Add a force tag, and update repos

re: https://github.com/artsy/force/pull/25

Proselint found issues
_posts/2014-07-09-retain-scroll-position-in-infinite-scroll.markdown

Line
Message
Severity

18
More than 30 ppm of exclamations. Keep them under control.
warning

_posts/2014-09-05-we-open-sourced-our-isomorphic-javascript-website.markdown

Line
Message
Severity

20
Substitute 'damn' every time you're inclined to write 'very;' your editor will delete it and the writing will be just as it should be.
warning

_posts/2014-09-12-designing-the-public-artsy-api.markdown

Line
Message
Severity

26
'back to the drawing board' is a cliché.
warning

26
Minimize your use of corporate catchphrases like this one.
warning

30
Substitute 'damn' every time you're inclined to write 'very;' your editor will delete it and the writing will be just as it should be. Found 5 times elsewhere.
warning

30
Comparison of an uncomparable: 'very complete.' is not comparable.
warning

64
Comparison of an uncomparable: 'more complete ' is not comparable.
warning

_posts/2014-09-24-launching-a-security-bug-bounty-program-at-artsy.markdown

Line
Message
Severity

32
Substitute 'damn' every time you're inclined to write 'very;' your editor will delete it and the writing will be just as it should be. Found 5 times elsewhere.
warning

104
Redundancy. Use 'every' instead of 'each and every'.
warning

_posts/2015-03-23-artsy-technology-stack-2015.markdown

Line
Message
Severity

30
Substitute 'damn' every time you're inclined to write 'very;' your editor will delete it and the writing will be just as it should be.
warning

_posts/2015-04-28-how-we-open-sourced-eigen.markdown

Line
Message
Severity

58
Substitute 'damn' every time you're inclined to write 'very;' your editor will delete it and the writing will be just as it should be.
warning

Spell Checker found issues
_posts/2014-07-09-retain-scroll-position-in-infinite-scroll.markdown

Line
Typo

12
ever little solution using an iframe.

16
n sourced this solution into [scrollFrame](https://github.com/artsy/scr

18
scrollFrame borrows from sites like Pinte

18
Frame borrows from sites like Pinterest that avoid this problem by op

18
your entire page client-side, scrollFrame will intercept your click and

18
and open the next page in an iframe that sits on top of your curr

18
t doesn't look like a modal). scrollFrame will then hook into the [HTML

18
rame will then hook into the [HTML5 history API](https://develope

18
rowser_history) to remove the iframe modal on back button and keep

20
scrollFrame only solves this specific pro

_posts/2014-09-05-we-open-sourced-our-isomorphic-javascript-website.markdown

Line
Typo

12
we've open sourced the entire Artsy.net web app, [Force](https://gith

14
o move off Rails and on to a **Node.js** stack th

14
odejs.org/) stack that shares Javascript code and rendering between th

14
therwise known as [Isomorphic Javascript](http://nerds.airbnb.com/isom

14
pen-sourced our boilerplate, **Ezel,** and have

14
step further and open sourced Artsy.net.

20
r transition to an isomorphic Javascript stack has been very successfu

22
o a couple of Node servers on Heroku. This vastly improved the per

22
speed. Using the patterns in Ezel, we are able to tailor assets

22
t our page-load in half (from 6.5 seconds to under 3 seconds) a

22
lf (from 6.5 seconds to under 3 seconds) and our tests take a

22
nds) and our tests take about 5 minutes (down from around 5 h

22
t 5 minutes (down from around 5 hours!) with little reduction

30
page, we simply started a new about2 app along side our old about

30
let us push code into the new about2 app with confidence it wasn't

30
lder and search and replaced "about2" to "about". There was no nee

30
no need to dig around various stylesheets, views, etc. folders looking

34
important that we've updated Ezel to [use app/component-level p

40
dules such as [these backbone mixins](https://github.com/artsy/art

42
pment. To do this we wrote a .env file and uploaded it as a pri

42
lture so we decided to update Ezel's configuration to be able to u

42
guration to be able to use a .env file in this way as well. Thi

42
u can read more about this in Ezel's [Build Scripts & Configuratio

46
of how we structured a large **Ezel** project a

46
ee to hit us up on twitter: [@craigspaeth](https://twitter.com/craigspa

46
//twitter.com/craigspaeth), [@dzucconi](https://twitter.com/dzucconi

46
ps://twitter.com/dzucconi), @zamiang

_posts/2014-09-12-designing-the-public-artsy-api.markdown

Line
Typo

10
ly available, along with over 26,000 artworks from many of our

10
available, along with over 26,000 artworks from many of our ins

12
k and related information on **artsy.net** for educa

16
reading here and head to the [developers.artsy.net](https://developers.artsy.net

16
e itself is a classic Rails + Boootstrap example and is also [open-sou

24
Artsy has been developing a homegrown API over the last four years,

24
r years, consisting of almost 400 endpoints and exposing over 1

24
0 endpoints and exposing over 100 domain models. It's probably

24
th our [recently open-sourced artsy.net website](https://github.com/a

32
ts all the API routes within "_links", such as "artists".

64
y, we provide examples using [hyperclient](https://github.com/codegram/

64
a well-known artist, [Gustav Klimt](https://artsy.net/artist/gus

84
developed solutions such as [mongoid-cached-json](https://github.com/dblock/mo

86
because every single URL maps 1:1 with a specific JSON respon

86
cause every single URL maps 1:1 with a specific JSON response

92
or not. The API will return a 403 or 404 otherwise and it's not

92
The API will return a 403 or 404 otherwise and it's not necess

94
iplined About Data Access and NxM Queries

96
ossible, often requiring many NxM server-side queries. This act

96
/garner) and had to fine-tune Mongoid's eager-loading endpoint by end

116
e do have embedded objects in MongoDB and the fact that HAL support

122
versioned URL which includes "v1". For the new API we decided

122
akes an optional "application/vnd.artsy-v2+json" media type.

122
tional "application/vnd.artsy-v2+json" media type.

122
nal "application/vnd.artsy-v2+json" media type.

130
at API Structure and Leverage 302 Redirects

134
works" and "/artworks/:artwork**_id".** At the Hypermedia API root

151
We leverage 302 redirects extensively. For ex

151
or example, querying "/current**_user"** redirects to "/users/:user_i

151
er" redirects to "/users/:user**_id"** with a 302 status code (we c

151
s to "/users/:user_id" with a 302 status code (we cannot serve

155
happens when you are on page 5 and an item is inserted on pa

155
d an item is inserted on page 4. Your next set of results for

155
next set of results for page 6 will include a duplicate that

155
that has just moved from page 5 onto page 6. Similarly, if an

155
t moved from page 5 onto page 6. Similarly, if an item was re

155
an item was removed from page 4, a request to page 6 will ski

155
rom page 4, a request to page 6 will skip an item that now ap

155
item that now appears on page 5.

157
rsor" (internally we use the [mongoid-scroll](https://github.com/dblock/mo

175
To get the "total**_count",** we decided to require clien

175
uire clients to append "?total**_count=true"** to the query string. It

179
d a "message". For example, a 401 Unauthorized response will al

190
ll give our new API a try at [developers.artsy.net](https://developers.artsy.net

_posts/2014-09-24-launching-a-security-bug-bounty-program-at-artsy.markdown

Line
Typo

10
. Some use services, such as **HackerOne** or [B

10
e](https://hackerone.com) or **BugCrowd.** In ea

10
rowd.com). In early September 2014 we quietly launched [our own

10
ty). Since then we have fixed 14 issues reported by 15 securit

10
e fixed 14 issues reported by 15 security researchers and paid

10
ecurity researchers and paid $750 in bounty. In the process we

20
ng in countries that may have U.S. sanctions imposed on them (se

20
ed to worry about in terms of U.S. sanctions?](http://www.treasu

20
r bounty programs, including **Github's,**

20
unty.github.com/), require a [W9](http://www.irs.gov/pub/irs-p

20
.gov/pub/irs-pdf/fw9.pdf) for U.S. citizens or a [W8_BEN](http:/

20
.pdf) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/i

20
df) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/irs-p

22
expected to pay. With about $50 a bug I estimated that this p

22
ogram would not exceed about $1,000 in the first few months,

22
ram would not exceed about $1,000 in the first few months, with

24
ear that every dollar of the $1,000 spent each month is worth

24
r that every dollar of the $1,000 spent each month is worth eve

32
rnal bug tracking systems. We labeled every issue as "Security Boun

42
### SSL, Secure Cookies and HSTS

44
If you let users signup and log-in or enter any perso

44
quests. Also you must enable [HSTS](https://scotthelme.co.uk/hst

46
In Rails, HSTS is turned on with `config.for

46
config.force_ssl = true. In node.js applications we use [an HSTS

46
de.js applications we use [an HSTS middleware](https://github.co

48
t. This is mitigated by using HSTS and by making sure session co

54
ails, and can be turned on in node.js applications with [helmet](ht

58
ing for Cross-Site Scripting (XSS) vulnerabilities in your code

58
via != in Jade templates or HAML. Track down how this data is

58
. Track down how this data is inputted into the system and check whe

58
or how to deal with this in a node.js app.

64
sion cookie in a new browser, your're not actually logging users ou

66
mparing it after a session is deserialized.

74
login. This, combined with an XSS, would leak your session cook

74
e, this can be a source of an XSS by itself with data URLs, som

78
ren't loading insecure (HTTP) javascript. A man-in-the-middle attack w

82
in our program's description. Here're a few examples.

86
ll eventually have all of the 11 billion people on Artsy and t

90
CSRF is a class of attacks that at

90
hin a certain period of time. CSRF was disabled on Artsy followi

98
specially if you use multiple thirdparty services for delivering e-mai

_posts/2015-03-23-artsy-technology-stack-2015.markdown

Line
Typo

10
Artsy has now grown past 100 team members and our Engineer

10
gineering organization is now 20 strong. For a brief overview

10
ast two years, check out our **2013** and [

10
](http://2013.artsy.net) and **2014** revie

12
en Artsy launched publicly in 2012.

22
you see today when you go to **www.artsy.net** is a

22
net) is a website built with **Ezel.js,** which is

22
s](http://expressjs.com) and **Browserify.** The

22
(http://browserify.org). The [CoffeeScript code](https://github.com/arts

22
source. The mobile version of www.artsy.net is [m.artsy.net](https://m.ar

22
version of www.artsy.net is **m.artsy.net** and is

22
same technology. Both run on **Heroku** and use [

22
](http://heroku.com) and use **Redis** for caching

22
ages, are served from Amazon **S3** v

22
/aws.amazon.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cl

22
.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cloudf

26
ith. The API service runs on [AWS OpsWorks](http://aws.amazon.c

26
The API service runs on [AWS OpsWorks](http://aws.amazon.com/opswor

26
retrieves data from several **MongoDB** data

26
ose.io). It also uses [Apache Solr](http://lucene.apache.org/sol

26
rvice also heavily relies on **Memcached.**

30
uilt entirely from scratch in 2014 on Ruby-on-Rails. This was a

38
in Ruby or by [Amazon Elastic MapReduce](http://aws.amazon.com/elasti

38
. We take data snapshots from MongoDB, run jobs on the data and exp

38
Several new applications use **PostgreSQL.**

40
ious front-ends pipe data to [Snowplow](https://github.com/snowplow/

40
//www.google.com/analytics), **MixPanel** and [C

40
l](https://mixpanel.com) and **ChartBeat.** Some

40
. Some data is warehoused in [AWS Redshift](http://aws.amazon.c

40
me data is warehoused in [AWS Redshift](http://aws.amazon.com/redshi

40
aws.amazon.com/redshift) and **PostgreSQL** a

40
ww.postgresql.org) and may be analyzed offline using [R](http://www.

40
http://www.r-project.org) or [iPython Notebooks](http://ipython.org

40
tebook.html). We also have a [Statsd](https://github.com/etsy/stat

40
read-only Rails console or in Redshift directly querying data.

42
send millions of e-mails via **SendGrid** and [M

42
ttps://mandrill.com) and use **MailChimp** for ma

44
ler systems usually start on [Heroku](https://dashboard.heroku.com

44
workloads usually end up on [AWS OpsWorks](http://aws.amazon.c

44
kloads usually end up on [AWS OpsWorks](http://aws.amazon.com/opswor

44
c](http://newrelic.com/) and **Pingdom.** Al

48
ineering workflow we live in **Github** and [Tre

48
hub](https://github.com) and **Trello.** We tend

50
In 2015 we intend to complete our tra

50
dependent services built with 10x growth in mind. We can then f

52
e e-mail<EMAIL_ADDRESS>if you wa

_posts/2015-04-28-how-we-open-sourced-eigen.markdown

Line
Typo

11
It was 95 days ago, and I was sitting b

11
I loaded my terminal, opened **TapTalk** on my ph

11
me) on my phone, tapped on my collegue Ash's

16
en" lang="en">We have open source’d the <a href="https://twitter.

16
gy

🎉— Ørta (@orta) January 22, 2015

16
8395611754819586">January 22, 2015

24
due, when we were [working on Eidolon](/blog/2014/11/13/eidolon-ret

24
/eidolon-retrospective/), our CTO dB

24
tossed the idea that, really, Eigen should be open source too. Ei

24
en should be open source too. Eigen is the code name for the [Art

26
We devoted time at the end of 2014 to understand what the constr

32
eigen to eigen-private on github, and did a fresh git init.

36
r. As the switch happened the WatchKit came out, and we had devoted

42
easy to look at the source on github but to be able to get it up a

44
ted-asc) of documentation fix PRs - thanks segiddins, *neonic

44
cumentation fix PRs - thanks s**egiddins,** neonichu and dkhamsing.

44
ix PRs - thanks segiddins, neonichu and dkhamsing. They have l

44
segiddins, neonichu and d**khamsing.** They have low barriers to e

50
app, we had no crazy internal SDKs or anything worth hiding with

54
I can enact change. I felt no resistence in the process. I kept offeri

54
team as I started the process 2 weeks before it happened, I t

63
3 months on the way we operate

63
a lot more organized, and the Eigen repo is easily the most well

63
d our workflow on other apps. Eidolon for example now runs with a s

67
artsy/eigen/issues/313) about Eigen itself. This was an unexpecte

75
ersonally, my email is on my [github profile](https://github.com/o

Spell Checker found issues
_posts/2014-07-09-retain-scroll-position-in-infinite-scroll.markdown

Line
Typo

12
ever little solution using an iframe.

16
n sourced this solution into [scrollFrame](https://github.com/artsy/scr

18
scrollFrame borrows from sites like Pinte

18
Frame borrows from sites like Pinterest that avoid this problem by op

18
your entire page client-side, scrollFrame will intercept your click and

18
and open the next page in an iframe that sits on top of your curr

18
t doesn't look like a modal). scrollFrame will then hook into the [HTML

18
rame will then hook into the [HTML5 history API](https://develope

18
rowser_history) to remove the iframe modal on back button and keep

20
scrollFrame only solves this specific pro

_posts/2014-09-05-we-open-sourced-our-isomorphic-javascript-website.markdown

Line
Typo

12
we've open sourced the entire Artsy.net web app, [Force](https://gith

14
o move off Rails and on to a **Node.js** stack th

14
odejs.org/) stack that shares Javascript code and rendering between th

14
therwise known as [Isomorphic Javascript](http://nerds.airbnb.com/isom

14
pen-sourced our boilerplate, **Ezel,** and have

14
step further and open sourced Artsy.net.

20
r transition to an isomorphic Javascript stack has been very successfu

22
o a couple of Node servers on Heroku. This vastly improved the per

22
speed. Using the patterns in Ezel, we are able to tailor assets

22
t our page-load in half (from 6.5 seconds to under 3 seconds) a

22
lf (from 6.5 seconds to under 3 seconds) and our tests take a

22
nds) and our tests take about 5 minutes (down from around 5 h

22
t 5 minutes (down from around 5 hours!) with little reduction

30
page, we simply started a new about2 app along side our old about

30
let us push code into the new about2 app with confidence it wasn't

30
lder and search and replaced "about2" to "about". There was no nee

30
no need to dig around various stylesheets, views, etc. folders looking

34
important that we've updated Ezel to [use app/component-level p

40
dules such as [these backbone mixins](https://github.com/artsy/art

42
pment. To do this we wrote a .env file and uploaded it as a pri

42
lture so we decided to update Ezel's configuration to be able to u

42
guration to be able to use a .env file in this way as well. Thi

42
u can read more about this in Ezel's [Build Scripts & Configuratio

46
of how we structured a large **Ezel** project a

46
ee to hit us up on twitter: [@craigspaeth](https://twitter.com/craigspa

46
//twitter.com/craigspaeth), [@dzucconi](https://twitter.com/dzucconi

46
ps://twitter.com/dzucconi), @zamiang

_posts/2014-09-12-designing-the-public-artsy-api.markdown

Line
Typo

10
ly available, along with over 26,000 artworks from many of our

10
available, along with over 26,000 artworks from many of our ins

12
k and related information on **artsy.net** for educa

16
reading here and head to the [developers.artsy.net](https://developers.artsy.net

16
e itself is a classic Rails + Boootstrap example and is also [open-sou

24
Artsy has been developing a homegrown API over the last four years,

24
r years, consisting of almost 400 endpoints and exposing over 1

24
0 endpoints and exposing over 100 domain models. It's probably

24
th our [recently open-sourced artsy.net website](https://github.com/a

32
ts all the API routes within "_links", such as "artists".

64
y, we provide examples using [hyperclient](https://github.com/codegram/

64
a well-known artist, [Gustav Klimt](https://artsy.net/artist/gus

84
developed solutions such as [mongoid-cached-json](https://github.com/dblock/mo

86
because every single URL maps 1:1 with a specific JSON respon

86
cause every single URL maps 1:1 with a specific JSON response

92
or not. The API will return a 403 or 404 otherwise and it's not

92
The API will return a 403 or 404 otherwise and it's not necess

94
iplined About Data Access and NxM Queries

96
ossible, often requiring many NxM server-side queries. This act

96
/garner) and had to fine-tune Mongoid's eager-loading endpoint by end

116
e do have embedded objects in MongoDB and the fact that HAL support

122
versioned URL which includes "v1". For the new API we decided

122
akes an optional "application/vnd.artsy-v2+json" media type.

122
tional "application/vnd.artsy-v2+json" media type.

122
nal "application/vnd.artsy-v2+json" media type.

130
at API Structure and Leverage 302 Redirects

134
works" and "/artworks/:artwork**_id".** At the Hypermedia API root

151
We leverage 302 redirects extensively. For ex

151
or example, querying "/current**_user"** redirects to "/users/:user_i

151
er" redirects to "/users/:user**_id"** with a 302 status code (we c

151
s to "/users/:user_id" with a 302 status code (we cannot serve

155
happens when you are on page 5 and an item is inserted on pa

155
d an item is inserted on page 4. Your next set of results for

155
next set of results for page 6 will include a duplicate that

155
that has just moved from page 5 onto page 6. Similarly, if an

155
t moved from page 5 onto page 6. Similarly, if an item was re

155
an item was removed from page 4, a request to page 6 will ski

155
rom page 4, a request to page 6 will skip an item that now ap

155
item that now appears on page 5.

157
rsor" (internally we use the [mongoid-scroll](https://github.com/dblock/mo

175
To get the "total**_count",** we decided to require clien

175
uire clients to append "?total**_count=true"** to the query string. It

179
d a "message". For example, a 401 Unauthorized response will al

190
ll give our new API a try at [developers.artsy.net](https://developers.artsy.net

_posts/2014-09-24-launching-a-security-bug-bounty-program-at-artsy.markdown

Line
Typo

10
. Some use services, such as **HackerOne** or [B

10
e](https://hackerone.com) or **BugCrowd.** In ea

10
rowd.com). In early September 2014 we quietly launched [our own

10
ty). Since then we have fixed 14 issues reported by 15 securit

10
e fixed 14 issues reported by 15 security researchers and paid

10
ecurity researchers and paid $750 in bounty. In the process we

20
ng in countries that may have U.S. sanctions imposed on them (se

20
ed to worry about in terms of U.S. sanctions?](http://www.treasu

20
r bounty programs, including **Github's,**

20
unty.github.com/), require a [W9](http://www.irs.gov/pub/irs-p

20
.gov/pub/irs-pdf/fw9.pdf) for U.S. citizens or a [W8_BEN](http:/

20
.pdf) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/i

20
df) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/irs-p

22
expected to pay. With about $50 a bug I estimated that this p

22
ogram would not exceed about $1,000 in the first few months,

22
ram would not exceed about $1,000 in the first few months, with

24
ear that every dollar of the $1,000 spent each month is worth

24
r that every dollar of the $1,000 spent each month is worth eve

32
rnal bug tracking systems. We labeled every issue as "Security Boun

42
### SSL, Secure Cookies and HSTS

44
If you let users signup and log-in or enter any perso

44
quests. Also you must enable [HSTS](https://scotthelme.co.uk/hst

46
In Rails, HSTS is turned on with `config.for

46
config.force_ssl = true. In node.js applications we use [an HSTS

46
de.js applications we use [an HSTS middleware](https://github.co

48
t. This is mitigated by using HSTS and by making sure session co

54
ails, and can be turned on in node.js applications with [helmet](ht

58
ing for Cross-Site Scripting (XSS) vulnerabilities in your code

58
via != in Jade templates or HAML. Track down how this data is

58
. Track down how this data is inputted into the system and check whe

58
or how to deal with this in a node.js app.

64
sion cookie in a new browser, your're not actually logging users ou

66
mparing it after a session is deserialized.

74
login. This, combined with an XSS, would leak your session cook

74
e, this can be a source of an XSS by itself with data URLs, som

78
ren't loading insecure (HTTP) javascript. A man-in-the-middle attack w

82
in our program's description. Here're a few examples.

86
ll eventually have all of the 11 billion people on Artsy and t

90
CSRF is a class of attacks that at

90
hin a certain period of time. CSRF was disabled on Artsy followi

98
specially if you use multiple thirdparty services for delivering e-mai

_posts/2015-03-23-artsy-technology-stack-2015.markdown

Line
Typo

10
Artsy has now grown past 100 team members and our Engineer

10
gineering organization is now 20 strong. For a brief overview

10
ast two years, check out our **2013** and [

10
](http://2013.artsy.net) and **2014** revie

12
en Artsy launched publicly in 2012.

22
you see today when you go to **www.artsy.net** is a

22
net) is a website built with **Ezel.js,** which is

22
s](http://expressjs.com) and **Browserify.** The

22
(http://browserify.org). The [CoffeeScript code](https://github.com/arts

22
source. The mobile version of www.artsy.net is [m.artsy.net](https://m.ar

22
version of www.artsy.net is **m.artsy.net** and is

22
same technology. Both run on **Heroku** and use [

22
](http://heroku.com) and use **Redis** for caching

22
ages, are served from Amazon **S3** v

22
/aws.amazon.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cl

22
.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cloudf

26
ith. The API service runs on [AWS OpsWorks](http://aws.amazon.c

26
The API service runs on [AWS OpsWorks](http://aws.amazon.com/opswor

26
retrieves data from several **MongoDB** data

26
ose.io). It also uses [Apache Solr](http://lucene.apache.org/sol

26
rvice also heavily relies on **Memcached.**

30
uilt entirely from scratch in 2014 on Ruby-on-Rails. This was a

38
in Ruby or by [Amazon Elastic MapReduce](http://aws.amazon.com/elasti

38
. We take data snapshots from MongoDB, run jobs on the data and exp

38
Several new applications use **PostgreSQL.**

40
ious front-ends pipe data to [Snowplow](https://github.com/snowplow/

40
//www.google.com/analytics), **MixPanel** and [C

40
l](https://mixpanel.com) and **ChartBeat.** Some

40
. Some data is warehoused in [AWS Redshift](http://aws.amazon.c

40
me data is warehoused in [AWS Redshift](http://aws.amazon.com/redshi

40
aws.amazon.com/redshift) and **PostgreSQL** a

40
ww.postgresql.org) and may be analyzed offline using [R](http://www.

40
http://www.r-project.org) or [iPython Notebooks](http://ipython.org

40
tebook.html). We also have a [Statsd](https://github.com/etsy/stat

40
read-only Rails console or in Redshift directly querying data.

42
send millions of e-mails via **SendGrid** and [M

42
ttps://mandrill.com) and use **MailChimp** for ma

44
ler systems usually start on [Heroku](https://dashboard.heroku.com

44
workloads usually end up on [AWS OpsWorks](http://aws.amazon.c

44
kloads usually end up on [AWS OpsWorks](http://aws.amazon.com/opswor

44
c](http://newrelic.com/) and **Pingdom.** Al

48
ineering workflow we live in **Github** and [Tre

48
hub](https://github.com) and **Trello.** We tend

50
In 2015 we intend to complete our tra

50
dependent services built with 10x growth in mind. We can then f

52
e e-mail<EMAIL_ADDRESS>if you wa

_posts/2015-04-28-how-we-open-sourced-eigen.markdown

Line
Typo

11
It was 95 days ago, and I was sitting b

11
I loaded my terminal, opened **TapTalk** on my ph

11
me) on my phone, tapped on my collegue Ash's

16
en" lang="en">We have open source’d the <a href="https://twitter.

16
gy

🎉— Ørta (@orta) January 22, 2015

16
8395611754819586">January 22, 2015

24
due, when we were [working on Eidolon](/blog/2014/11/13/eidolon-ret

24
/eidolon-retrospective/), our CTO dB

24
tossed the idea that, really, Eigen should be open source too. Ei

24
en should be open source too. Eigen is the code name for the [Art

26
We devoted time at the end of 2014 to understand what the constr

32
eigen to eigen-private on github, and did a fresh git init.

36
r. As the switch happened the WatchKit came out, and we had devoted

42
easy to look at the source on github but to be able to get it up a

44
ted-asc) of documentation fix PRs - thanks segiddins, *neonic

44
cumentation fix PRs - thanks s**egiddins,** neonichu and dkhamsing.

44
ix PRs - thanks segiddins, neonichu and dkhamsing. They have l

44
segiddins, neonichu and d**khamsing.** They have low barriers to e

50
app, we had no crazy internal SDKs or anything worth hiding with

54
I can enact change. I felt no resistence in the process. I kept offeri

54
team as I started the process 2 weeks before it happened, I t

63
3 months on the way we operate

63
a lot more organized, and the Eigen repo is easily the most well

63
d our workflow on other apps. Eidolon for example now runs with a s

67
artsy/eigen/issues/313) about Eigen itself. This was an unexpecte

75
ersonally, my email is on my [github profile](https://github.com/o

Spell Checker found issues
_posts/2014-07-09-retain-scroll-position-in-infinite-scroll.markdown

Line
Typo

12
ever little solution using an iframe.

16
n sourced this solution into [scrollFrame](https://github.com/artsy/scr

18
scrollFrame borrows from sites like Pinte

18
Frame borrows from sites like Pinterest that avoid this problem by op

18
your entire page client-side, scrollFrame will intercept your click and

18
and open the next page in an iframe that sits on top of your curr

18
t doesn't look like a modal). scrollFrame will then hook into the [HTML

18
rame will then hook into the [HTML5 history API](https://develope

18
rowser_history) to remove the iframe modal on back button and keep

20
scrollFrame only solves this specific pro

_posts/2014-09-05-we-open-sourced-our-isomorphic-javascript-website.markdown

Line
Typo

12
we've open sourced the entire Artsy.net web app, [Force](https://gith

14
o move off Rails and on to a **Node.js** stack th

14
odejs.org/) stack that shares Javascript code and rendering between th

14
therwise known as [Isomorphic Javascript](http://nerds.airbnb.com/isom

14
pen-sourced our boilerplate, **Ezel,** and have

14
step further and open sourced Artsy.net.

20
r transition to an isomorphic Javascript stack has been very successfu

22
o a couple of Node servers on Heroku. This vastly improved the per

22
speed. Using the patterns in Ezel, we are able to tailor assets

22
t our page-load in half (from 6.5 seconds to under 3 seconds) a

22
lf (from 6.5 seconds to under 3 seconds) and our tests take a

22
nds) and our tests take about 5 minutes (down from around 5 h

22
t 5 minutes (down from around 5 hours!) with little reduction

30
page, we simply started a new about2 app along side our old about

30
let us push code into the new about2 app with confidence it wasn't

30
lder and search and replaced "about2" to "about". There was no nee

30
no need to dig around various stylesheets, views, etc. folders looking

34
important that we've updated Ezel to [use app/component-level p

40
dules such as [these backbone mixins](https://github.com/artsy/art

42
pment. To do this we wrote a .env file and uploaded it as a pri

42
lture so we decided to update Ezel's configuration to be able to u

42
guration to be able to use a .env file in this way as well. Thi

42
u can read more about this in Ezel's [Build Scripts & Configuratio

46
of how we structured a large **Ezel** project a

46
ee to hit us up on twitter: [@craigspaeth](https://twitter.com/craigspa

46
//twitter.com/craigspaeth), [@dzucconi](https://twitter.com/dzucconi

46
ps://twitter.com/dzucconi), @zamiang

_posts/2014-09-12-designing-the-public-artsy-api.markdown

Line
Typo

10
ly available, along with over 26,000 artworks from many of our

10
available, along with over 26,000 artworks from many of our ins

12
k and related information on **artsy.net** for educa

16
reading here and head to the [developers.artsy.net](https://developers.artsy.net

16
e itself is a classic Rails + Boootstrap example and is also [open-sou

24
Artsy has been developing a homegrown API over the last four years,

24
r years, consisting of almost 400 endpoints and exposing over 1

24
0 endpoints and exposing over 100 domain models. It's probably

24
th our [recently open-sourced artsy.net website](https://github.com/a

32
ts all the API routes within "_links", such as "artists".

64
y, we provide examples using [hyperclient](https://github.com/codegram/

64
a well-known artist, [Gustav Klimt](https://artsy.net/artist/gus

84
developed solutions such as [mongoid-cached-json](https://github.com/dblock/mo

86
because every single URL maps 1:1 with a specific JSON respon

86
cause every single URL maps 1:1 with a specific JSON response

92
or not. The API will return a 403 or 404 otherwise and it's not

92
The API will return a 403 or 404 otherwise and it's not necess

94
iplined About Data Access and NxM Queries

96
ossible, often requiring many NxM server-side queries. This act

96
/garner) and had to fine-tune Mongoid's eager-loading endpoint by end

116
e do have embedded objects in MongoDB and the fact that HAL support

122
versioned URL which includes "v1". For the new API we decided

122
akes an optional "application/vnd.artsy-v2+json" media type.

122
tional "application/vnd.artsy-v2+json" media type.

122
nal "application/vnd.artsy-v2+json" media type.

130
at API Structure and Leverage 302 Redirects

134
works" and "/artworks/:artwork**_id".** At the Hypermedia API root

151
We leverage 302 redirects extensively. For ex

151
or example, querying "/current**_user"** redirects to "/users/:user_i

151
er" redirects to "/users/:user**_id"** with a 302 status code (we c

151
s to "/users/:user_id" with a 302 status code (we cannot serve

155
happens when you are on page 5 and an item is inserted on pa

155
d an item is inserted on page 4. Your next set of results for

155
next set of results for page 6 will include a duplicate that

155
that has just moved from page 5 onto page 6. Similarly, if an

155
t moved from page 5 onto page 6. Similarly, if an item was re

155
an item was removed from page 4, a request to page 6 will ski

155
rom page 4, a request to page 6 will skip an item that now ap

155
item that now appears on page 5.

157
rsor" (internally we use the [mongoid-scroll](https://github.com/dblock/mo

175
To get the "total**_count",** we decided to require clien

175
uire clients to append "?total**_count=true"** to the query string. It

179
d a "message". For example, a 401 Unauthorized response will al

190
ll give our new API a try at [developers.artsy.net](https://developers.artsy.net

_posts/2014-09-24-launching-a-security-bug-bounty-program-at-artsy.markdown

Line
Typo

10
. Some use services, such as **HackerOne** or [B

10
e](https://hackerone.com) or **BugCrowd.** In ea

10
rowd.com). In early September 2014 we quietly launched [our own

10
ty). Since then we have fixed 14 issues reported by 15 securit

10
e fixed 14 issues reported by 15 security researchers and paid

10
ecurity researchers and paid $750 in bounty. In the process we

20
ng in countries that may have U.S. sanctions imposed on them (se

20
ed to worry about in terms of U.S. sanctions?](http://www.treasu

20
r bounty programs, including **Github's,**

20
unty.github.com/), require a [W9](http://www.irs.gov/pub/irs-p

20
.gov/pub/irs-pdf/fw9.pdf) for U.S. citizens or a [W8_BEN](http:/

20
.pdf) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/i

20
df) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/irs-p

22
expected to pay. With about $50 a bug I estimated that this p

22
ogram would not exceed about $1,000 in the first few months,

22
ram would not exceed about $1,000 in the first few months, with

24
ear that every dollar of the $1,000 spent each month is worth

24
r that every dollar of the $1,000 spent each month is worth eve

32
rnal bug tracking systems. We labeled every issue as "Security Boun

42
### SSL, Secure Cookies and HSTS

44
If you let users signup and log-in or enter any perso

44
quests. Also you must enable [HSTS](https://scotthelme.co.uk/hst

46
In Rails, HSTS is turned on with `config.for

46
config.force_ssl = true. In node.js applications we use [an HSTS

46
de.js applications we use [an HSTS middleware](https://github.co

48
t. This is mitigated by using HSTS and by making sure session co

54
ails, and can be turned on in node.js applications with [helmet](ht

58
ing for Cross-Site Scripting (XSS) vulnerabilities in your code

58
via != in Jade templates or HAML. Track down how this data is

58
. Track down how this data is inputted into the system and check whe

58
or how to deal with this in a node.js app.

64
sion cookie in a new browser, your're not actually logging users ou

66
mparing it after a session is deserialized.

74
login. This, combined with an XSS, would leak your session cook

74
e, this can be a source of an XSS by itself with data URLs, som

78
ren't loading insecure (HTTP) javascript. A man-in-the-middle attack w

82
in our program's description. Here're a few examples.

86
ll eventually have all of the 11 billion people on Artsy and t

90
CSRF is a class of attacks that at

90
hin a certain period of time. CSRF was disabled on Artsy followi

98
specially if you use multiple thirdparty services for delivering e-mai

_posts/2015-03-23-artsy-technology-stack-2015.markdown

Line
Typo

10
Artsy has now grown past 100 team members and our Engineer

10
gineering organization is now 20 strong. For a brief overview

10
ast two years, check out our **2013** and [

10
](http://2013.artsy.net) and **2014** revie

12
en Artsy launched publicly in 2012.

22
you see today when you go to **www.artsy.net** is a

22
net) is a website built with **Ezel.js,** which is

22
s](http://expressjs.com) and **Browserify.** The

22
(http://browserify.org). The [CoffeeScript code](https://github.com/arts

22
source. The mobile version of www.artsy.net is [m.artsy.net](https://m.ar

22
version of www.artsy.net is **m.artsy.net** and is

22
same technology. Both run on **Heroku** and use [

22
](http://heroku.com) and use **Redis** for caching

22
ages, are served from Amazon **S3** v

22
/aws.amazon.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cl

22
.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cloudf

26
ith. The API service runs on [AWS OpsWorks](http://aws.amazon.c

26
The API service runs on [AWS OpsWorks](http://aws.amazon.com/opswor

26
retrieves data from several **MongoDB** data

26
ose.io). It also uses [Apache Solr](http://lucene.apache.org/sol

26
rvice also heavily relies on **Memcached.**

30
uilt entirely from scratch in 2014 on Ruby-on-Rails. This was a

38
in Ruby or by [Amazon Elastic MapReduce](http://aws.amazon.com/elasti

38
. We take data snapshots from MongoDB, run jobs on the data and exp

38
Several new applications use **PostgreSQL.**

40
ious front-ends pipe data to [Snowplow](https://github.com/snowplow/

40
//www.google.com/analytics), **MixPanel** and [C

40
l](https://mixpanel.com) and **ChartBeat.** Some

40
. Some data is warehoused in [AWS Redshift](http://aws.amazon.c

40
me data is warehoused in [AWS Redshift](http://aws.amazon.com/redshi

40
aws.amazon.com/redshift) and **PostgreSQL** a

40
ww.postgresql.org) and may be analyzed offline using [R](http://www.

40
http://www.r-project.org) or [iPython Notebooks](http://ipython.org

40
tebook.html). We also have a [Statsd](https://github.com/etsy/stat

40
read-only Rails console or in Redshift directly querying data.

42
send millions of e-mails via **SendGrid** and [M

42
ttps://mandrill.com) and use **MailChimp** for ma

44
ler systems usually start on [Heroku](https://dashboard.heroku.com

44
workloads usually end up on [AWS OpsWorks](http://aws.amazon.c

44
kloads usually end up on [AWS OpsWorks](http://aws.amazon.com/opswor

44
c](http://newrelic.com/) and **Pingdom.** Al

48
ineering workflow we live in **Github** and [Tre

48
hub](https://github.com) and **Trello.** We tend

50
In 2015 we intend to complete our tra

50
dependent services built with 10x growth in mind. We can then f

52
e e-mail<EMAIL_ADDRESS>if you wa

_posts/2015-04-28-how-we-open-sourced-eigen.markdown

Line
Typo

11
It was 95 days ago, and I was sitting b

11
I loaded my terminal, opened **TapTalk** on my ph

11
me) on my phone, tapped on my collegue Ash's

16
en" lang="en">We have open source’d the <a href="https://twitter.

16
gy

🎉— Ørta (@orta) January 22, 2015

16
8395611754819586">January 22, 2015

24
due, when we were [working on Eidolon](/blog/2014/11/13/eidolon-ret

24
/eidolon-retrospective/), our CTO dB

24
tossed the idea that, really, Eigen should be open source too. Ei

24
en should be open source too. Eigen is the code name for the [Art

26
We devoted time at the end of 2014 to understand what the constr

32
eigen to eigen-private on github, and did a fresh git init.

36
r. As the switch happened the WatchKit came out, and we had devoted

42
easy to look at the source on github but to be able to get it up a

44
ted-asc) of documentation fix PRs - thanks segiddins, *neonic

44
cumentation fix PRs - thanks s**egiddins,** neonichu and dkhamsing.

44
ix PRs - thanks segiddins, neonichu and dkhamsing. They have l

44
segiddins, neonichu and d**khamsing.** They have low barriers to e

50
app, we had no crazy internal SDKs or anything worth hiding with

54
I can enact change. I felt no resistence in the process. I kept offeri

54
team as I started the process 2 weeks before it happened, I t

63
3 months on the way we operate

63
a lot more organized, and the Eigen repo is easily the most well

63
d our workflow on other apps. Eidolon for example now runs with a s

67
artsy/eigen/issues/313) about Eigen itself. This was an unexpecte

75
ersonally, my email is on my [github profile](https://github.com/o

Spell Checker found issues
_posts/2014-07-09-retain-scroll-position-in-infinite-scroll.markdown

Line
Typo

12
ever little solution using an iframe.

16
n sourced this solution into [scrollFrame](https://github.com/artsy/scr

18
scrollFrame borrows from sites like Pinte

18
Frame borrows from sites like Pinterest that avoid this problem by op

18
your entire page client-side, scrollFrame will intercept your click and

18
and open the next page in an iframe that sits on top of your curr

18
t doesn't look like a modal). scrollFrame will then hook into the [HTML

18
rame will then hook into the [HTML5 history API](https://develope

18
rowser_history) to remove the iframe modal on back button and keep

20
scrollFrame only solves this specific pro

_posts/2014-09-05-we-open-sourced-our-isomorphic-javascript-website.markdown

Line
Typo

12
we've open sourced the entire Artsy.net web app, [Force](https://gith

14
o move off Rails and on to a **Node.js** stack th

14
odejs.org/) stack that shares Javascript code and rendering between th

14
therwise known as [Isomorphic Javascript](http://nerds.airbnb.com/isom

14
pen-sourced our boilerplate, **Ezel,** and have

14
step further and open sourced Artsy.net.

20
r transition to an isomorphic Javascript stack has been very successfu

22
o a couple of Node servers on Heroku. This vastly improved the per

22
speed. Using the patterns in Ezel, we are able to tailor assets

22
t our page-load in half (from 6.5 seconds to under 3 seconds) a

22
lf (from 6.5 seconds to under 3 seconds) and our tests take a

22
nds) and our tests take about 5 minutes (down from around 5 h

22
t 5 minutes (down from around 5 hours!) with little reduction

30
page, we simply started a new about2 app along side our old about

30
let us push code into the new about2 app with confidence it wasn't

30
lder and search and replaced "about2" to "about". There was no nee

30
no need to dig around various stylesheets, views, etc. folders looking

34
important that we've updated Ezel to [use app/component-level p

40
dules such as [these backbone mixins](https://github.com/artsy/art

42
pment. To do this we wrote a .env file and uploaded it as a pri

42
lture so we decided to update Ezel's configuration to be able to u

42
guration to be able to use a .env file in this way as well. Thi

42
u can read more about this in Ezel's [Build Scripts & Configuratio

46
of how we structured a large **Ezel** project a

46
ee to hit us up on twitter: [@craigspaeth](https://twitter.com/craigspa

46
//twitter.com/craigspaeth), [@dzucconi](https://twitter.com/dzucconi

46
ps://twitter.com/dzucconi), @zamiang

_posts/2014-09-12-designing-the-public-artsy-api.markdown

Line
Typo

10
ly available, along with over 26,000 artworks from many of our

10
available, along with over 26,000 artworks from many of our ins

12
k and related information on **artsy.net** for educa

16
reading here and head to the [developers.artsy.net](https://developers.artsy.net

16
e itself is a classic Rails + Boootstrap example and is also [open-sou

24
Artsy has been developing a homegrown API over the last four years,

24
r years, consisting of almost 400 endpoints and exposing over 1

24
0 endpoints and exposing over 100 domain models. It's probably

24
th our [recently open-sourced artsy.net website](https://github.com/a

32
ts all the API routes within "_links", such as "artists".

64
y, we provide examples using [hyperclient](https://github.com/codegram/

64
a well-known artist, [Gustav Klimt](https://artsy.net/artist/gus

84
developed solutions such as [mongoid-cached-json](https://github.com/dblock/mo

86
because every single URL maps 1:1 with a specific JSON respon

86
cause every single URL maps 1:1 with a specific JSON response

92
or not. The API will return a 403 or 404 otherwise and it's not

92
The API will return a 403 or 404 otherwise and it's not necess

94
iplined About Data Access and NxM Queries

96
ossible, often requiring many NxM server-side queries. This act

96
/garner) and had to fine-tune Mongoid's eager-loading endpoint by end

116
e do have embedded objects in MongoDB and the fact that HAL support

122
versioned URL which includes "v1". For the new API we decided

122
akes an optional "application/vnd.artsy-v2+json" media type.

122
tional "application/vnd.artsy-v2+json" media type.

122
nal "application/vnd.artsy-v2+json" media type.

130
at API Structure and Leverage 302 Redirects

134
works" and "/artworks/:artwork**_id".** At the Hypermedia API root

151
We leverage 302 redirects extensively. For ex

151
or example, querying "/current**_user"** redirects to "/users/:user_i

151
er" redirects to "/users/:user**_id"** with a 302 status code (we c

151
s to "/users/:user_id" with a 302 status code (we cannot serve

155
happens when you are on page 5 and an item is inserted on pa

155
d an item is inserted on page 4. Your next set of results for

155
next set of results for page 6 will include a duplicate that

155
that has just moved from page 5 onto page 6. Similarly, if an

155
t moved from page 5 onto page 6. Similarly, if an item was re

155
an item was removed from page 4, a request to page 6 will ski

155
rom page 4, a request to page 6 will skip an item that now ap

155
item that now appears on page 5.

157
rsor" (internally we use the [mongoid-scroll](https://github.com/dblock/mo

175
To get the "total**_count",** we decided to require clien

175
uire clients to append "?total**_count=true"** to the query string. It

179
d a "message". For example, a 401 Unauthorized response will al

190
ll give our new API a try at [developers.artsy.net](https://developers.artsy.net

_posts/2014-09-24-launching-a-security-bug-bounty-program-at-artsy.markdown

Line
Typo

10
. Some use services, such as **HackerOne** or [B

10
e](https://hackerone.com) or **BugCrowd.** In ea

10
rowd.com). In early September 2014 we quietly launched [our own

10
ty). Since then we have fixed 14 issues reported by 15 securit

10
e fixed 14 issues reported by 15 security researchers and paid

10
ecurity researchers and paid $750 in bounty. In the process we

20
ng in countries that may have U.S. sanctions imposed on them (se

20
ed to worry about in terms of U.S. sanctions?](http://www.treasu

20
r bounty programs, including **Github's,**

20
unty.github.com/), require a [W9](http://www.irs.gov/pub/irs-p

20
.gov/pub/irs-pdf/fw9.pdf) for U.S. citizens or a [W8_BEN](http:/

20
.pdf) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/i

20
df) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/irs-p

22
expected to pay. With about $50 a bug I estimated that this p

22
ogram would not exceed about $1,000 in the first few months,

22
ram would not exceed about $1,000 in the first few months, with

24
ear that every dollar of the $1,000 spent each month is worth

24
r that every dollar of the $1,000 spent each month is worth eve

32
rnal bug tracking systems. We labeled every issue as "Security Boun

42
### SSL, Secure Cookies and HSTS

44
If you let users signup and log-in or enter any perso

44
quests. Also you must enable [HSTS](https://scotthelme.co.uk/hst

46
In Rails, HSTS is turned on with `config.for

46
config.force_ssl = true. In node.js applications we use [an HSTS

46
de.js applications we use [an HSTS middleware](https://github.co

48
t. This is mitigated by using HSTS and by making sure session co

54
ails, and can be turned on in node.js applications with [helmet](ht

58
ing for Cross-Site Scripting (XSS) vulnerabilities in your code

58
via != in Jade templates or HAML. Track down how this data is

58
. Track down how this data is inputted into the system and check whe

58
or how to deal with this in a node.js app.

64
sion cookie in a new browser, your're not actually logging users ou

66
mparing it after a session is deserialized.

74
login. This, combined with an XSS, would leak your session cook

74
e, this can be a source of an XSS by itself with data URLs, som

78
ren't loading insecure (HTTP) javascript. A man-in-the-middle attack w

82
in our program's description. Here're a few examples.

86
ll eventually have all of the 11 billion people on Artsy and t

90
CSRF is a class of attacks that at

90
hin a certain period of time. CSRF was disabled on Artsy followi

98
specially if you use multiple thirdparty services for delivering e-mai

_posts/2015-03-23-artsy-technology-stack-2015.markdown

Line
Typo

10
Artsy has now grown past 100 team members and our Engineer

10
gineering organization is now 20 strong. For a brief overview

10
ast two years, check out our **2013** and [

10
](http://2013.artsy.net) and **2014** revie

12
en Artsy launched publicly in 2012.

22
you see today when you go to **www.artsy.net** is a

22
net) is a website built with **Ezel.js,** which is

22
s](http://expressjs.com) and **Browserify.** The

22
(http://browserify.org). The [CoffeeScript code](https://github.com/arts

22
source. The mobile version of www.artsy.net is [m.artsy.net](https://m.ar

22
version of www.artsy.net is **m.artsy.net** and is

22
same technology. Both run on **Heroku** and use [

22
](http://heroku.com) and use **Redis** for caching

22
ages, are served from Amazon **S3** v

22
/aws.amazon.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cl

22
.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cloudf

26
ith. The API service runs on [AWS OpsWorks](http://aws.amazon.c

26
The API service runs on [AWS OpsWorks](http://aws.amazon.com/opswor

26
retrieves data from several **MongoDB** data

26
ose.io). It also uses [Apache Solr](http://lucene.apache.org/sol

26
rvice also heavily relies on **Memcached.**

30
uilt entirely from scratch in 2014 on Ruby-on-Rails. This was a

38
in Ruby or by [Amazon Elastic MapReduce](http://aws.amazon.com/elasti

38
. We take data snapshots from MongoDB, run jobs on the data and exp

38
Several new applications use **PostgreSQL.**

40
ious front-ends pipe data to [Snowplow](https://github.com/snowplow/

40
//www.google.com/analytics), **MixPanel** and [C

40
l](https://mixpanel.com) and **ChartBeat.** Some

40
. Some data is warehoused in [AWS Redshift](http://aws.amazon.c

40
me data is warehoused in [AWS Redshift](http://aws.amazon.com/redshi

40
aws.amazon.com/redshift) and **PostgreSQL** a

40
ww.postgresql.org) and may be analyzed offline using [R](http://www.

40
http://www.r-project.org) or [iPython Notebooks](http://ipython.org

40
tebook.html). We also have a [Statsd](https://github.com/etsy/stat

40
read-only Rails console or in Redshift directly querying data.

42
send millions of e-mails via **SendGrid** and [M

42
ttps://mandrill.com) and use **MailChimp** for ma

44
ler systems usually start on [Heroku](https://dashboard.heroku.com

44
workloads usually end up on [AWS OpsWorks](http://aws.amazon.c

44
kloads usually end up on [AWS OpsWorks](http://aws.amazon.com/opswor

44
c](http://newrelic.com/) and **Pingdom.** Al

48
ineering workflow we live in **Github** and [Tre

48
hub](https://github.com) and **Trello.** We tend

50
In 2015 we intend to complete our tra

50
dependent services built with 10x growth in mind. We can then f

52
e e-mail<EMAIL_ADDRESS>if you wa

_posts/2015-04-28-how-we-open-sourced-eigen.markdown

Line
Typo

11
It was 95 days ago, and I was sitting b

11
I loaded my terminal, opened **TapTalk** on my ph

11
me) on my phone, tapped on my collegue Ash's

16
en" lang="en">We have open source’d the <a href="https://twitter.

16
gy

🎉— Ørta (@orta) January 22, 2015

16
8395611754819586">January 22, 2015

24
due, when we were [working on Eidolon](/blog/2014/11/13/eidolon-ret

24
/eidolon-retrospective/), our CTO dB

24
tossed the idea that, really, Eigen should be open source too. Ei

24
en should be open source too. Eigen is the code name for the [Art

26
We devoted time at the end of 2014 to understand what the constr

32
eigen to eigen-private on github, and did a fresh git init.

36
r. As the switch happened the WatchKit came out, and we had devoted

42
easy to look at the source on github but to be able to get it up a

44
ted-asc) of documentation fix PRs - thanks segiddins, *neonic

44
cumentation fix PRs - thanks s**egiddins,** neonichu and dkhamsing.

44
ix PRs - thanks segiddins, neonichu and dkhamsing. They have l

44
segiddins, neonichu and d**khamsing.** They have low barriers to e

50
app, we had no crazy internal SDKs or anything worth hiding with

54
I can enact change. I felt no resistence in the process. I kept offeri

54
team as I started the process 2 weeks before it happened, I t

63
3 months on the way we operate

63
a lot more organized, and the Eigen repo is easily the most well

63
d our workflow on other apps. Eidolon for example now runs with a s

67
artsy/eigen/issues/313) about Eigen itself. This was an unexpecte

75
ersonally, my email is on my [github profile](https://github.com/o

Spell Checker found issues
_posts/2014-07-09-retain-scroll-position-in-infinite-scroll.markdown

Line
Typo

12
ever little solution using an iframe.

16
n sourced this solution into [scrollFrame](https://github.com/artsy/scr

18
scrollFrame borrows from sites like Pinte

18
Frame borrows from sites like Pinterest that avoid this problem by op

18
your entire page client-side, scrollFrame will intercept your click and

18
and open the next page in an iframe that sits on top of your curr

18
t doesn't look like a modal). scrollFrame will then hook into the [HTML

18
rame will then hook into the [HTML5 history API](https://develope

18
rowser_history) to remove the iframe modal on back button and keep

20
scrollFrame only solves this specific pro

_posts/2014-09-05-we-open-sourced-our-isomorphic-javascript-website.markdown

Line
Typo

12
we've open sourced the entire Artsy.net web app, [Force](https://gith

14
o move off Rails and on to a **Node.js** stack th

14
odejs.org/) stack that shares Javascript code and rendering between th

14
therwise known as [Isomorphic Javascript](http://nerds.airbnb.com/isom

14
pen-sourced our boilerplate, **Ezel,** and have

14
step further and open sourced Artsy.net.

20
r transition to an isomorphic Javascript stack has been very successfu

22
o a couple of Node servers on Heroku. This vastly improved the per

22
speed. Using the patterns in Ezel, we are able to tailor assets

22
t our page-load in half (from 6.5 seconds to under 3 seconds) a

22
lf (from 6.5 seconds to under 3 seconds) and our tests take a

22
nds) and our tests take about 5 minutes (down from around 5 h

22
t 5 minutes (down from around 5 hours!) with little reduction

30
page, we simply started a new about2 app along side our old about

30
let us push code into the new about2 app with confidence it wasn't

30
lder and search and replaced "about2" to "about". There was no nee

30
no need to dig around various stylesheets, views, etc. folders looking

34
important that we've updated Ezel to [use app/component-level p

40
dules such as [these backbone mixins](https://github.com/artsy/art

42
pment. To do this we wrote a .env file and uploaded it as a pri

42
lture so we decided to update Ezel's configuration to be able to u

42
guration to be able to use a .env file in this way as well. Thi

42
u can read more about this in Ezel's [Build Scripts & Configuratio

46
of how we structured a large **Ezel** project a

46
ee to hit us up on twitter: [@craigspaeth](https://twitter.com/craigspa

46
//twitter.com/craigspaeth), [@dzucconi](https://twitter.com/dzucconi

46
ps://twitter.com/dzucconi), @zamiang

_posts/2014-09-12-designing-the-public-artsy-api.markdown

Line
Typo

10
ly available, along with over 26,000 artworks from many of our

10
available, along with over 26,000 artworks from many of our ins

12
k and related information on **artsy.net** for educa

16
reading here and head to the [developers.artsy.net](https://developers.artsy.net

16
e itself is a classic Rails + Boootstrap example and is also [open-sou

24
Artsy has been developing a homegrown API over the last four years,

24
r years, consisting of almost 400 endpoints and exposing over 1

24
0 endpoints and exposing over 100 domain models. It's probably

24
th our [recently open-sourced artsy.net website](https://github.com/a

32
ts all the API routes within "_links", such as "artists".

64
y, we provide examples using [hyperclient](https://github.com/codegram/

64
a well-known artist, [Gustav Klimt](https://artsy.net/artist/gus

84
developed solutions such as [mongoid-cached-json](https://github.com/dblock/mo

86
because every single URL maps 1:1 with a specific JSON respon

86
cause every single URL maps 1:1 with a specific JSON response

92
or not. The API will return a 403 or 404 otherwise and it's not

92
The API will return a 403 or 404 otherwise and it's not necess

94
iplined About Data Access and NxM Queries

96
ossible, often requiring many NxM server-side queries. This act

96
/garner) and had to fine-tune Mongoid's eager-loading endpoint by end

116
e do have embedded objects in MongoDB and the fact that HAL support

122
versioned URL which includes "v1". For the new API we decided

122
akes an optional "application/vnd.artsy-v2+json" media type.

122
tional "application/vnd.artsy-v2+json" media type.

122
nal "application/vnd.artsy-v2+json" media type.

130
at API Structure and Leverage 302 Redirects

134
works" and "/artworks/:artwork**_id".** At the Hypermedia API root

151
We leverage 302 redirects extensively. For ex

151
or example, querying "/current**_user"** redirects to "/users/:user_i

151
er" redirects to "/users/:user**_id"** with a 302 status code (we c

151
s to "/users/:user_id" with a 302 status code (we cannot serve

155
happens when you are on page 5 and an item is inserted on pa

155
d an item is inserted on page 4. Your next set of results for

155
next set of results for page 6 will include a duplicate that

155
that has just moved from page 5 onto page 6. Similarly, if an

155
t moved from page 5 onto page 6. Similarly, if an item was re

155
an item was removed from page 4, a request to page 6 will ski

155
rom page 4, a request to page 6 will skip an item that now ap

155
item that now appears on page 5.

157
rsor" (internally we use the [mongoid-scroll](https://github.com/dblock/mo

175
To get the "total**_count",** we decided to require clien

175
uire clients to append "?total**_count=true"** to the query string. It

179
d a "message". For example, a 401 Unauthorized response will al

190
ll give our new API a try at [developers.artsy.net](https://developers.artsy.net

_posts/2014-09-24-launching-a-security-bug-bounty-program-at-artsy.markdown

Line
Typo

10
. Some use services, such as **HackerOne** or [B

10
e](https://hackerone.com) or **BugCrowd.** In ea

10
rowd.com). In early September 2014 we quietly launched [our own

10
ty). Since then we have fixed 14 issues reported by 15 securit

10
e fixed 14 issues reported by 15 security researchers and paid

10
ecurity researchers and paid $750 in bounty. In the process we

20
ng in countries that may have U.S. sanctions imposed on them (se

20
ed to worry about in terms of U.S. sanctions?](http://www.treasu

20
r bounty programs, including **Github's,**

20
unty.github.com/), require a [W9](http://www.irs.gov/pub/irs-p

20
.gov/pub/irs-pdf/fw9.pdf) for U.S. citizens or a [W8_BEN](http:/

20
.pdf) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/i

20
df) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/irs-p

22
expected to pay. With about $50 a bug I estimated that this p

22
ogram would not exceed about $1,000 in the first few months,

22
ram would not exceed about $1,000 in the first few months, with

24
ear that every dollar of the $1,000 spent each month is worth

24
r that every dollar of the $1,000 spent each month is worth eve

32
rnal bug tracking systems. We labeled every issue as "Security Boun

42
### SSL, Secure Cookies and HSTS

44
If you let users signup and log-in or enter any perso

44
quests. Also you must enable [HSTS](https://scotthelme.co.uk/hst

46
In Rails, HSTS is turned on with `config.for

46
config.force_ssl = true. In node.js applications we use [an HSTS

46
de.js applications we use [an HSTS middleware](https://github.co

48
t. This is mitigated by using HSTS and by making sure session co

54
ails, and can be turned on in node.js applications with [helmet](ht

58
ing for Cross-Site Scripting (XSS) vulnerabilities in your code

58
via != in Jade templates or HAML. Track down how this data is

58
. Track down how this data is inputted into the system and check whe

58
or how to deal with this in a node.js app.

64
sion cookie in a new browser, your're not actually logging users ou

66
mparing it after a session is deserialized.

74
login. This, combined with an XSS, would leak your session cook

74
e, this can be a source of an XSS by itself with data URLs, som

78
ren't loading insecure (HTTP) javascript. A man-in-the-middle attack w

82
in our program's description. Here're a few examples.

86
ll eventually have all of the 11 billion people on Artsy and t

90
CSRF is a class of attacks that at

90
hin a certain period of time. CSRF was disabled on Artsy followi

98
specially if you use multiple thirdparty services for delivering e-mai

_posts/2015-03-23-artsy-technology-stack-2015.markdown

Line
Typo

10
Artsy has now grown past 100 team members and our Engineer

10
gineering organization is now 20 strong. For a brief overview

10
ast two years, check out our **2013** and [

10
](http://2013.artsy.net) and **2014** revie

12
en Artsy launched publicly in 2012.

22
you see today when you go to **www.artsy.net** is a

22
net) is a website built with **Ezel.js,** which is

22
s](http://expressjs.com) and **Browserify.** The

22
(http://browserify.org). The [CoffeeScript code](https://github.com/arts

22
source. The mobile version of www.artsy.net is [m.artsy.net](https://m.ar

22
version of www.artsy.net is **m.artsy.net** and is

22
same technology. Both run on **Heroku** and use [

22
](http://heroku.com) and use **Redis** for caching

22
ages, are served from Amazon **S3** v

22
/aws.amazon.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cl

22
.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cloudf

26
ith. The API service runs on [AWS OpsWorks](http://aws.amazon.c

26
The API service runs on [AWS OpsWorks](http://aws.amazon.com/opswor

26
retrieves data from several **MongoDB** data

26
ose.io). It also uses [Apache Solr](http://lucene.apache.org/sol

26
rvice also heavily relies on **Memcached.**

30
uilt entirely from scratch in 2014 on Ruby-on-Rails. This was a

38
in Ruby or by [Amazon Elastic MapReduce](http://aws.amazon.com/elasti

38
. We take data snapshots from MongoDB, run jobs on the data and exp

38
Several new applications use **PostgreSQL.**

40
ious front-ends pipe data to [Snowplow](https://github.com/snowplow/

40
//www.google.com/analytics), **MixPanel** and [C

40
l](https://mixpanel.com) and **ChartBeat.** Some

40
. Some data is warehoused in [AWS Redshift](http://aws.amazon.c

40
me data is warehoused in [AWS Redshift](http://aws.amazon.com/redshi

40
aws.amazon.com/redshift) and **PostgreSQL** a

40
ww.postgresql.org) and may be analyzed offline using [R](http://www.

40
http://www.r-project.org) or [iPython Notebooks](http://ipython.org

40
tebook.html). We also have a [Statsd](https://github.com/etsy/stat

40
read-only Rails console or in Redshift directly querying data.

42
send millions of e-mails via **SendGrid** and [M

42
ttps://mandrill.com) and use **MailChimp** for ma

44
ler systems usually start on [Heroku](https://dashboard.heroku.com

44
workloads usually end up on [AWS OpsWorks](http://aws.amazon.c

44
kloads usually end up on [AWS OpsWorks](http://aws.amazon.com/opswor

44
c](http://newrelic.com/) and **Pingdom.** Al

48
ineering workflow we live in **Github** and [Tre

48
hub](https://github.com) and **Trello.** We tend

50
In 2015 we intend to complete our tra

50
dependent services built with 10x growth in mind. We can then f

52
e e-mail<EMAIL_ADDRESS>if you wa

_posts/2015-04-28-how-we-open-sourced-eigen.markdown

Line
Typo

11
It was 95 days ago, and I was sitting b

11
I loaded my terminal, opened **TapTalk** on my ph

11
me) on my phone, tapped on my collegue Ash's

16
en" lang="en">We have open source’d the <a href="https://twitter.

16
gy

🎉— Ørta (@orta) January 22, 2015

16
8395611754819586">January 22, 2015

24
due, when we were [working on Eidolon](/blog/2014/11/13/eidolon-ret

24
/eidolon-retrospective/), our CTO dB

24
tossed the idea that, really, Eigen should be open source too. Ei

24
en should be open source too. Eigen is the code name for the [Art

26
We devoted time at the end of 2014 to understand what the constr

32
eigen to eigen-private on github, and did a fresh git init.

36
r. As the switch happened the WatchKit came out, and we had devoted

42
easy to look at the source on github but to be able to get it up a

44
ted-asc) of documentation fix PRs - thanks segiddins, *neonic

44
cumentation fix PRs - thanks s**egiddins,** neonichu and dkhamsing.

44
ix PRs - thanks segiddins, neonichu and dkhamsing. They have l

44
segiddins, neonichu and d**khamsing.** They have low barriers to e

50
app, we had no crazy internal SDKs or anything worth hiding with

54
I can enact change. I felt no resistence in the process. I kept offeri

54
team as I started the process 2 weeks before it happened, I t

63
3 months on the way we operate

63
a lot more organized, and the Eigen repo is easily the most well

63
d our workflow on other apps. Eidolon for example now runs with a s

67
artsy/eigen/issues/313) about Eigen itself. This was an unexpecte

75
ersonally, my email is on my [github profile](https://github.com/o

Spell Checker found issues
_posts/2014-07-09-retain-scroll-position-in-infinite-scroll.markdown

Line
Typo

12
ever little solution using an iframe.

16
n sourced this solution into [scrollFrame](https://github.com/artsy/scr

18
scrollFrame borrows from sites like Pinte

18
Frame borrows from sites like Pinterest that avoid this problem by op

18
your entire page client-side, scrollFrame will intercept your click and

18
and open the next page in an iframe that sits on top of your curr

18
t doesn't look like a modal). scrollFrame will then hook into the [HTML

18
rame will then hook into the [HTML5 history API](https://develope

18
rowser_history) to remove the iframe modal on back button and keep

20
scrollFrame only solves this specific pro

_posts/2014-09-05-we-open-sourced-our-isomorphic-javascript-website.markdown

Line
Typo

12
we've open sourced the entire Artsy.net web app, [Force](https://gith

14
o move off Rails and on to a **Node.js** stack th

14
odejs.org/) stack that shares Javascript code and rendering between th

14
therwise known as [Isomorphic Javascript](http://nerds.airbnb.com/isom

14
pen-sourced our boilerplate, **Ezel,** and have

14
step further and open sourced Artsy.net.

20
r transition to an isomorphic Javascript stack has been very successfu

22
o a couple of Node servers on Heroku. This vastly improved the per

22
speed. Using the patterns in Ezel, we are able to tailor assets

22
t our page-load in half (from 6.5 seconds to under 3 seconds) a

22
lf (from 6.5 seconds to under 3 seconds) and our tests take a

22
nds) and our tests take about 5 minutes (down from around 5 h

22
t 5 minutes (down from around 5 hours!) with little reduction

30
page, we simply started a new about2 app along side our old about

30
let us push code into the new about2 app with confidence it wasn't

30
lder and search and replaced "about2" to "about". There was no nee

30
no need to dig around various stylesheets, views, etc. folders looking

34
important that we've updated Ezel to [use app/component-level p

40
dules such as [these backbone mixins](https://github.com/artsy/art

42
pment. To do this we wrote a .env file and uploaded it as a pri

42
lture so we decided to update Ezel's configuration to be able to u

42
guration to be able to use a .env file in this way as well. Thi

42
u can read more about this in Ezel's [Build Scripts & Configuratio

46
of how we structured a large **Ezel** project a

46
ee to hit us up on twitter: [@craigspaeth](https://twitter.com/craigspa

46
//twitter.com/craigspaeth), [@dzucconi](https://twitter.com/dzucconi

46
ps://twitter.com/dzucconi), @zamiang

_posts/2014-09-12-designing-the-public-artsy-api.markdown

Line
Typo

10
ly available, along with over 26,000 artworks from many of our

10
available, along with over 26,000 artworks from many of our ins

12
k and related information on **artsy.net** for educa

16
reading here and head to the [developers.artsy.net](https://developers.artsy.net

16
e itself is a classic Rails + Boootstrap example and is also [open-sou

24
Artsy has been developing a homegrown API over the last four years,

24
r years, consisting of almost 400 endpoints and exposing over 1

24
0 endpoints and exposing over 100 domain models. It's probably

24
th our [recently open-sourced artsy.net website](https://github.com/a

32
ts all the API routes within "_links", such as "artists".

64
y, we provide examples using [hyperclient](https://github.com/codegram/

64
a well-known artist, [Gustav Klimt](https://artsy.net/artist/gus

84
developed solutions such as [mongoid-cached-json](https://github.com/dblock/mo

86
because every single URL maps 1:1 with a specific JSON respon

86
cause every single URL maps 1:1 with a specific JSON response

92
or not. The API will return a 403 or 404 otherwise and it's not

92
The API will return a 403 or 404 otherwise and it's not necess

94
iplined About Data Access and NxM Queries

96
ossible, often requiring many NxM server-side queries. This act

96
/garner) and had to fine-tune Mongoid's eager-loading endpoint by end

116
e do have embedded objects in MongoDB and the fact that HAL support

122
versioned URL which includes "v1". For the new API we decided

122
akes an optional "application/vnd.artsy-v2+json" media type.

122
tional "application/vnd.artsy-v2+json" media type.

122
nal "application/vnd.artsy-v2+json" media type.

130
at API Structure and Leverage 302 Redirects

134
works" and "/artworks/:artwork**_id".** At the Hypermedia API root

151
We leverage 302 redirects extensively. For ex

151
or example, querying "/current**_user"** redirects to "/users/:user_i

151
er" redirects to "/users/:user**_id"** with a 302 status code (we c

151
s to "/users/:user_id" with a 302 status code (we cannot serve

155
happens when you are on page 5 and an item is inserted on pa

155
d an item is inserted on page 4. Your next set of results for

155
next set of results for page 6 will include a duplicate that

155
that has just moved from page 5 onto page 6. Similarly, if an

155
t moved from page 5 onto page 6. Similarly, if an item was re

155
an item was removed from page 4, a request to page 6 will ski

155
rom page 4, a request to page 6 will skip an item that now ap

155
item that now appears on page 5.

157
rsor" (internally we use the [mongoid-scroll](https://github.com/dblock/mo

175
To get the "total**_count",** we decided to require clien

175
uire clients to append "?total**_count=true"** to the query string. It

179
d a "message". For example, a 401 Unauthorized response will al

190
ll give our new API a try at [developers.artsy.net](https://developers.artsy.net

_posts/2014-09-24-launching-a-security-bug-bounty-program-at-artsy.markdown

Line
Typo

10
. Some use services, such as **HackerOne** or [B

10
e](https://hackerone.com) or **BugCrowd.** In ea

10
rowd.com). In early September 2014 we quietly launched [our own

10
ty). Since then we have fixed 14 issues reported by 15 securit

10
e fixed 14 issues reported by 15 security researchers and paid

10
ecurity researchers and paid $750 in bounty. In the process we

20
ng in countries that may have U.S. sanctions imposed on them (se

20
ed to worry about in terms of U.S. sanctions?](http://www.treasu

20
r bounty programs, including **Github's,**

20
unty.github.com/), require a [W9](http://www.irs.gov/pub/irs-p

20
.gov/pub/irs-pdf/fw9.pdf) for U.S. citizens or a [W8_BEN](http:/

20
.pdf) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/i

20
df) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/irs-p

22
expected to pay. With about $50 a bug I estimated that this p

22
ogram would not exceed about $1,000 in the first few months,

22
ram would not exceed about $1,000 in the first few months, with

24
ear that every dollar of the $1,000 spent each month is worth

24
r that every dollar of the $1,000 spent each month is worth eve

32
rnal bug tracking systems. We labeled every issue as "Security Boun

42
### SSL, Secure Cookies and HSTS

44
If you let users signup and log-in or enter any perso

44
quests. Also you must enable [HSTS](https://scotthelme.co.uk/hst

46
In Rails, HSTS is turned on with `config.for

46
config.force_ssl = true. In node.js applications we use [an HSTS

46
de.js applications we use [an HSTS middleware](https://github.co

48
t. This is mitigated by using HSTS and by making sure session co

54
ails, and can be turned on in node.js applications with [helmet](ht

58
ing for Cross-Site Scripting (XSS) vulnerabilities in your code

58
via != in Jade templates or HAML. Track down how this data is

58
. Track down how this data is inputted into the system and check whe

58
or how to deal with this in a node.js app.

64
sion cookie in a new browser, your're not actually logging users ou

66
mparing it after a session is deserialized.

74
login. This, combined with an XSS, would leak your session cook

74
e, this can be a source of an XSS by itself with data URLs, som

78
ren't loading insecure (HTTP) javascript. A man-in-the-middle attack w

82
in our program's description. Here're a few examples.

86
ll eventually have all of the 11 billion people on Artsy and t

90
CSRF is a class of attacks that at

90
hin a certain period of time. CSRF was disabled on Artsy followi

98
specially if you use multiple thirdparty services for delivering e-mai

_posts/2015-03-23-artsy-technology-stack-2015.markdown

Line
Typo

10
Artsy has now grown past 100 team members and our Engineer

10
gineering organization is now 20 strong. For a brief overview

10
ast two years, check out our **2013** and [

10
](http://2013.artsy.net) and **2014** revie

12
en Artsy launched publicly in 2012.

22
you see today when you go to **www.artsy.net** is a

22
net) is a website built with **Ezel.js,** which is

22
s](http://expressjs.com) and **Browserify.** The

22
(http://browserify.org). The [CoffeeScript code](https://github.com/arts

22
source. The mobile version of www.artsy.net is [m.artsy.net](https://m.ar

22
version of www.artsy.net is **m.artsy.net** and is

22
same technology. Both run on **Heroku** and use [

22
](http://heroku.com) and use **Redis** for caching

22
ages, are served from Amazon **S3** v

22
/aws.amazon.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cl

22
.com/s3/) via the [CloudFront CDN](http://aws.amazon.com/cloudf

26
ith. The API service runs on [AWS OpsWorks](http://aws.amazon.c

26
The API service runs on [AWS OpsWorks](http://aws.amazon.com/opswor

26
retrieves data from several **MongoDB** data

26
ose.io). It also uses [Apache Solr](http://lucene.apache.org/sol

26
rvice also heavily relies on **Memcached.**

30
uilt entirely from scratch in 2014 on Ruby-on-Rails. This was a

38
in Ruby or by [Amazon Elastic MapReduce](http://aws.amazon.com/elasti

38
. We take data snapshots from MongoDB, run jobs on the data and exp

38
Several new applications use **PostgreSQL.**

40
ious front-ends pipe data to [Snowplow](https://github.com/snowplow/

40
//www.google.com/analytics), **MixPanel** and [C

40
l](https://mixpanel.com) and **ChartBeat.** Some

40
. Some data is warehoused in [AWS Redshift](http://aws.amazon.c

40
me data is warehoused in [AWS Redshift](http://aws.amazon.com/redshi

40
aws.amazon.com/redshift) and **PostgreSQL** a

40
ww.postgresql.org) and may be analyzed offline using [R](http://www.

40
http://www.r-project.org) or [iPython Notebooks](http://ipython.org

40
tebook.html). We also have a [Statsd](https://github.com/etsy/stat

40
read-only Rails console or in Redshift directly querying data.

42
send millions of e-mails via **SendGrid** and [M

42
ttps://mandrill.com) and use **MailChimp** for ma

44
ler systems usually start on [Heroku](https://dashboard.heroku.com

44
workloads usually end up on [AWS OpsWorks](http://aws.amazon.c

44
kloads usually end up on [AWS OpsWorks](http://aws.amazon.com/opswor

44
c](http://newrelic.com/) and **Pingdom.** Al

48
ineering workflow we live in **Github** and [Tre

48
hub](https://github.com) and **Trello.** We tend

50
In 2015 we intend to complete our tra

50
dependent services built with 10x growth in mind. We can then f

52
e e-mail<EMAIL_ADDRESS>if you wa

_posts/2015-04-28-how-we-open-sourced-eigen.markdown

Line
Typo

11
It was 95 days ago, and I was sitting b

11
I loaded my terminal, opened **TapTalk** on my ph

11
me) on my phone, tapped on my collegue Ash's

16
en" lang="en">We have open source’d the <a href="https://twitter.

16
gy

🎉— Ørta (@orta) January 22, 2015

16
8395611754819586">January 22, 2015

24
due, when we were [working on Eidolon](/blog/2014/11/13/eidolon-ret

24
/eidolon-retrospective/), our CTO dB

24
tossed the idea that, really, Eigen should be open source too. Ei

24
en should be open source too. Eigen is the code name for the [Art

26
We devoted time at the end of 2014 to understand what the constr

32
eigen to eigen-private on github, and did a fresh git init.

36
r. As the switch happened the WatchKit came out, and we had devoted

42
easy to look at the source on github but to be able to get it up a

44
ted-asc) of documentation fix PRs - thanks segiddins, *neonic

44
cumentation fix PRs - thanks s**egiddins,** neonichu and dkhamsing.

44
ix PRs - thanks segiddins, neonichu and dkhamsing. They have l

44
segiddins, neonichu and d**khamsing.** They have low barriers to e

50
app, we had no crazy internal SDKs or anything worth hiding with

54
I can enact change. I felt no resistence in the process. I kept offeri

54
team as I started the process 2 weeks before it happened, I t

63
3 months on the way we operate

63
a lot more organized, and the Eigen repo is easily the most well

63
d our workflow on other apps. Eidolon for example now runs with a s

67
artsy/eigen/issues/313) about Eigen itself. This was an unexpecte

75
ersonally, my email is on my [github profile](https://github.com/o

  Generated by :no_entry_sign: danger


Reauthenticate when API password is changed

If the API password is changed, a request for reathentication will be triggered. The user will just have to enter the new password and thus no need for uninstall/Install in this situation anymore.

We need to think this through so that we do not break the retry on failed login (server problem) that we implemented earlier...
I am not saying that it has been broken, I am just worried it might...

I catch http response 400 (Bad request) with Easee specific sub-code 100 = username/password error. I think all other errors are handled as before.
Agree that we should test thoroughly in real life before releasing.

Got a few 504 - ServerFailureExeption during the night that was recovered as usual.


Add term Specialized extracellular matrix

Suggested term label:
Specialized extracellular matrix
Definition (free text)
Species or cell-type specific extracellular matrices that are different from the two main types of extracellular matrices: the interstitial ECM and the basement membrane ECM in metazoan.
Gene product name and ID to be annotated to this term
Keep the original product name and ID
Parent term(s)
extracellular matrix (GO:0031012)
Children terms

terms that were originally under extracellular matrix (GO:0031012)

[x] Pollen coat (GO:0070505)
[x] Ubisch body (GO:0070645)
[x] Egg coat (GO:0035805)
[x] Chitin-based extracellular matrix (GO:0062129)
[x] Middle lamella (GO:0009519)
[x] Biofilm matrix (GO:0062039)
[x] Organomineral extracellular matrix (GO:1990377)

terms that were originally under collagen-containing extracellular matrix (GO:0062023)

[x] Synapse-associated extracellular matrix (GO:0099535)

[x] interphotoreceptor matrix (GO:0033165)

[x] Cuticular ECM (GO:0060102)

[x] note: also requesting changing name of term GO:0060102 from "collagen and cuticulin-based cuticle extracellular matrix" to "Cuticular ECM"

Synonyms (please specify, EXACT, BROAD, NARROW or RELATED)
Not applicable
Framework in slide 2: https://docs.google.com/presentation/d/1CfY-qBrZLK-7TBR8GB9V87uYdBdPmeg9/edit?usp=sharing&ouid=109267399050361021326&rtpof=true&sd=true
screenshot below:

@DaiqingChen
Ubisch body (GO:0070645) is currently part_of ECM. I am making it part_of specialized ECM. OK ?

@DaiqingChen For terms that that were originally under collagen-containing extracellular matrix (GO:0062023):

Synapse-associated extracellular matrix (GO:0099535)
interphotoreceptor matrix (GO:0033165)
Cuticular ECM (GO:0060102)

I have ADDED 'specialized extracellular matrix' as an additional parent; did you want to remove/obsolete collagen-containing extracellular matrix (GO:0062023) ? I dont see this term in Framework from slide 2: https://docs.google.com/presentation/d/1CfY-qBrZLK-7TBR8GB9V87uYdBdPmeg9/edit?usp=sharing&ouid=109267399050361021326&rtpof=true&sd=true
Thanks, Pascale

Yes, I would like to obsolete collagen-containing extracellular matrix (GO:0062023). Haven't got the chance to request obsolete term yet, will write it up soon, thank you Pascale!

@DaiqingChen Ubisch body (GO:0070645) is currently part_of ECM. I am making it part_of specialized ECM. OK ?

I would think it should be is_a ECM, as only plants has this specialized ECM type. A reference about it: https://doi.org/10.1016/0034-6667(94)00086-Y
@Matrisome what do you think?

@DaiqingChen We need one or more references for GO terms. I used PMID:33605520, let me know if there are more appropriate ones.

I would think we should cite reference more focused on plants(PMID: 28955324) and bacteria(PMID: 28089324) for specialized ECM, also SynGO for the synapse-related terms(PMID: 31171447)

Thanks @DaiqingChen
I added the references, except for the SynGo paper, which doesn't describe the ECM.
Thanks, Pascale

Hi @Matrisome,
The term adhesive extracellular matrix(GO:0062130) we originally wanted to change from Cellular Component to Molecular Function, but after reading the definition, this term is defining a matrix in drosophila where "These glands synthesize and secrete massive amounts of a glue which attaches the pupae to the substrate during metamorphosis."
Looks like this term should be added under specialized ECM, and update the name to the synonym "puparial glue". What do you think?

@DaiqingChen : please update with screenshot of revised slide 2


Allow running daemon in docker

Currently you can't use schedule in docker environments, since docker terminates the container after the process is finished. gobackup start creates a background process & gobackup run doesn't support schedule.

Nevermind it does, i just misconfigured it. Sorry!


Add DUST Token (DUST)

Currency name: DUST Token
Symbol: DUST
Website: https://dust-token.com/
Theme color: #8B1DCE
Logo (SVG): https://io.blocktime.solutions/images/icons/dust.svg

@icinsight Is the hexagon part of the icon or just the yellow shapes?

Hexagon is an integral part of the icon.
See here: https://dust-token.com/ and
here https://www.coingecko.com/en/coins/dust-token
Thanks,
Teemu
From: Tom Médioni<EMAIL_ADDRESS>Sent: June 16, 2020 19:16
To: spothq/cryptocurrency-icons<EMAIL_ADDRESS>Cc: icinsight<EMAIL_ADDRESS>Mention<EMAIL_ADDRESS>Subject: Re: [spothq/cryptocurrency-icons] Add DUST Token (DUST) (#378)
@icinsight https://github.com/icinsight  Is the hexagon part of the icon or just the yellow shapes?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub https://github.com/spothq/cryptocurrency-icons/issues/378#issuecomment-645039482 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AJKRGCXH6ZPDL32CFKM7SNTRW7VI7ANCNFSM4NLQFFYQ .  https://github.com/notifications/beacon/AJKRGCR7AZXOSZS4SC6JXEDRW7VI7A5CNFSM4NLQFFY2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEZZIK6Q.gif


Fix restify API

In call to res.status(200) response returns statusCode (200) instead of response object (this), so there is no chaining.

thanks..  I had fixed this too but not checked in yet.


Fix java package version in README

Fixes #53
Closes #32
0.2.0 hasn't yet been released on rubygems or bintray.  The latest released version is 0.1.1, so I've updated the README accordingly.

I've updated a couple of other versions that weren't in sync with the released version.

As a follow-up, I should probably do a release of v0.2 since that hasn't been done in a long time.


Be consistent with page names, titles and menu

Content must go through a pre-merge checklist.
Pre-Merge Content Checklist
This documentation has been checked to ensure that:

[x] The title, template, and date` are all set
[x] Does this PR have a new menu item (anywhere in templates/*.hbs files) that points to a document .md that is set to publish in the future? If so please only publish the .md and .hbs changes in real-time (otherwise there will be a menu item pointing to a .md file that does not exist)
[x] File does not use CRLF, but uses plain LF (hint: use cat -ve <filename> | grep '^M' | wc -l and expect 0 as a result)
[x] Has passed bart check

✅ content/spin/ai-sentiment-analysis-api-tutorial.md
✅ content/spin/key-value-store-tutorial.md
✅ content/spin/registry-tutorial.md
✅ content/spin/url-shortener-tutorial.md

[x] Has been manually tested by running in Spin/Bartholomew (hint: use PREVIEW_MODE=1 and run npm run styles to update styling)
[x] Headings are using Title Case
[x] Code blocks have the programming language set to properly highlight syntax and the proper copy directive
[x] Have tested with npm run test and resolved all errors
[x] Relates to an existing (potentially outdated) blog article? If so please add URL in blog to point to this content.

All makes sense; just a general tidy-up and I’m happy to be flexible on the title names.


Commands hang if the workpool is stopped

If you call Disconnect(), the workPool is stopped and drained.
Many of the commands rely on a result coming back from a channel which never happens.

Thanks @fraenkel
I don't think we'll fix this at this time, but this issue can serve as a record of a known issue for other users.
/cc @shalako @crhino


Roact exists

Why would you make this if there is a ROBLOX made version of this?
github.com/Roblox/roact

https://github.com/Roblox/roact

React-lua is a 1:1 translation of ReactJS v17. It was created by Roblox for the universal app, licensed under MIT, but not published on GitHub. This repo just contains a developer-consumable version of the React translation Roblox made.
Roact is an approximate recreation of ReactJS v16. However, its internal structures are completely different to upstream React, and it lacks various features and developer tools that React-lua provides (hooks, usage warnings, usable stack traces, error boundary, profiling, dev tools).
Roblox made both. React-lua is the successor to Roact; it just isn't published on GitHub.


Website Redesign: Release 1 navigation bars

User Story
AS a New Orcahome user I WANT to be able to easily navigate through the page and find relevant links SO THAT I can complete my goal without having to read the all the text on the page.
Description
The intent of this story is to implement the UI finalized design from the Orcasound UX/UI team for the website redesign on the Navigation Bars.
Notes
Use this Figma file page (Navigation Bars page): https://www.figma.com/file/AKxnlPthLEMQyYrYuMWqOW/Orcahome-Dev-Design?type=design&node-id=517-94&mode=design
Acceptance Criteria
GIVEN I open the Orcasound website WHEN I look at the pages THEN I see a UI that matches the attached UX/UI design.
Mobile navigation bars

Tablet navigation bars

Desktop navigation bars

@UXBrendan I got ERROR: Permission to orcasound/orcahome.git denied to yyu233.

@UXBrendan Can you please have a look at the mobile view of Nav-bar. Let me know your feedback or any improvements.

@UXBrendan I have couple of questions commented on the Figma document. Let me know what you think.

@yyu233 Can you please provide a link here to the comment you'd like feedback on?

@UXBrendan Can you please have a look at the mobile view of Nav-bar. Let me know your feedback or any improvements.

@coderaries12 Can you please provide a link here to the mobile view of the nav bar you'd like my feedback on?

@coderaries12 @coderaries12
I wanted to check in with you about this project. Please see my feedback below regarding questions Yizheng asked me about the design:
Since Vera isn't getting back to us, I'll answer your questions so you can move forward.
1.) Does hovering over the "Notify Me"  and "Support Me" button change color of the buttons?
Let's not have a hover effect, since there's no hover for mobile. Ignore change states for those buttons and just use the initial color.
2.) Which event causes the "Notify Me" button to turn on the orange ringing bell icon? Which event inverts the color of the "Support Me" button?
Again, no change states, just static buttons.
3.) Do you think if you can change the color of X and github icon to make them more visible in the footer?
Yes, please invert colors or do whatever you have to to make any icons visible with the black background. Please make them WCAG compliant for contrast.


cleanup JS

even with so few lines it is a mess! don't look!

add preventDefault in JS
think about how to display search results, should we keep the last chosen option?

cleanup is done, still need to deal with empty search results etc.

everything fixed now.


Auto screenings not running on schedule

Nothing was triggered at 5:40 AM.

Issue being closed due to rewrite v2.


feat: Regularization strength for logistic (regression) classifier

Closes #750
Summary of Changes

Closed since the brances were the wrong way round.


Cancelled events still firing on default listeners

When registering multiple listeners for the same event, and then cancelling the first one, the other events still fire. Sponge Docs suggest that cancelled events should not fire (https://docs.spongepowered.org/master/en-GB/plugin/event/listeners.html)
Test code can be found at: https://gist.github.com/dualspiral/29ffaa079de0341c19acfdb8c924e974. The test plugin fires when a block break event is fired, with different filters, and different priorities. All events fire, even though the first listener will cancel the event.
The results of said test code are below. This has been observed on both Forge and Vanilla flavours.
[20:16:15 INFO] [eventtest]: Event blockBreakTwo. Cancellation state: false
[20:16:15 INFO] [eventtest]: Event blockBreakThree. Cancellation state: true
[20:16:15 INFO] [eventtest]: Event blockBreakOnePointOne. Cancellation state: true
[20:16:15 INFO] [eventtest]: Event blockBreakOne. Cancellation state: true
[20:16:15 INFO] [eventtest]: Event blockBreakTwoLate. Cancellation state: true

Most likely an issue with the event filter code, I'll investigate.


How to use with formik?

Is it possible to call a useMutation in the onSubmit of a formik form?

take a look at the code example in this comment: https://github.com/trojanowski/react-apollo-hooks/pull/93#issuecomment-467209547


By default download latest 6.x version of OWASP check

Currently task downloads version 6.0.2 which is quite old (Released Sep 2020). Latest release is 6.1.1 and even the task runner complaints that we should upgrade the version:
[WARN] A new version of dependency-check is available. Consider updating to version 6.1.1.

My suggestion:

By default download always latest 6.x version (Version 7 may contain breaking changes)
Support specific version selection in current form

The current extension already has a current version field, you just need to update it.

The develop branch being worked on in #23 supports the latest tag for finding the latest verison.


Make BUILD_SHARED_LIBS yield dynamic lib that doesn't need static libs

By changing the mode of a few libraries from STATIC to OBJECT
when BUILD_SHARED_LIBS is enabled, CMake will output a shared
library object that doesn't require any static linking against
Td from the library user's end.

Object libraries can be linked to with target_link_libraries() only since CMake 3.12 and TDLib supports CMake 3.0+, so they can't be used this way.

Object libraries can be linked to with target_link_libraries() only since CMake 3.12 and TDLib allows CMake 3.0+, so they can't be used this way.

I guess I can add a version shield so that OBJECT is only used when CMake version >= 3.12

Thanks. Now this is a correct change. It will be merged in TDLib 1.7.5.


feat(fft): add fft/ifft

Issue Link / Motivation
close #258
In protogalaxy, there are several places need fft/ifft, e.g. when prover wants to compute F, G and K
Changes Overview

root of unity generation for a given fft domain size.
fft and ifft function. The fn best_fft is imported from halo2curves.
unit test for random inputs

Also a question, shouldn't we test this solution with some synthetic example? I'm not sure that the functions I gave above work exactly, since the only thing that is checked is that ifft is the inverse of fft

Also a question, shouldn't we test this solution with some synthetic example? I'm not sure that the functions I gave above work exactly, since the only thing that is checked is that ifft is the inverse of fft

Agree,  convolution test would be good.

Also a question, shouldn't we test this solution with some synthetic example? I'm not sure that the functions I gave above work exactly, since the only thing that is checked is that ifft is the inverse of fft

I had tested it locally.  One more test example added.

looks good.


Enable all CI runners for fd-2/main

Enable all runners, disable failing tests for now.
Passing CI: https://github.com/tenstorrent/tt-metal/actions/runs/8714332357

@abhullar-tt this has your fix for 64k asserts, will that be merged soon?

@abhullar-tt this has your fix for 64k asserts, will that be merged soon?

I can merge that now


Android Studio - flutter TODO issue

When I open an existing project with some TODOs in it and click on a TODO from the taskbar below, the studio refreshes kind of, saying "updating indices" again and again. If I don't click on a TODO and directly run the app, this doesn't happen till I click on the TODO.
This only occurs when opening the app for the first time. As many courses online give out TODOs to the students, this is a troubling issue, albeit a tiny one.

What kind of "TODOs" are you talking about?
Please also add the output of flutter doctor?

I am running flutter on android studio. I can't seem to run flutter commands inside the studio terminal. i am attaching a screenshot of the 'TODOs' I was talking about.

@Servo97
Do you see the word "Terminal" in the photo that you posted? Could you click it and run a flutter commands "flutter doctor" for zoechi's request?

I tried doing that first, it didn't work. Says flutter isn't recognized as an internal or external command.
This doesn't mean I don't have flutter. I have created 4 mini apps now, just that every time I try to open the app for the first time and click on the TODO button, studio goes into that weird state.

You need to install flutter and set the environment variable.
The guideline is here=> guideline
Or I can help you personally. Just tell me that you downloaded flutter or not before on your computer and where it is.

Without additional information, we are unfortunately not sure how to resolve this issue. We are therefore reluctantly going to close this bug for now. Please don't hesitate to comment on the bug if you have any more information for us; we will reopen it right away!
Thanks for your contribution.


Fix race-condition and false-sharing in Aux::Random

This is a duplicate of the initial closed #215
Aux::Random offers thread_local references to random number generators and distributions. If the code does not recognize that the compiler supports the thread_local keyword, it silently uses non-thread_local instances. The test however only checked for GCC>4.8, Clang never used thread_local!
If a user assumes (for a good reason) that its references are thread-local and the detection fails, we get race-conditions and false-sharing, i.e. slow code broken code. I did not check which algorithms are affected, but my new code certainly was.
IMHO we should expect thread_local from a compiler nowadays. If its not supported we should be very verbose about it, and have a compile-time error.
Another issue in Aux::Random was the treatment of seed-values, which involved inter-thread communication via non-atomic global variables. I removed one unnecessary variable and made the remaining ones atomic.
The PR also includes a small benchmark to quantify the overhead caused when using convenient functions such as Aux::Random::probability(). They all involve static variables and thus extra instructions are issued by the compiler to check proper initialization. Also, if LTO is not used, additional calls are required. All together, using something like the following is roughly 30% faster than repeated calls to Aux::Random::*:
auto& gen = getURNG();
std::uniform_read_distribution distr {...};
for (.... large number ....) {
   auto prob = distr(gen);
}

I hence add a warning in the documentation.

Thank you for this PR. We can finally merge this.


DX: Improve readme

the trailling slashes in the command args help a developer new to the tool, to identify which args passed to the tool are just "magic strings" like detect and which are regular filesystem paths, like src/ tests/ in this example

Makes sense :+1: