• Recursive UseEffect in React

    In React, useEffect let’s you perform side effects in function components. They are meant to run once when the component is mounted, however you can recursively call it by combining adding a useState data dependency to it. By toggling the value of the data dependency inside the effect, it recursively call the effect. This is useful, for example, in implementing retry logic to an API call say for automatically retrying when an access token expires.

    const [retryToggle, setRetryToggle] = useState(false);
    
    React.useEffect(() => {
      if (someConditionToPreventInfiniteLoop) {
        return
      }
    
      fetch("http://example.com")
        .then((r) => handleSuccessHere(r))
        .catch((err) => setRetryToggle( i=> !i))
    
      // This dependency allows us to re-run the effect whenever this
      // value changes.
    }, [retryToggle]);
    

  • A Minimum Remarkable Product Is Obviously Better

    People often get hung up on the ‘viable’ part of a minimum viable product (MVP) and tend to think of it as something that can be crappy. Framing how you are building the first revision of a product idea as a minimum remarkable product (MRP?) makes clear that it has to be obviously better than what’s currently out there or it will not get anyone’s attention.

    This framing is less of a functional definition (minimum viable evokes ‘it kinda sorta works’) and more of a user centered definition (minimum remarkable evokes ‘what would get our users attention?').

    (I couldn’t find a source, but it comes from Amazon or Jeff Bezos).

    See also:


  • How Refresh Tokens Work

    A refresh token in an OAuth setup using Json Web Tokens (JWT) is used to request a new access token. Because access tokens are short lived (to minimize the impact of a token being exfiltrated), a long lived refresh token is commonly used to, for example, stay logged into an app rather than need to log in every n minutes (the length of the access token).

    Why have two tokens? In web apps this provides an additional layer of security and a better access story for your auth service (for high traffic app). Access tokens have a short life and the signed token is verified on every request (CPU bound), a refresh token affords a chance for the auth service to cut off access (using a deny list in a database i.e. IO bound) and is also stored separately (HttpOnly cookie) to prevent cross-site-scripting (XSS) attacks. This also improves scalability, authentication happens less frequently (at login time and token refresh time) which can reduce load on an auth service.

    The refresh token should be treated differently because it has a longer expiry. It should be stored in a more secure way to prevent leaking it. In the browser that means storing it in an HttpOnly, Secure, and SameSite (to prevent CSRF attacks) cookie in the browser which can not be accessed from JS and refresh token rotation. This makes it possible to “refresh” an access token by making a request and including the cookie (using fetch with credentials: 'include').

    See also:


  • Shipwrecked Boys Don't Devolve Into Savagery

    Unlike the Lord of the Flies, a real life story about six shipwrecked boys who ended up on a deserted island in Tonga for 15 months showed cooperation and loyalty rather than murder and mayhem.

    The group stole a boat out of boredom and got caught in a storm that brought them to the island. They survived by scavenging.

    They also survived by working together. One of the boys fell and broke their leg so they fashioned a makeshift split. They made a guitar out of coconuts and wire that washed ashore. They sung together and prayed every night to keep their spirits up, for 15 months before they were rescued by a fishing boat.

    Read the article


  • Zero Trust Security Frameworks

    Zero Trust refers to securing at the device level rather than at the network level. Each device (or network) is on the public internet and uses encryption and authentication (using certificates and a certificate authority) between connections in the network. This has the advantage of being flexible—devices communicate directly to each other—and maybe more secure—there’s no ‘network’ to compromise (e.g. taking over the VPN server).

    Examples:

    See also:

    • When compared to trust models this would be closer to 1 of N (there’s some central authority for authentication) rather than 0 of N

  • Weekly Reflection Clarifies Broad Based Worrying

    At the end of the week I reflect on what went well, what’s not working, and what I learned. The key is to write down an observation and then add specific supporting examples. What I typically find is that I’m drawing conclusions from a small number of instances—or none at all. This is often enough to dispel broad based worrying that accumulates at the end of the week (especially on weeks that haven’t gone well).

    See also:


  • Münchhausen Trilemma Explains Common Tropes of Arguments

    The Münchhausen trilemma occurs when attempting to prove anything to be true. Such attempts fall into three tropes—a circular argument which supports itself (A <-> B), a regressive argument where the proof requires further proof infinitely (“why?” x infinity), and a dogmatic argument which relies on an assertion which is not defended (“because”).

    A good example is conspiracy theories—it’s not useful to argue with someone about because it will inevitably fall into one of these tropes.

    See also:


  • Tournament Like Fields With Asymetric and Convex Payouts Favor High-Variance Strategies

    Fields that exhibit tournaments with asymmetric and convex payouts favor high-variance strategies (variance from the benchmark mean).

    For example, fund managers that end up on the Morningstar list (top fund managers) tend to be founder-managed funds with highly concentrated positions (they also underperform in later periods). High variance from an index benchmark is favorable because if you make it to the top fund manager list you will receive many more clients and make a lot on fields.

    Another example is baseball where, before Babe Ruth, the prevailing strategy was high-contact (hitting many singles). Babe Ruth showed a high-variance strategy by swinging for the fences every time. His failure rate was much higher (he led the league in strikeouts), but he also overwhelmingly led the league in home runs making him one of the most valuable players in the league. (A corollary in recent times is the rise of three pointers in basketball).

    Other fields that exhibit this incentive for high-variance strategies include politics (making outrageous statements until something sticks has little downside these days) and venture capital (losses are capped, but gains are not).

    Read Swinging for the Fences.

    See also: