Decoupled Django usually means that you are providing a client SPA with a API, such as a DRF powered REST API.
If you are using something like token auth (you mentioned JWT), then you are not using cookies, at which point CSRF is not needed. This is because the user's browser isn't automatically sending the cooking containing a session ID on every request to the server.
That said, you can implement session auth with DRF REST APIs, which accept a session cookie on requests. For this, I believe you would receive/send CSRF tokens via HTTP headers.
XSS is not something you would worry too much about in an API endpoint. It is something you should worry a lot about in your client side SPA though. If using something like React, your templates will be auto-escaped, and thus you have to go out of your way to make it a problem.
This is one of my favorite software development books of all time. It's the book that finally offered straight forward guidance and wisdom on how to properly utilize OOP language features.
Other languages do sometimes implement this at the library level. Clojure's core.async comes to mind (though there are subtle differences). There's downsides to this approach though.
The data going into each "mailbox" either needs to be immutable, or deep copied to be thread safe. This obviously comes at a cost. Sometimes you just have a huge amount of state that different threads need to work on, and the above solution isn't viable. Erlang has ets/dets to help deal with this. You will notice ets/dets looks nothing like the mailbox/process pattern.
Erlang is great, but it is hardly the "one true way". As with most things, tradeoffs are a thing, and usually the right solution comes down to "it depends".
QQQ has done great the last decade, but that's no guarantee it will outperform the next decade. Make sure you understand what you are getting yourself into by overweighting in the tech sector, and that it's a plan you can stick with during the hard times.
I don't quite see what the outbox pattern has to do with the two generals problem.
The point of the outbox pattern is that a durable record of the need to send an event is stored in the DB as part of the DB txn, taking advantage of ACID guarantees.
Once you have that durable record in your DB, you can essentially treat your DB as a queue (there's lot of great articles on how to do this with Postgres for instance) for some worker processes to later process the queue records, and send the events.
The worker processes in turn can decide if they want to attempt at least once, or at most once delivery of the message. Of course if you choose the later, then maybe your event is never sent, and perhaps that was the point you were trying to make to the interviewer.
They key takeaway though is that you are no longer reliant on the original process that stores the DB txn to also send the event, which can fail for any number of reasons, and may have no path to recovery. In other words, at least once delivery is now an option on the table.
The killer feature for me that Slack has over Discord is the ability to hide images, so I'm not stuck being distracted by some random person's obnoxious animated meme.
There's some arguments behind why you might want to not lay blame plainly (and especially publicly) on an individual, within a business team setting.
- Laying direct blame on someone may lead them to trying to hide problems to avoid the pain/shame in the future.
- Related - everyone makes honest mistakes. Creating and environment where people feel ok admitting to these is a lot more ideal than the alternative.
- Teams should be encouraged to take collective ownership, such that if someone who works with xyzelement sees them failing to prioritize, they need to do something about it, even if it's just raising a concern early in the project with those who need to hear said concern.
That all said, sometimes people do need direct feedback (in private), especially when they are struggling in general with their job.
For web development, it's more than powerful enough for anything I need (Python/Django/PostgreSQL work).
I'd probably be annoyed if doing anything CPU intensive (e.g. compiling C++ all day, ML, etc). Memory has never been a limiting factor as I don't run VMs.
Drug use was decriminalized in Portland OR by ballot measure, and it is not going well. Open air drug use, coupled with an increase in violence and crime have made being in large parts of downtown quite unbearable.
Filling prisons with drug users is probably not the answer, but just letting people do as they please because they are addicts with issues doesn't guarantee great outcomes either.
The biggest downside of Gevent IMO is that it enables the magic of turning sync code into async code via monkey patching things like the socket lib. This lack of explicitness can make things a bit difficult to reason about, without a good mental model of what Gevent is doing underneath the hood.
which errors out at runtime if `a` or `b` are omitted, despite being keyword arguments which are usually optional.