I am several hundred opossums in a trench coat
I agree that this is ultimately a problem with developers lacking security knowledge and general understanding, but my issue with Firestore specifically is that it is a powerful tool that, while it can be adopted as part of a carefully considered tech stack, lends itself most naturally towards being a blunt force instrument used by these kinds of developers.
My main criticism of Firestore is that it offers a powerful feature set that is both extremely attractive to amateur or constrained developers while simultaneously doing a poor job of guiding said amateurs towards creating a secure and well designed backend. In particular, the seemingly expected use case of the technology as something directly interfaced with by apps and other clients, as evidenced by the substantial support and feature set for this use case, is the main issue. This no-code no-management client driven interaction model makes it especially attractive to these developers.
This lack of indirection through an API Gateway or service, however, imposes additional design considerations largely delegated to the security rules which can easily be missed by a beginner. For example:
- Many examples of amateurs take an open-by-default approach, only applying access and write restrictions where necessary and miss data that should be restricted
- Some amateurs deploy databases with no access or write restrictions at all
- There is no way to only allow a "view" of a document to a request, instead a separate document and security rules containing the private fields needs to be created. This can be fairly simple to design around but seems to be a bit of a "gotcha", plus if you have similar but non identical sets of data that needs to be accessible by different groups it must be duplicated and manually synchronized.
- Since there is no way to version data models, incompatible changes require complicated workarounds or an increasingly complicated deserialization process on the client side (especially as existing clients continue to write outdated models).
- Schema validation of data written by clients to the database is handled by security rules, which is seemingly unintuitive or missed by many developers because I've seen plenty of projects miss it
- If clients are writing data directly, it can become fairly complex to handle and subsequently maintain their contributions, especially if the aforementioned private data documents are required or the data model changes.
All of these pitfalls can be worked around (although I would still argue for some layer of indirection at least for writes), but at this point I've been contracted to 2 or 3 projects worked on by "professionals" (derogatory) that failed to account for any of these issues and I absolutely sick to death of it. I think a measure of a tools quality is whether it guides a developer towards good practices by design and I have found Firestore to completely fail in that regard. I think it can be used well, and it is perfectly appropriate for small inconsequential (as in data leaks would be inconsequential) single developer projects, but it almost never is.
I absolutely despise Firebase Firestore (the database technology that was "hacked"). It's like a clarion call for amateur developers, especially low rate/skill contractors who clearly picked it not as part of a considered tech stack, but merely as the simplest and most lax hammer out there. Clearly even DynamoDB with an API gateway is too scary for some professionals. It almost always interfaces directly with clients/the internet without sufficient security rules preventing access to private information (or entire database deletion), and no real forethought as to ongoing maintenance and technical debt.
A Firestore database facing the client directly on any serious project is a code smell in my opinion.
- JumpRemoved Locked
How do we feel about Lemmy communities that ban others based on a protected characteristics e.g. gender, sexuality, etc?
Women have been historically and presently marginalised, yes.
- JumpRemoved Locked
How do we feel about Lemmy communities that ban others based on a protected characteristics e.g. gender, sexuality, etc?
If people want a respectful space to discuss among themselves I don't see any good reason to force myself into the conversation. Not every space on the internet (or real life) needs to be a stage for the free marketplace of ideas, especially when you're talking about already marginalised communities who are easily disenfranchised by many of the kinds of people attracted to that style of space.
Personally, looking at the interaction between yourself and the mod, it reads to me like you was the one who was sarcastic and rude.
This feels more like two questions, so I'll answer them both:
- When I'm not programming for my job, I'm programming one of many side projects I have going on at any time. Same with any other professional who has a career in their hobby. These are often projects I think would be useful to me and I believe would let me learn new skills.
- I use Linux (and MacOS) because the Unix environment, particularly the command line tooling is far superior to Windows. Developers often work on Unix, so they build their tools for the platform and thus improvements stack up. I also just like the FOSS philosophy underpinning most Linux.
If you're trying to learn programming and know at least some basics, my only advice is to pick a project you're even a little interested in and get started. Don't worry about operating system, it doesn't actually matter that much unless you're working on iOS or MacOS! A weather app for whatever language/platform you're working with is usually my first suggestion for students.
There are plenty of legitimate reasons for Google to provide extra support and exceptions to parts of their guidelines to certain parties, including themselves. No one is claiming this is a consequence-neutral decision, and it's right to not inherently trust these exceptions, but it is not a black and white issue.
In this case, placing extra barriers around sensitive permissions like
MANAGE_EXTERNAL_STORAGEfor untrusted parties is perfectly reasonable, but the process they implemented should be competent and appealable to a real support person. What Google should be criticized for (and "heavily fined" by the EU if that were to happen) is their inconsistent and often incorrect baseline review process, as well as their lack of any real support. They are essentially part of a duopoly and should thus be forced to act responsibly.Oh yeah for sure. Google, extremely large companies, and government apps essentially have different streams and access to support than the rest of us mere mortals. They all receive scrutiny, and may have slightly altered guidelines depending on the app, but the most consequential difference is that they have much more ability to access real support. I just don't think it was an intentional and specific attempt to be anti-competitive, this is better explained by incompetence and the consequences of well-intentioned but poorly implemented policy.
I've experienced this exact issue with the Google Play Store with some clients and it's just the worst. This kinda thing happens because Google is essentially half-arsing an Apple-style comprehensive review of apps. For context, Apple offers thorough reviews pointing to exactly how the app violates policy/was rejected, with mostly free one-on-one support with a genuine Apple engineer to discuss or review the validity of the report/how to fix it. They're restrictive as hell and occasionally make mistakes, but at the end of the road there is a real, extremely competent human able to dedicate time to assist you.
Google uses a mix of human and automated reviewers that are even more incompetent than Apple's frontline reviewers. They will reject your app for what often feels like arbitrary reasons, and you're lucky if their reason amounts to more than a single sentence. Unlike Apple, from that point you have few options. I have yet to find an official way to reach an actually useful human unless you happen to know someone in Google's Android/Developer Relations team.
I'm actually certain that the issues facing Nextcloud are not some malicious anti-competitive effort, but yet more sheer and utter incompetence from every enterprise/business facing aspect of Google.
Google is free. The moderator time you waste by reposting this already removed post however, is not
Fingers crossed they do🤞
To add, this is happening against a backdrop of a historic swing against primary votes for the two major parties. That means that, under our preferential voting system increasingly more people are voting third party/independent first, with the two major parties further down the ballot. Labor is still winning enough seats to form majority for now (due to preference flow), but it points to a population increasingly frustrated by the inaction of the legacy parties and increasing polarization.
Ok, first up the players: Labor is the major centre-left party led by Anthony Albanese, Liberals are the centre-right (think economically liberal) led by Peter Dutton, Nationals are right wing, Greens are left wing, and there are a handful of "teal" independents who are mostly politically centre women with an environmental focused. The Liberals and Nationals make up the Coalition and essentially act as one insane party with the Libs at the helm, so you can mostly treat them interchangably.
Labor won the last federal election in 2022 by a slim majority (2 seats), but the Coalition lost in one of the worst defeats in our history. The Liberals were hit the hardest, losing 19 seats, putting them at their lowest representation since their formation in 1944. They were in power since 2013 and lost for a lot of reasons, but a major one was that Prime Minister Scott Morrison was rightfully loathed.
Since the last election, the Coalition has been steadily growing in popularity due to the same reasons other non-incumbents have globally (ui.e., inflation, high energy prices, etc). Add to that a (mostly true) perception that the government was doing too little to fix problems like our crumbling healthcare system wasn't helping.
Finally the election is announced in late March (our elections aren't fixed) and the parties start campaigning. Dutton, the Liberal leader, looks like he is going to win a majority at this early point. The following things happen:
- Labor announces and immediately implements a universal tax cut, Dutton announces he will repeal it and replace it with a cut on fuel prices.
- Labors announces a major initiative to improve bulk billed healthcare (bulk billed = free to the patient), which Dutton immediately matches. Labor runs a major attack campaign claiming that he cannot be trusted, since last time his party was in power they tried to destroy bulk billing among other things.
- Dutton announces a cut of 41,000 jobs to the public service, a substantial portion. He faces significant backlash as people worry it will result in degraded frontline services, remembering the issues with veterans affairs and Medicare last time they were in. The 41,000 he wants to cut is how much the public service had grown since 2022, so this seems like a reasonable worry. He "clarifies" that no frontline workers will be cut. He also adds that the cuts will be through attrition, not firing. Following continued backlash, he "clarifies" that he always meant the cuts were to come from Canberra, the capital. This is a mathematical impossibility, as he would have to gut the upper ranks of every department and probably defense to achieve that number.
- He announced an end to work from home for all public servants. This is bad for the Liberals, because they've had massive problems with women in the past (including a woman allegedly raped in a ministers office and subsequently an alleged cover up), and people quickly pointed out that the policy would disproportionately affects women, who are unfortunately still expected to bear most of the burden of childcare. Banning working from home prevents them from holding down many jobs. Dutton responds, typically out of touch, that women can job share. He then "clarifies" he only meant it to apply to Canberra, then changes his mind about the policy completely.
- He rejected Labor's renewable energy transition and instead proposes a transition to Nuclear. No industry group except the one they hired thinks this is realistic, a good option, or feasible. Unrealistically short time-frames, bad assumptions, etc are used to make it look good on paper. Finally someone points out that the places they plan to put the plants don't have enough water.
- Just yesterday, on the eve of the election, they announced their budget they intend to introduce if they win shows a budget deficit worse than Labor's during the next term, but magically improving after that. This exact tactic worked in 2013 but isn't now.
- Other minor things. They keep crashing campaign trucks into polling locations. Dutton has zero charisma and looks creepy, and was a Queensland cop (that's really bad, they're as corrupt as the worst American cop).
- Also a Liberal Senate candidate for this election personally tried to induct me into a culty MLM a few years back so fuck them specifically.
This has resulted in polls gradually sliding for the Coalition to the point that it now looks like they will lose even more seats this election and Labor might even gain one. Dutton may lose his own seat. It looks like the teals may pick up another member, with the Greens and fringe right wing parties staying about the same.
Mr President, a second signal chat has hit the buildings
I've used it most extensively for non-professional projects, where if I wasn't using this kind of tooling to write tests they would simply not be written. That means no tickets to close either. That said, I am aware that the AI is almost always at best testing for regression (I have had it correctly realise my logic is incorrect and write tests that catch it, but that is by no means reliable) Part of the "hand holding" I mentioned involves making sure it has sufficient coverage of use cases and edge cases, and that what it expects to be the correct is actually correct according to intent.
I essentially use the AI to generate a variety of scenarios and complementary test data, then further evaluating it's validity and expanding from there.
I most often just get it straight up misunderstanding how the test framework itself works, but I've definitely had it make strange decisions like that. I'm a little convinced that the only reason I put up with it for unit tests is because I would probably not write them otherwise haha.
I think its most useful as an (often wrong) line completer than anything else. It can take in an entire file and just try and figure out the rest of what you are currently writing. Its context window simply isn't big enough to understand an entire project.
That and unit tests. Since unit tests are by design isolated, small, and unconcerned with the larger project AI has at least a fighting change of competently producing them. That still takes significant hand holding though.
I knew something was wrong but I didn't put the dots together until my early 20s. I'd definitely had "I wanna be a girl" thoughts as a kid/teen but wasn't super aware that being trans was a thing so shoved them to the back of my brain and allowed myself to just kinda feel broken instead.
C'mon, that's what PR's, RCs, and betas are for
This is awful. One of my favorite differences between Android and iOS, as both a user AND developer is sideloading.