@ben I agree in principle, but I need to distinguish between bad things the last developer did from bad things everybody who writes node does, since the latter will likely match whatever tutorials / blog posts I end up consulting.
@ben Yeah, I haven't actually tried running it yet. I'm not sure if I should take a huge node_modules dir to mean it's terrible, or just a real-world project doing real-world things that is more than six months old.
Some brief digging suggests it is using something called Nxus, which appears to be a web application framework, because the world needs more JS frameworks.
So all of the controllers are subclasses of nxus-core or nxus-admin controllers. I guess the project implementation doesn't look utterly terrible, but Nxus is about 2.5 years old which doesn't fill me with confidence.
I'm maybe inheriting a #NodeJS project, as a part-time paying gig. I don't do node. I do the minimum amount of client-side JS to make something work.
If the project is sane, I'm confident I could skill up on-the-fly. If the project is terrible, I'd be in over my head. I don't have the expertise to judge, though.
If it was Python / Django, I'd be able to tell what I was in for in ten minutes.
Where do I look in a node project? What are best practices? What warning signs do I look for?
@tom79@mastodon.social Sweet! I'll be happy to help test for you.
I'm also just particularly familiar with the API because I re-implemented it in Python for #wonambi. So I know what it is theoretically capable of, even if it is sometimes a bit weird about how it does things, like the difference between since_id and min_id, because both are poorly named.
Really, I should just build a bridge between Mastodon and my RSS reader, and use that to read my timeline. At least then I know I won't miss anything, everything can be sorted how I want, and unread/read status will be explicit rather than inferred.
@tom79@mastodon.social It may also help to know that my internet access is not fast. Doing any extra work to get to the toot I want to read is likely to take 10X more time than somebody on a decent broadband connection.
@tom79@mastodon.social I don't actually care much about the display order, I care about not spending the first half of my short reading sessions loading toots I'm not going to read yet.
The long-press option is news to me; I just tried it and it works for relatively short gaps, but I worry that trying to use it to load three days of toots at a time might either take several minutes anyway or get me rate limited. Loading the oldest 40 toots in a gap rather than the newest would have neither problem.
I continue to be amazed at how many people assume 'reversed chronological' is the best sorting method for social media. I get wanting to know what's going on right now, but I want to read my timeline like a webcomic, not a firehose I dip into randomly without context. Firehoses are for twitter.
so apparently the attacker: - broke into jenkins - noticed flywheel (OS X build server) having ssh access from outside through a forwarded port - used those two to take flywheel - waited for someone to connect to flywheel and forward their agent - used the agent to get access to every server and add their key to a authorized_keys2 so it wouldn't get overwritten
last issue atm: "Monitor log files to avoid relying on external whitehats"
Regarding #commento: it was relatively easy to set up, and will more-or-less work for my two blogs separated by paths (though Commento also assumes one blog per subdomain and breaks with unhelpful messages if you include a path in your subdomain).
It doesn't do Oauth to Mastodon/Pleroma. There's an open MR to implement that, but it's poorly documented. I'd help, but it's #golang and that bugs me even more than JS.
I also don't know #NodeJS at all and am a mere dabbler in JavaScript, but #Schnack is simple enough and laid out in such a way that seems to work for my Python/Django-trained brain. The one twist is that the client-side code has to be built after changes, which took some time to figure out.
As part of the process, I'll try adding docs to the fork about modifying it; so many #FOSS projects lack even a basic explanation of how to make changes to the code.