K
Kevin Burke
kev.inburke.com · Personal blog · on HN since 2011
Kevin Burke, a software engineer and former Twilio developer, writes about APIs, testing, code review, and web security.
What HN saysHN commenters cite his warning against Sails and Waterline as matching their own bad experiences, and his posts on bug-finding methods.
39HN people shared it
16linked it in comments
104stories submitted
4.0Kstory points
8 years agolast shared
2011people per year2026
Most-shared posts
- 1Reddit's database has only two tables4 people · 296 points · first shared 2012 · 79 comments on HN
- 2Why code review beats testing: evidence from decades of programming research4 people · 117 points · first shared 2011 · 47 comments on HN
- 3The Frustration and Loneliness of Server-Side JavaScript Development (2016)4 people · 9 points · first shared 2016 · 1 comments on HN
- 4Things to Use Instead of JSON Web Tokens3 people · 382 points · first shared 2017 · 195 comments on HN
- 5Virgin Mobile leaves six million subscriber accounts wide open3 people · 177 points · first shared 2012 · 79 comments on HN
- 6Six Years of Hacker News Comments about Twilio3 people · 45 points · first shared 2016 · 11 comments on HN
- 7The TSA Randomizer iPad App Cost $1.4M3 people · 8 points · first shared 2016 · 1 comments on HN
- 8Don't Use Sails (or Waterline)3 people · 7 points · first shared 2015 · 1 comments on HN
- 9Profile Anything in Any Language in Under a Minute3 people · 7 points · first shared 2018 · discussion on HN
- 10AWS’s response to ALB internal validation failures3 people · 5 points · first shared 2018 · discussion on HN
- 11“Invalid username or password” is a useless security measure2 people · 413 points · first shared 2014 · 182 comments on HN
- 12JavaScript string encoding2 people · 105 points · first shared 2017 · 90 comments on HN
- 13A Two Month Debugging Story2 people · 90 points · first shared 2016 · 44 comments on HN
- 14Hacking Roller Coaster Tycoon with Genetic Algorithms2 people · 7 points · first shared 2014 · discussion on HN
- 15Dumb tricks to save database space2 people · 7 points · first shared 2016 · discussion on HN
What HN people wrote when they linked it
kevinburke · 2014-09-02
SEEKING WORK: San Francisco or remote
Formerly worked on Twilio's API, docs and onboarding flow for 2.5 years. Contributor to urllib3 (the library underpinning requests) and Jenkins CI. I can build great experiences and make developers happy.
Great with: Python, HTTP, Go, PHP, Bash, nginx, Jenkins
I can make: API's, client libraries (see my talk here: https://www.youtube.com/watch?v=C_UJHqR_2Mo), great user experiences, websites, Twilio applications.
Homepage: https://kev.inburke.com
Github: https://github.com/kevinburke
Email: [email protected]
romanovcode · 2018-04-04
I've used sails 3 years ago on a startup that we wrote from scratch.
Don't want to be negative but it is by far the worst framework and ORM I've ever used. Strongly recommend reading this[0] before you even start fiddling with the framework.
Even tho there are 100 wrong things about it the absolute worst: ORM "migrations" work in a way that they drop the tables and and then re-create them. If you have a lot of data the table is dropped and you get Out Of Memory exception - what a great ORM!
[0] https://kev.inburke.com/kevin/dont-use-sails-or-waterline/
Lazare · 2018-04-03
I've never tried Sails, but I'll note that it has a very bad reputation in the node community for many years, with particular scorn heaped on its poor documentation, many bugs, slow development pace, and (especially) its truly bad ORM.
Representative criticism: https://kev.inburke.com/kevin/dont-use-sails-or-waterline/
Or see the comments here: https://github.com/balderdashy/sails/issues/3429
Now admittedly that was three years ago, much may have changed, and this release may be amazing, but I'd suggest doing some due diligence. I've run across 6+ different projects regretting their use of Sails; I've yet to run across someone celebrating their decision. The project is troubled and probably on no one's list of "top 3 node js frameworks".
collyw · 2017-05-10
Not exactly what you asked for but this compares defects and different types of testing. Unit testing is one of the less effective ways of finding bugs.
https://kev.inburke.com/kevin/the-best-ways-to-find-bugs-in-your-code/
aug-riedinger · 2015-02-08
https://kev.inburke.com/kevin/invalid-username-or-password-useless/
Could not agree more on this. Best practice should evolve within time and wiki should be updated!
LnxPrgr3 · 2014-05-17
The closest thing I've seen to a proper study concludes that testing is high cost and low benefit compared to other QA measures: https://kev.inburke.com/kevin/the-best-ways-to-find-bugs-in-your-code/
rdfi · 2013-03-14
Found that paper about code reviews, it is mentioned in this blog post: http://kev.inburke.com/kevin/the-best-ways-to-find-bugs-in-your-code/
And here's the link to the paper itself: http://kev.inburke.com/docs/basili_testing.pdf
zokier · 2019-01-24
That is generally AWS stance on the matter too; VPC is considered secure enough. I remember reading something about it in their own blog, but now I could only find this where it is explained:
https://kev.inburke.com/kevin/aws-alb-validation-tls-reply/
mkolodny · 2018-05-22
I don't know if this is still the case, but at least in 2010 Reddit used Postgres as a key-value store [0]
[0] https://kev.inburke.com/kevin/reddits-database-has-two-tables/
atmosx · 2018-01-04
Here:
https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web-tokens
https://news.ycombinator.com/item?id=13866883
https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/
or go with the flow:
https://www.google.gr/search?q=ptacek+jwt&oq=ptacek+jwt&aqs=ch…
He has countless comments preaching against JWT and DNSSEC.
Mind you, I know the nickname, I know he is good with sec (I'd hire him to vet an app) and all but I don't know him IRL or ever heard of him before joining HN ... that's to say that he spent a lot of digital ink discussing these two topics here. The subset he's talking about, should amount for more than 50% of the regulars I guess.
davidu · 2016-06-23
This post is an amusing summary of the six years of Twilio haters: https://kev.inburke.com/kevin/six-years-of-hacker-news-comments-about-…
walrus01 · 2016-06-04
> Letting govt agencies who don't know what they're doing go out and tender for private sector building of internet services would be a disaster; they'd be oversold six ways from Sunday.
You mean like this? $1.4 million for an app that chooses left or right.
http://www.geek.com/apps/tsa-paid-1-4-million-for-randomizer-app-that-…
https://kev.inburke.com/kevin/tsa-randomizer-app-cost-336000/
whalesalad · 2016-05-24
Reddit does something very similar. https://kev.inburke.com/kevin/reddits-database-has-two-tables/
I think the important thing to note here is that there are lots of different ways to use any given tool that can fit your use case without being an atrocity.
lowboy · 2016-04-03
Why is there a ?lobsters qs on the submitted url? Seems to load fine without:
https://kev.inburke.com/kevin/tsa-randomizer-app-cost-336000/
maxerickson · 2014-09-14
Up until 2 years ago, Virgin Mobile USA rate limited PIN attempts using cookies:
https://kev.inburke.com/kevin/open-season-on-virgin-mobile-customer-da…
(VM USA was a VMNO, but now it's more of a Sprint brand, since 2009 Sprint owns them outright)
alliemobley · 2012-09-04
Server Side: I plan to copy those that scaled before me, a mixmash of: pinterest http://highscalability.com/blog/2012/5/21/pinterest-architecture-updat… , reddit: http://kev.inburke.com/kevin/reddits-database-has-two-tables/ , and instagram: http://highscalability.com/blog/2012/4/16/instagram-architecture-updat… architectures.
The previous devs managed to get everything tightly coupled at the design stage, which is why I think their implementation efforts failed.
The plan for now is to seperate the existing code into layers and decide what to do from there.