I'd love to see legislation that mandated a functioning web experience for critical services like this (banking, utilities, etc) - otherwise it will continue to further entrench the current duopoly.

(I suppose this is also an instance where I should do a better job of voting with my feet and supporting services that do offer this)

Eg: JDK + maven + junit + tomcat

Making these components pluggable is arguably how we get innovation (eg: yarn/pnpm, jest/vitest, etc)

The people in leadership positions should be active participants, and not all decisions will be ones they are are able to make locally - but they should feel comfortable to present a POV and recommendation/tradeoffs upwards when that's the case. If the buck stops with them then they should be aware that "do nothing" is a decision that they are making.

Spoiler: neither the commodity solution or the in-house solution will ever be perfect, and you should be really self critical of whether you're building something in-house to scratch your own itch.

If you can find a commodity solution with the right extension points that's often the best solution, failing that many times it's worth accepting the limitations, rarely it's worth investing in the totally bespoke thing (outside of your core domain/proposition).

My first thought was I hope they didn't make this mistake for everyone, and second thought how do I safely return this.

(Turns out it was a one off mistake, and returning the excess was pretty straightforward though probably the largest bank transfer I've ever made)

It also forces you to use DNS challenges, which means you don't require the publicly route able address.

Personally what I do is: - Predominantly use wildcards

- Run a tiny coredns instance with my A records for a internal subdomain of my normal domain

- Configure tailscale to use the coredns resolver

- Run two haproxy instances, one for internal services, one for public facing. The public facing one can't route directly to the internal services.

When even the obscure DNS provider I'm using is supported for DNS challenges, I really don't see much upside to using HTTP challenges anymore

It's the steam version, but Crusader Kings also hangs for a bit if you block it's network access

Not really an issue these days but it certainly was back in the day

The childcare cliff edge is probably the worst, but the personal allowance taper isn't ideal either as it's compressed over a relatively short income range

And of course all the thresholds remain frozen, creating plenty of fiscal drag on top.

The other part of the litmus test is "does the person submitting actually understand what they're submitting and why" - which is arguably not required for PRs that you'd otherwise accept, but since you have to put time and effort into determining whether a given contribution is ok to merge, it's common decency for the submitter to have done a self review first (AI or no AI)

(I'm not sure if there was a way around this, there may well have been but I had other things going on and sold for scrap)

There's plenty of comments mentioning delay lines, and the other good stuff pnpm (and others) have implemented in response to protect package consumers.

That bit that's getting less conversation is the tools on the package maintainer side:

- MFA for publishing: https://docs.npmjs.com/requiring-2fa-for-package-publishing-...

- trusted publishers, available for about a year: https://docs.npmjs.com/trusted-publishers

And as of recently, staged publishing, essentially combining the best of both those features: https://docs.npmjs.com/staged-publishing

Now you can: - Publish from CI, without static credentials

- AND require a maintainer to approve it using MFA before it actually goes live to the registry

If you want you can still use something like GitHub Actions Environments protection to require multiple approvals, or a time delay, on the CI side.

We need to encourage the community to adopt these publishing protections or this will continue to be an issue.

As best I can tell it doesn't do any batching of it's writes/reads, and it's update heavy in places rather than append (I suspect their cloud version might do some of these things)

It's pretty close to "let's make every function call serialise it's parameters/return value, go through a postgres table and several network hops"

That said it can be very useful, but it's a heavy tool that's best suited for high value/risk workflows where you're earning enough from the execution that you can afford the overhead (for example an Uber trip with several dollars of service fees is probably a good fit, unsurprisingly since it's roots are from Uber)

How do you avoid this pitfall?

If you have investments outside of an ISA (tax free investment wrapper) then same story - you need to report disposals and dividends for tax purposes.

That's before we get into side hustles/self employment and investment properties, etc.