• Al Smith Was a Poor and Uneducated Tammany Man Who Rose to Be the Governor of New York

    Al Smith was a poor Irish-American who grew up in the Fourth Ward of New York City (Lower East Side). He became a Tammany Hall loyalist and henchman, but became so well liked (by Tammany and the people of his district) that he was elected to the State Assembly.

    Not knowing anything about legislation and bills, every night he would read each bill. He would pay for transcripts of the days session to read later so he could try to understand it. He would sit in on committees that he wasn’t a part of. He then mastered it. Combined with his likable character, talent for oration, and now an in-depth understanding of how legislation worked and it’s problems he quickly became effective and championed reform while becoming the assembly speaker.

    He then pushed for the local Tammany democrats to change course and embrace progressivism. They acquiesced and it opened the door for a new kind of candidate—the kind that made Al Smith the governor of New York where he led a progressive agenda.

    See also:

  • Recursive UseEffect in React

    In React, useEffect let’s you perform side effects in function components. They are meant to run once when the component is mounted, however you can recursively call it by combining adding a useState data dependency to it. By toggling the value of the data dependency inside the effect, it recursively call the effect. This is useful, for example, in implementing retry logic to an API call say for automatically retrying when an access token expires.

    const [retryToggle, setRetryToggle] = useState(false);

React.useEffect(() => {
  if (someConditionToPreventInfiniteLoop) {
    return
  }

  fetch("http://example.com")
    .then((r) => handleSuccessHere(r))
    .catch((err) => setRetryToggle( i=> !i))

  // This dependency allows us to re-run the effect whenever this
  // value changes.
}, [retryToggle]);

  • A Minimum Remarkable Product Is Obviously Better

    People often get hung up on the ‘viable’ part of a minimum viable product (MVP) and tend to think of it as something that can be crappy. Framing how you are building the first revision of a product idea as a minimum remarkable product (MRP?) makes clear that it has to be obviously better than what’s currently out there or it will not get anyone’s attention.

    This framing is less of a functional definition (minimum viable evokes ‘it kinda sorta works’) and more of a user centered definition (minimum remarkable evokes ‘what would get our users attention?').

    (I couldn’t find a source, but it comes from Amazon or Jeff Bezos).

    See also:

  • How Refresh Tokens Work

    A refresh token in an OAuth setup using Json Web Tokens (JWT) is used to request a new access token. Because access tokens are short lived (to minimize the impact of a token being exfiltrated), a long lived refresh token is commonly used to, for example, stay logged into an app rather than need to log in every n minutes (the length of the access token).

    Why have two tokens? In web apps this provides an additional layer of security and a better access story for your auth service (for high traffic app). Access tokens have a short life and the signed token is verified on every request (CPU bound), a refresh token affords a chance for the auth service to cut off access (using a deny list in a database i.e. IO bound) and is also stored separately (HttpOnly cookie) to prevent cross-site-scripting (XSS) attacks. This also improves scalability, authentication happens less frequently (at login time and token refresh time) which can reduce load on an auth service.

    The refresh token should be treated differently because it has a longer expiry. It should be stored in a more secure way to prevent leaking it. In the browser that means storing it in an HttpOnly, Secure, and SameSite (to prevent CSRF attacks) cookie in the browser which can not be accessed from JS and refresh token rotation. This makes it possible to “refresh” an access token by making a request and including the cookie (using fetch with credentials: 'include').

    See also:

  • Shipwrecked Boys Don't Devolve Into Savagery

    Unlike the Lord of the Flies, a real life story about six shipwrecked boys who ended up on a deserted island in Tonga for 15 months showed cooperation and loyalty rather than murder and mayhem.

    The group stole a boat out of boredom and got caught in a storm that brought them to the island. They survived by scavenging.

    They also survived by working together. One of the boys fell and broke their leg so they fashioned a makeshift split. They made a guitar out of coconuts and wire that washed ashore. They sung together and prayed every night to keep their spirits up, for 15 months before they were rescued by a fishing boat.

    Read the article

  • Zero Trust Security Frameworks

    Zero Trust refers to securing at the device level rather than at the network level. Each device (or network) is on the public internet and uses encryption and authentication (using certificates and a certificate authority) between connections in the network. This has the advantage of being flexible—devices communicate directly to each other—and maybe more secure—there’s no ‘network’ to compromise (e.g. taking over the VPN server).

    Examples:

    See also:

    • When compared to trust models this would be closer to 1 of N (there’s some central authority for authentication) rather than 0 of N

  • Weekly Reflection Clarifies Broad Based Worrying

    At the end of the week I reflect on what went well, what’s not working, and what I learned. The key is to write down an observation and then add specific supporting examples. What I typically find is that I’m drawing conclusions from a small number of instances—or none at all. This is often enough to dispel broad based worrying that accumulates at the end of the week (especially on weeks that haven’t gone well).

    See also:

  • Münchhausen Trilemma Explains Common Tropes of Arguments

    The Münchhausen trilemma occurs when attempting to prove anything to be true. Such attempts fall into three tropes—a circular argument which supports itself (A <-> B), a regressive argument where the proof requires further proof infinitely (“why?” x infinity), and a dogmatic argument which relies on an assertion which is not defended (“because”).

    A good example is conspiracy theories—it’s not useful to argue with someone about because it will inevitably fall into one of these tropes.

    See also: