@evana@hachyderm.io

evana @evana@hachyderm.io · Jul 22, 2026

Replying to @b0rk@social.jvns.ca

@b0rk@social.jvns.ca I'm here for them, even though I'm not really interested in writing my frontend logic in Python. I *am* happy to steal working patterns for other projects without having to pay the full learning cost. 😁

2

0

evana @evana@hachyderm.io · May 13, 2026

Replying to @b0rk@social.jvns.ca

@b0rk@social.jvns.ca I'd love to read a summary of your lessons. I'm also a "prefer fewer tools" type, and I'd like to understand what the problems are as you scale up.

0

evana @evana@hachyderm.io · May 11, 2026

Replying to @hszakher@mastodon.world

@hszakher@mastodon.world @Teri_Kanefield@mastodon.social @slott56@fosstodon.org "resulting mess" includes a lot of really embarrassing cleanup that will be humiliating for whoever owns it: think paying affected third parties and implicitly endorsing the regime in Iran via a variety of policy changes at their behest, losing face with various allies in the region where we clearly can't keep them safe, and owning the resulting inflation, economic impact, etc.

If someone other than the executive (read: President, Secretary of Defense, Secretary of State) ends up owning this fiasco, it will empower the executive to do it again. And they will have a punching bag to distract from their failures, because "our plan would have worked, but we were thwarted!".

It's like the grownups bailing out a teenager who's causing damage. Maybe it's done from a feeling of love or responsibility, but shielding that person from consequences will teach them that they don't have to worry about consequences.

0

1

0

evana @evana@hachyderm.io · May 05, 2026

Replying to @carnage4life@mas.to

@carnage4life am I the only one bothered by the fact that the wild card backgrounds change twice through the hand of cards?

0

evana @evana@hachyderm.io · May 02, 2026

Replying to @tsupasat@infosec.exchange

@tsupasat@infosec.exchange @carnage4life@mas.to there was at least one candidate for an open source mentorship that seemed to be doing this. The same issues would crop up on every PR. I don't know if it was an LLM or not understanding the details, but it definitely made an impression (and they were not on my shortlist).

1

0

evana @evana@hachyderm.io · Apr 26, 2026

Replying to @briankrebs@infosec.exchange

@briankrebs did you see https://www.404media.co/delusion-using-chatgpt-gemini-claude-grok-safety-ai-psychosis-study/ ? Apparently at least some LLM chat interfaces will lean into and encourage these delusions.

0

evana @evana@hachyderm.io · Feb 27, 2026

Replying to @hachyderm@hachyderm.io

@hachyderm

the practice of choosing connection over punishment is itself part of building the community we believe that we all want to live in.

Thank you for this reminder (and all the work that you do).

The discussion about asking for what you want reminded me of something I was taught in my son's pre-K: if you tell a young child what you don't want them to do ("don't climb that ladder"), they get the idea of doing so. Using positive language ("stay below this height") helps them find ways to follow the rule. Asking for what you want seems like another case of positive framing helping even adults get along.

0

evana @evana@hachyderm.io · Feb 06, 2026

Replying to @trashwizard@mastodon.social

@dalias@hachyderm.io @catsalad@infosec.exchange @trashwizard@mastodon.social I think there's a difference between technical know-how and social experience understanding what moderation in a social network really means.

3

2

0

evana @evana@hachyderm.io · Dec 07, 2025

Replying to @bo_brinkman@kind.social

@bo_brinkman@kind.social @polotek@social.polotek.net my understanding is that Rails and Django do this really well, but I've also had good success with the go migration tools and flyway(!!) for a python project that was using plain SQL.

0

evana @evana@hachyderm.io · Dec 05, 2025

Replying to @polotek@social.polotek.net

@polotek@social.polotek.net another reason to do this early is so that you convert the knowledge of how to run the application into code, rather than keeping it in squishy memory (where it is inevitably not documented well enough for when you come back 6 months later). So for me, doing the packaging / CI is basically a defense against future abandonment of the project by myself.

0

evana @evana@hachyderm.io · Dec 05, 2025

Replying to @matt@toot.cafe

@matt@toot.cafe @polotek@social.polotek.net if the data matters, you probably want something backing up that database. If the data doesn't matter, then just go ahead and lose it. 😁 While backing up a database isn't hard, it's the sort of thing that's easy to screw up and annoying to check/maintain. That's a great thing to offload to a platform (either company managed or from a service). One "cheat" I will do with managed database systems is to use multiple named databases within the same instance, so they all share backups, access control, and billing unit. For a small project, that let's me amortize the effort. For a big project, it's probably a mistake, but formalizing the backup / restore to migrate to a separate database when you got that scale might be a good practice opportunity anyway.

0

1

0

evana @evana@hachyderm.io · Jul 16, 2025

Replying to @Viss@mastodon.social

@Viss@mastodon.social @crocodisle@woof.tech

Most of these urls probably owe more to Apache / Nginx and cgi-bin style deployments where people stuff things in the webroot than docker or Kubernetes.

Not to say that there isn't a lot of blame to go around in terms of insecure defaults, but I wouldn't necessarily start with the last 10 years and imagine things were better before that.

Deploying software is still way harder than it needs to be, but a big list of "don't"s won't teach people what they should do instead.

Here's a couple "do"s I'd add:

separate any of your secret data or stuff that might vary between environments from the code you check in / bundle for deployment. If you have secrets, see if your platform has a tool for secrets (and use it), or carefully use either environment variables or file contents to load them in from outside your webroot.
Figure out how to package and deploy your software repeatably. Docker is actually good at this, though tarballs or even git with checked-in lock files and a script can work. Avoid doing git checkouts below your webroot, since doing so will expose your .git directory and metadata to these kinds of queries.

4

0

evana @evana@hachyderm.io · Oct 30, 2024

Replying to @david_chisnall@infosec.exchange

@david_chisnall@infosec.exchange it gets a bit weirder, because a lot of that value is "paper value" based on things like stocks that have gone up in value (but haven't been taxed yet). So what you do is you take out a 3% loan with that stock as collateral, and then let your core investments continue to appreciate at better than 3%. Billionaire-level money is reality-warpingly weird (and seems to be largely based around tax avoidance).

0

evana @evana@hachyderm.io · Nov 24, 2023

I'm trying to get over my discomfort at self-promotion.

I've distilled my 9 years of working on serverless (2014-2023) into a book with O'Reilly. While there's a chapter on "how Knative works", my favorite chapters are the ones about building serverless applications on any platform -- extending applications and connecting applications through event-publishing.

Building Serverless Applications on Knative (https://learning.oreilly.com/library/view/building-serverless-applications/9781098142063/) comes out in-print on Dec 19, but the ebook is already available.

7

0

3

0

evana

Posts

Remote instance

Media