliberately.
Except the cups must be recycled where you bought them, and when they accidentally turn out to be super toxic Bob insists the recycling fee was clearly posted.
I don't know who's right here, but it's definitely not that simple.
First off, TLS is crypto bread-and-butter that's used for a lot more than HTTPS. You're not out of the woods because you're not running a webserver.
Second, SSH itself doesn't use TLS; it has its own protocol, so sshd isn't vulnerable.
But third, read overflows like this can be escalated in countless ways to total compromise if some credential, key, canary, or such gets leaked. So just because sshd isn't vulnerable doesn't mean you're not screwed.
I won't speak to this particular case, but look at the incentives for any service that stores people's coins:
-You can cash out (steal) an arbitrary amount of people's coins, blaming it on a "hack". If technically competent you can make it look as legitimate as you like, even giving a detailed post-mortem.
-This will probably tarnish your operation and possibly your internet rep if the Google juice flows that way.
So how much is your internet reputation worth? Personally, there's probably a number that would sway me.
Until these incentives are changed somehow, with regulation or otherwise, it will happen.
Your comment demonstrates how monumentally "The War on Terror" has failed, now that people have been so thoroughly terrorized that the most available explanation for a plane disappearing has become "terrorism".
It's less incredible once you come to terms with the fact that like so much "zero-tolerance" emotionally charged legislation its role is to be a political gun that doesn't require the ammunition of justice or reason to function. "But he's a child molester!" is all you need, logic and facts be damned. What's worse, is it's impossible to get rid of these laws because anyone who tries can easily be branded as a <insert evil demographic> sympathizer.
As unsurprising as it is that these laws exist and continue to do so, it's still utterly horrifying when you realize it's combined with indiscriminate data hoovering for later use.
I don't think there's any solution but to stop reacting emotionally to terms like "child-molester", "murderer" and "terrorist" and instead think critically about the deeper reasons behind why people do what they do. I'm doing my part and I encourage anyone reading this to do the same.
End-user Windows licenses haven't been a significant source of income for Microsoft for a very long time. They make their money from their enterprise ecosystem, and end-user Windows serves only to support that ecosystem.
So unfortunately, I hate to break it to you that as an end user the money you're giving Microsoft for their products never gave you control.
But on the bright side, pissing off the end users that provide sustenance and influx for their volume-licenses cash cows doesn't serve Microsoft's bottom line either. So even if you pay nothing, your usage of Microsoft's products is very much something Microsoft would prefer to continue.
Having been where you've been, may I suggest that the dealbreaker is that you're treating dating like a World of Warcraft inventory checklist? I wish someone had told me that when I was saying the same things.
This only works if you stick with every partner long enough to get a perfectly accurate assessment of them as a long term mate, that your assements are perfectly objective, independent, and stable, and that you know n.
The amount of ifs, ands, and buts in this caveat means it's time to defer to one of my favorite xkcd's of all time. [0]
This thing is dead on arrival. Unless I'm mistaken it's not open source, so the main draw of node (unrestrained hackability -- see npm) goes out the window.
The touted benefit is marginally increased parallel performance, but even if you buy this (I don't), the best case scenario is this buys you a slightly decreased server bill for the price of closedness, lock-in, and compatibility headaches. If your code shards horizontally like this then you can already trivially parallelize and shard across servers with first-class node core clustering.
I spend most of my waking hours writing all sorts of crazy things in node, and I still can't think of any scenario in which using this makes sense.
Although contrary to popular belief Gox was never a Magic exchange, they were a Bitcoin startup at a time when Bitcoin was not much more than internet lols and pizza deliveries. The first thing you do when hacking together a stupid exchange for a joke e-currency isn't writing unit tests. You just write the code and blast it up on a domain you had lying around for a different project.
Cue runaway success, a company sale or two, scaling issues with complicated technology and not much precedent legal or otherwise, and this is what you get.
There is nothing at all surprising about this code. And it seems Gox's problems were much more deeply rooted than the subjective non-compliance of their code with "best practices".