Comments by "Metalstorm" (@M3t4lstorm) on "ByteByteGo" channel.

  1. It's so simple that almost everyone does REST wrong
    212
  2. SO is just a glorified forum, forums have been around for decades and are are mostly just CRUD operations. There is no real-time'iness about it, no huge amounts of data (think IoT, streaming, personalization/suggestions, etc). There doesn't seem to be any integrations with other large systems (CRMs, data warehouses, BI, ML, etc). They don't protentially lose large amounts of money if a number of users can't login/create a post. It's extremely read heavy, that's the easiest to design for. They are not dealing with financials/transactions/money, if something is out of date or data is slightly wrong it doesnt matter. SO still has downtime/maintenance basicslly every week or so, i wonder why...it's a sinple architecture because its a simple system.
    39
  3. Notes: - The SQL query at 20:27 would not work for the same reasons you mentioned previously in the video (prime meridian + equator). - You assume that the long/lat is the centre of the business/place, if users are able to add their own businesses this will probably not be the case - Businesses/places can span multiple grids (think of shopping malls) - Businesses/places can be bigger than a grid (think of airports) - At the very end you say it would "use the long/lat to rank the businesses and return to the client" (sorting), you also need to check if the business is still within the radius the user specified (filter); just because the business is in the same grid/neighbouring grids doesn't mean its within the radius they asked for. The first thought might be to make the geohash a list (of all the grids that it covers), but how do you calculate that? You would need a polygon (a long/lats for each vertex) that covers the (rough?) area of the business/place, then you get onto the trouble of validating that :)
    21
  4. Sure if you don't implement it properly, but that goes for everything, so...
    18
  5. How would GQL differ from a security perspecific than any other HTTP based API...
    8
  6. Tell me you don't know what a JWT is without telling me you don't know what a JWT is 😉
    7
  7. There isn't any security issues putting roles and permissions in a JWT.
    6
  8. This kind of 'security' doesn't even belong in the API layer, so yes GQL can
    4
  9.  @biomorphic  Revoke the JWT. Put the clients IP in the JWT and validate it on the server side. Sorted, not difficult.
    3
  10.  @marcioaso  some pretty bad takes, ofcourse the FE wants to know what permissions the users has, if the user doesn't have the 'delete X' permission then you hide/disable the button that the user would click to 'delete X'. The API that actually 'deletes X' should be the thing validating that the user has that permissions. I don't think anyone in this thread has said that the permissions should be enforced/checked/validated in the FE...that would obviously be silly because it's easily bypassed, trust nothing from the FE, only server-authoritative, etc. A JWT is not a cookie, both literally and figuratively, so that whole section is basically moot. Also, a lot of people are assuming the client is a web browser, sure most of the time it is, but the same principles/architectures are used when the client is something else, like another application, service, CLI, a 'raw' request from something like CURL.
    3
  11. You know performance isn't the number 1 priority of a microservice architecture right? Nor is a deciding factor if you should use MS or not
    3
  12.  ihateidiots9484  Sounds more like a bad Dev team/system design.
    3
  13. Disagree on most of this video, and is outright wrong at times, maybe because its such a high level video at only 4 minutes? It also seems all over the place in terms of concepts, there doesn't seem to be any logic over what topics are picked; over concepts much more akin to MS architectures like eventual consistency, 2-phase commit, actor pattern (workers), async vs sync (basically you are now introducing a depenacy on the network/timing/order on almost anything you do, which in a monolith you don't normally have to). Also microservces shouldn't "communicate with each other" that itself is too much coupling and against the goal. This format works well for small discrete topics like algorithms, but not for these large scale software architectures as there is just to many rabbit holes and information to cover.
    3
  14. You can also put the client's IP (as seen by the server) in the JWT when creating it. Validate it just as you would the signature, issuer etc. Any attacker getting ahold of the JWT would have to perform the attack from the client's network, rather than sending it back to a Command and Control server/their network.
    2
  15.  ihateidiots9484  they are obviously doing it wrong if those are the kind of problems you are seeing. I am speaking from a lot of experience in this field.
    2
  16. Imagine that, using the wrong tech causes huge problems and a huge bill.
    2
  17.  @marcioaso  because you reply with one thing and then get replies and then you edit your message greatly. Which yes, is your responsibility 😉
    1
  18. Only a few? Literally 1000's of companies follow microservices (or at least try to). For large corps, sure legacy stuff might be monolithic, that's not because monolithic is better, it's just that changing an enterprise system once it's been in prod for many years to anything else is a massive amount of work. Anything in the last 5 years or so (of a decent scale) will more than likely be microservices (again, at least try to).
    1
  19.  @fxfighter  ye then you need to rack it, maintain hardware backups, redundant locations (different countries at least - currencies, tax, processes, laws, etc), pay someone to manage and maintain all of this security/vulnerabilities, networking, storage, patching, etc...infra engi easily 50k+ a year.
    1