Having to explicitly opt out regardless of what you do is terrible. So now you're telling me that I have consciously disable it every time I create a new website/page? How do we force Google to stop this?

Maybe not node/python, but I'm pretty sure you can use terraform as a package in go. If not, there is always the "make temp dir, write/download files necessary tf files, run terraform apply"

Note upgrading to 0.13 is quite easy and terraform actually has a subcommand that does most of the work you (usually no additional steps required).

> I am already looking around for some way to remove Terraform from our org because it is slowly strangling our productivity.

The only other alternatives you have are Pulumi. All other alternatives are in my opinion, way worse. You can use ansible, which I'd even worse because you have to manage ansible version upgrades and have no way of figuring out what changes will be made (yes, --diff is usually useless). You can manage manually, but good luck. Lastly your option is CFN (or Azure/GCP equivalent) but then you have no way of managing anything outside of the cloud environment.

For me, the biggest thing is, when I go into AWS I struggle to find everything that is intrinsically linked to another resource. Say you have a lambda, to find which iam is linked to it, and what permissions it has is 2 separate tabs, then another for e.g. security groups, probably more tabs for other things. While using aws-cli makes it slightly easier, it's still a lot of effort to do this effectively.

With terraform I can look in one repo that has all the above, often in the same file too. Finding out what your infra looks like is a lot easier.

Regarding the state, you should not be touching your infra outside your code, if you do (e.g. while you're testing in dev), you should make the same changes in tf once you've confirmed it's what you want, and otherwise you undo those changes.

With further automation (e.g. tfcloud) you can even enforce these things by auto applying workspaces which ensures manual changes are always undone.

Terraform CLI introduced an upgrade command (can't remember what it's called) that automatically does this for you.

I switched to Bitwarden because it's open source, and because they have a good enough Linux client. Their browser extension and desktop client doesn't come close to what 1Password provided on Mac, but it does the job.

Bitwarden isn't without its issues, but at $10 a year, and its open source nature, it's worth every penny and then some.

This is not a good excuse for laziness.

> But not ever using a site because of it seems silly when it's literally a half-second longer click.

I highly disagree. With this site at least it is actually possible to leave. Many websites I've come across with this issue, it is entirely impossible to leave without physically holding down the back button in the browser to get a list of history items, and then clicking a site from earlier.

> (Also, for this site I don't actually see the bug. So either they fixed it very rapidly, or GP was just referring to individual searchers being in the history, which is common for any search engine.)

Looks like they've fixed it.

I'd never heard of 1Password before they were fully SaaS, but as I understand it, some of the original users were pretty upset with this move. Either way, I used to be a 1Password customer, and their product, at least on the Mac, was the most polished password manager.

> section.Object.get("reset_lesson_position").?.Bool

Also requiring the provide the type every time you retrieve an element from a JSON string again seems odd. JSON already has the data type, why do I need to provide the type every time I retrieve the data?

We are living in a day and age where applications ask for overbroad permissions for many reasons, laziness, privacy invasion, and even legitimate use. Forcing user interaction at worst raises awareness, at best prevents the privacy of individuals from being invaded.

I had a lot of issues with Brew, but the biggest one was how slow it was. Upgrading all packages on my Mac used to take hours.

EDIT: Never mind, found it - https://github.com/bitwarden/desktop/issues/552. This isn't exactly an RCE. You can say the same about anything. By your logic Microsoft auto-updates are RCE. Same with pacman/apt-get/yum package managers. Same with pretty much anything else.

I'm not saying they're not valid concerns, however, if you're this worried about all of these things, maybe cloud-based software isn't for you.

The server does not see the domains you have passwords for. The following data are saved in plaintext:

- A list of "equivalent domains" (this starts out with a default list, but individuals can change this). This totally can be used to deduce which websites you have an account for, but that's not really enough information, as most websites will not have an entry here.

- Some metadata such as your email, master password hint

- Most of the boolean values (mfa enabled, email verified, premium)

- Custom field types (types only, field name, and value are both encrypted)

- Revision date

- Bunch of UUIDs

Here is what a single password entry looks like when retrieved from the /sync endpoint, which happens before decryption: https://pastebin.com/FLr19qiN

> You have to trust the server also if you use the web client because the web client is loaded from the server.

This is true! However, the android app, cli, and other clients do not get loaded from the server, thus, in theory, you can inspect the source of them, possibly compile it yourself, and use that. In those scenarios you do not have to trust the server.