I've used apistar quite extensively in two different projects (one launched) and so far I like it.
One disadvantage is you can't use wsgi middleware, but after rewriting our middleware to components they ended up being much neater. I'm a fan of the bottom up approach where you define the components you want in a route. We have some routes which just returns the database query and with a custom renderer it will get rendered in the json format we expect
We use different files for "soft" requirements, dev/test requirements, and a freeze.txt containing all production requirements and then we default to installing from freeze.txt but can update from the other files. It's similar to this[1] but generating the freeze.txt in a temporary virtualenv.
I've started using an generated offline cache and PIP_FIND_LINKS to remove the dependency of pypi for known installs in one project as well, will be interesting to see if it turns out to be a good idea or not.
This is funny, I've actually inherited a project where the original developer had this idea, he used the same function to encrypt everything: even the news posts available on the front page were encrypted. The passwords were using the same encryption functions and needless to say not using a one way hash so fully decryptable...
At home I use Dropbox for some files and Resilio Sync for others
At work we make heavy use of version controlled configuration management where we can recreate any machine from just rerunning the ansible playbook and duply backup for databases and other storage.
While duply was trivial to set up, nice to work with, and much more stable than any other solutions that we were using previously if I were to do it again with more than a handful of machines I would have likely looked into reversing the flow with a pull based backup just to have a better overview since I don't trust a `duply verify` monitoring to catch all possible issues.
Cloud backup is managed by a server fetching the data and then backing it up with duply.
We also run a rsync of all disk image snapshots from one DC to another (and vice versa) but that is more of a disaster recovery in case our regular backups fail or were not properly set up for vital data since it would take more effort to recover from those backups
While I agree with you I'd like to caution some users about rushing into dockerising everything in their production environment. If your environment setup is not repeatable and you don't have your configuration management under control then you have other problems and using docker is just going to add another layer of abstraction on your mess that your DBA doesn't know how to deal with when things hit the fan. In particular I can imagine improper understanding of docker volumes could bite some people, but they also have some questionable defaults for networking (user land proxy, rewriting iptables)
That being said we currently use docker for some of our production databases, mainly for almost-idle services (mongodb for graylog, zookeeper for kafka), but I have had no problem using them for some moderately sized services with a couple thousands writes per second on redis/kafka (which is nothing for them).
We're still using non-containerised versions of the databases that needs dedicated bare metal servers mostly because I don't see the risk-benefit being worth it, but I'd love to hear someones war stories about running larger scale databases in docker.
For development, I don't think there's anything better for databases, it beats manual setup, vagrant boxes, and shared development servers by a long shot. I feel that educating everyone on your team in how to use it is well worth the investment. docker-compose makes setting up even a fairly complicated development environment a breeze.
This, it depends more on the product and the requirements. I've worked in companies that are just a few employees and are running databases larger than this. I've also worked for a company with ~100 employees whose only 'database' is an in memory cache and a few kilobytes big textfile
Completely agree, for example chrome has been observed flushing full state data to disk at regular intervals even with no changes since 2010[1] which is eating battery and SSD lifetime. Firefox does this too as far as I know.
Not to mention the battery impact of poorly written javascript SPA's or advertisements.
I don't understand why some developers insists on using semver and not follow the spec, in my opinion that is the only 'problem' with semver.
If you need a version and don't care about following the spec just use a timestamp or datetime, replace it where required with a sed command and move on but please don't claim to use semver if it's just an arbitrary number for you
I just want to say that it's likely not the amount of plugins it's the weight each have, likely you have a few heavy ones causing your boot to be slow. I use ~20 plugins and startup time is still under a second when opening a 35000 line file, try using --startuptime
HTML5 media is quite a can of worms, I remember reading the return types of HTMLMediaElement.canPlayType() [1] which is ['probably', 'maybe', ''] for the first time thinking it's a joke.
What advice I give in terms of computer security I see more like being sanitary similar to washing your hands, it will not make you free of germs but it will greatly reduce the chance of getting an serious infection. The thing you should realize is that your data will never be perfectly secure. You could take your data offline and store it on an encrypted hard-drive in a waterproof safe on the bottom of the ocean and there could still be ways to access it. You need to find a middle ground where you feel safe enough not to worry about serious infections but aren't afraid of germs to the level it affects your every day life.
Most browsers store their passwords in plain-text, this means there's applications that can fetch all your stored passwords from all browsers and send them to an undisclosed location in seconds given user level privileges on the machine.
By upgrading to lastpass you have reduced that attack surface by using a secure passphrase and encrypted data-store but you have increased your attack surface to anything accessing lastpass servers and application bugs.
With all these attack vectors one might think that it's better to just not save passwords and just remember them, while this is true in theory in practice it's impossible to remember a sufficiently unique password for each website you are registered to which leads to password reuse which is another much greater attack vector where your leaked passwords from one site can be reused on other sites.
In general I would advice you to use a password manager that generates and encrypts passwords (Lastpass is one of them), use a secure passphrase and don't reuse passwords. Password reuse will likely make you less secure than writing your passwords on a post-it by your computer (don't do that either)
I would also consider looking into using proper 2-factor authentication for sensitive login (document storage, email, password manager) but I don't want to bore people with the details there so I'll defer you to do some independent research
"Despite reporting the problem to the author on Friday, and following up the report via Twitter this has not yet been fixed, but after four days I assume I'm not alone in spotting this."
Giving someone a weekend to fix something doesn't exactly sound like responsible disclosure.
I understand if you get excited because you found a flaw but if you find something like this please be more responsible with publishing your findings.
I'm struggling to see which VCS you deem superior, I'm assuming you are not referring to SVN, Mercurial maybe?
The learning curve to git is not great but as far as I know nobody has publicly released an option that's improved enough over git to motivate the cost of switching technology. If it's not working for you the only advice I can give is either learn it until it is actually working for you rather than being in the way or try to find a better workflow.
I use tig (https://github.com/jonas/tig) because it doesn't require me to leave the terminal and I find it does everything I need from a git UI without getting in the way