varsock

cool. yeah you would know best, I see you're very involved on this instance

I've actually found his blog where he talks about this "optimistic merge"

http://hintjens.com/blog:106

any utility in enforcing/suggesting a post template that address (for example)

1. What task are you accomplishing with this code?
2. How is it implemented (give an overview of your solution)?
3. Why did you choose this approach (if several valid approaches exist)?
4. What specifically, if anything, do you want suggestions on. Security, best practices, etc (Optional)

There is a very effective approach (34:00), that big companies like cloudflare use, to ship a product in a fast and quality way. It bears parallels to what you are describing. In essence engineers should not get hung up in the details to trying to solve everything.

1. Just build a proof of concept
2. Discard the prototype no matter what and start from scratch keeping the initial feedback in mind
3. Build something internally that you yourself will use
4. Only once something is good enough and is used internally, then release it to beta.

So that tedious process in trying to flush out all the details before seeing a product (or open source effort) working end to end, might be premature before having the full picture.

Brave has superior fingerprint protection, they achieve this by randomizing the browsers fingerprint. Visit EFF's cover your tracks to test your browser.

To achieve the same functionality that brave achieves out of the box with Firefox I need many extensions and then when I profile both browsers, Firefox is more resource intensive. Brave's blocking is native to the browser. I will give Firefox the W because I've read that uBlock is technically more capable. But as a long time Firefox/uBlock user who switched to brave - this has not been noticable.

As for accessibility, I can configure brave to be really aggressive at ad blocking, tracking blocking, fingerprint blocking, and restricting JS even, and all those options I can set from one place instead of in different settings/extensions. When a website breaks, I click on the button next to the URL and immediately have options to granularly dial down the "protection" or add a website to my trusted list. In Firefox I was annoyed to having go through settings for the extension.

Brave plans to continue supporting Manifest V2 after Google kills it. For Ungoogled Chromium, however, it's still undecided, likely depending on whether UG contributors are willing to maintain it.

Brave has superior fingerprint protection, they achieve this by randomizing the browsers fingerprint. Visit EFF's cover your tracks to test your browser.

To achieve the same functionality that brave achieves out of the box with Firefox I need many extensions and then when I profile both browsers, Firefox is more resource intensive. Brave's blocking is native to the browser. I will give Firefox the W because I've read that uBlock is technically more capable. But as a long time Firefox/uBlock user who switched to brave - this has not been noticable.

As for accessibility, I can configure brave to be really aggressive at ad blocking, tracking blocking, fingerprint blocking, and restricting JS even, and all those options I can set from one place instead of in different settings/extensions. When a website breaks, I click on the button next to the URL and immediately have options to granularly dial down the "protection" or add a website to my trusted list. In Firefox I was annoyed to having go through settings for the extension.

Brave plans to continue supporting Manifest V2 after Google kills it. For Ungoogled Chromium, however, it's still undecided, likely depending on whether UG contributors are willing to maintain it.

society gains nothing by preventing a software developer from implementing ...

I see the point you are trying to make but I respectfully disagree. Technology is at the core of seemingly every field and at the core of technology is software. Will it result in direct bodily harm? Rarely. But indirectly the impact is certainly more substantial.

Take internet as an example. The significance of internet and information sharing cannot be disputed. Disturptions to information sharing can send ripples through services that provide essential services. Networking these days is accomplished Vida software defined networking techniques. And we are becoming more dependant on technology and automation.

I can see why the indirect risk is not as scary as direct risk, but you have to admit, as automation is growing and decisions are being made for us, regulation of those that build these systems should not be overlooked. Professional engineers have a code of ethics they have to adhere to and if you read through it you can see the value it would bring.

As a counter example to your "doctors are licensed to not kill people" - orthodontists, who move teeth around, pose no fatal risk to their patients. Should they be exempt from being licensed?

EDIT:

Just yesterday news was published by Reuters that Musk and managers at Tesla knew about defects of autopilot but marketed otherwise. If those working on it had been licensed, then negligence and decietfulness could line them up to lose their license and prevent them from working in this line again. It would bring accountability

getting a developer account with redhat you can have up to 10(?) instances of RedHat Linux LTS. super stable, is run on servers for many critical serves. Or just use rocky linux (bug for bug compatible with red hat) and establish a roll back procedure. There are rollback options at the filesystem level so you can snapshot before an update.

I use fedora and I don't typically have any issues and that is considered bleeding edge.

Macs have too many guardrails that get in the way which can be as disruptive as something breaking bc you need to work around it. But I am acknowledging that it is use case dependant.

This is the best suggestion for DIY, I can even get away without a printer and just write by hand. Perfect! Wish I could pin this comment.

nothing wrong with being self taught, you could follow these basics topics before poking holes in firewall.

1. VLANS: learn how to separate your LAN into networks with different security requirements. For wireless, try to make a "main" and "IoT" network so that IoT network that can't talk to your "main" network but "main" can reach IoT devices. For wired, try to have a Management network, and a "Dirty network" etc.
2. Firewalls and Routing: You will need to be able to route between your VLANS and set firewall rules to allow certain traffic. Best practice is block everything and allow only what you need.
3. NMAP: learn how to do NMAP scans of your network to discover hosts and their open ports/services. This is a similar approach that "hackers" and script kiddies use on the public internet to find vulnerae and open services. Being able to probe your own network is crutial in understanding how others might approach in penetrating it.
4. Wireguard VPN: Learn to access your network remotely by setting up a wireguard VPN. Wireguard is preferred because it is "stealthy" and will not respond to unsolicited attempted to probe your network. Start small by using wireguard to access between VLANs so you don't run the risk of using the internet.
5. NGINX and Reverse Proxy: If necessary, learn to expose your services or blog or website by only exposing nginx and proxying to your services. Many guides on securing NGINX exist. Try not to expose anything, but sometimes necessary if you want others to reach your website/blog/hosting etc.

That's a rough outline that you can use to guide yourself and achieve milestones with hands on experience. In your pursuit you'll run into certificates and domain name hosting and stuff. But all this is on the web so let your curiosity (and paranoia) drive! Have fun!!

The table of contents hints there is only one section relevant to security, Lab Firewall Config.

Anyone have experience with this book that could vouch for other chapters that explore best practices for security?

good question. Software and computer practices are changing much faster than other fields but with time, pillars are being better and better defined. Production quality code, CI/CD, DevOps, etc..

Civil engieers have a successful licensure process established. See my comment regarding that.

But an approach where a candidate would spend time under a "licensed professional software eng" would favor practical work experience over academic.