The only complicated part of this method is securing the key, and the key is definitely required or you may as well just save it as plain text.
You sync your DB across multiple cloud services, and to decrypt you use a weak master pass and strong key.
I've been struggling with how to move that key around.
.1) Put it on a USB drive or hide it in your filesystem.
This is cumbersome and losing the drive could be disastrous. It's also trivial to scan a filesystem for key-like files.
.2) Use an authentication dongle.
This one is better but requires third party hardware in most cases, and is slightly expensive.
.3) Bluetooth/NFC to your device.
This can be intercepted at extended ranges as proven at defcon etc. Though is admittedly the most convenient method. The data can be signed, but I haven't seen anything out there that implements this well just yet.
.4) Timed one time passwords, PushBullet etc.
This feels like a bonus feature.
I'm not sure how to go about this. You lose or leak the key then you're screwed.
Is there a wristwatch or phone app with signed credential sharing based on wearer input, compatible to a standard?
Honestly I'd rather a t520 over this new Dell i7 e7450 latitude they have our developers using. The keyboard has... Fn key Home and End keys! Maximum cringe.
Quick suggestion; grab ShareX and make some .webm's showcasing Relax for your landing page. Much more accessible than learning how it all works. People want to see results.
While I recommend a switch to Linux/Mac, you can make updates behave like Win7 by opening "Edit Group Policies" in the start search. Then look for Windows Updates for the option.
Without this done windows will actually download updates automatically while you are ingame or something else network sensitive, it's so fucking stupid.
This is pretty much the preferred cure from what I've gathered. If you can build a PC with two GPU's (or merely one PCIe and one integrated), you can game, use Photoshop nearly natively.
But as you have said, it's not as straighforward as I'd like. I haven't tried it yet but it's nice seeing others having success.
Are there any up to date guides and best practices for this?
Additionally... Tonic is comparible to CodePen in terms of testing and thus gave me the idea;
Perhaps you could also include other languages into your platform. Such as a Stylus REPL, SASS, SCSS etc. all of which, like CoffeeScript, are just JS modules on npm.
With compilers like Stylus and SCSS you would probably default the return value to be the compiled CSS, and with Coffee you'd need a toggle button to show what the compiled JS looks like, though not 100% necessary.
With that said, if there was just a way to set up a "build" script for a REPL to set up the environment to achieve the same result. As in, you require('stylus') then have some global variable stream/buffer, tonic.output, for which you could inject into the module of your choice to generate output, and then save it via tonic.buffer.write() or something. It could then be ridiculously flexible in terms of testing out finicky new languages/compilers.
I had the displeasure of reading most of what you wrote and am writing this to convince you of something:
Please stop. Your SJW politics is off topic and in my opinion; utterly trivial nonsense. You were out-argued and still you found it in yourself to write more damage control comments.
I'm certain the reason people on HN don't call you out on this more often is the latent fear of being shadowbanned due to political correctness.
You made this your personal little soapbox and your posts reek of entitlement. Stop.
This is a mostly garbage. It doesn't even mention control flow; callbacks, promises.
A big problem with JS is in part its best quality; flexibility. New and old developers need to be shown how JS has evolved to be written. I see massive code-quality and structure discrepancies in various large modules throughout the JS community and it only serves to dissuade contribution.
I'm not sure if it exists, but there should instead be a site dedicated to: "JS, done right."
It could outline actual best practices.
- Building, usage of precompilers
- Control flow
- Code structures
- Tests
- Everything in between
Usage of precompilers.
- Browserify, for modularity
- Babel, for next-gen features and code elegance
Control flow
- Bluebird, for promises
Tests
- What libraries to use
- How to build tests and how the big guys do it
- Guides for complex tests
Then you could introduce other somewhat subjective deviations, like CoffeeScript, other promise libraries, other control flow techniques.
Describing code structures is another big one.
With the use of Babel, the example-code can feature ES6 classes which would remove a nice chunk of the confusion newbs might associate with JS's prototype system (Not to say it shouldn't be introduced).
Then describe when to use each code structure.
My last thought would be to link to Github repos; for example, applications in both node.js and the client, which could describe a standardized filestructure, explain build steps, introduce tests, supply a step by step guide, etc..
Then I might say that if someone makes it through that gauntlet (and everything I missed in between), they might just be a competent JS dev.
I've observed that the SJW hive think has skyrocketed over the last year on HN. I used to be able to predict ridicule in the comments, but instead I find pandering and PC nonsense. It's pretty depressing overall.
Try running a server which watches for file changes and then automatically recompiles without server restart, preferbly configured in the server instead of a CLI. I couldn't be nearly as productive with any other setup.
You sync your DB across multiple cloud services, and to decrypt you use a weak master pass and strong key.
I've been struggling with how to move that key around.
.1) Put it on a USB drive or hide it in your filesystem.
This is cumbersome and losing the drive could be disastrous. It's also trivial to scan a filesystem for key-like files.
.2) Use an authentication dongle.
This one is better but requires third party hardware in most cases, and is slightly expensive.
.3) Bluetooth/NFC to your device.
This can be intercepted at extended ranges as proven at defcon etc. Though is admittedly the most convenient method. The data can be signed, but I haven't seen anything out there that implements this well just yet.
.4) Timed one time passwords, PushBullet etc.
This feels like a bonus feature.
I'm not sure how to go about this. You lose or leak the key then you're screwed.
Is there a wristwatch or phone app with signed credential sharing based on wearer input, compatible to a standard?