Defending my product from the dumbest possible haters

[@kieraisverybored]

personally I just have an auto email setup to immediately send all user uploads straight to all the best dark web forums

[@ThePoke151]

That's what we in the industry call "free backups"

[@EpicSquare]

That's really limiting your potential reach - consider adding a copy to USB flash drives that you then toss out onto the street. Now you're even compliant with data residency regulations.

[@WinBarua]

Remember rule number one of the Internet, however dumb you think people are going to be, you’re still not quite right.

[@awesomekalin55]

UploadThing: Now with no security and slower speeds to satisfy the haters!

[@backwards_user__]

Whatever happened to "don't like it, don't use it."

[@orionh5535]

We are developers, its our nature to hate things we don't agree with and be vocal about it. Don't make me dropkick you.

[@richardhaddadau]

@@orionh5535 don't tell me what you don't want me to do. I'll ctrl + alt + delete you.

[@creativeb549]

@@orionh5535 as a developer, i do not agree with your statement

[@MagerX1794]

@@creativeb549 as a developer id be willing to commit to the octagon to defend the statement he made because I do agree with it.

[@boredbytrash]

„Principles and truths must be timeless“ is the stupidest thing I have heard this year, holy shit

[@richardhaddadau]

I love how people say UploadThing is made for Devs not Customers. Amm...I think devs ARE the customers with UploadThing lol. That's like saying, we should hate Cafes because they are made for people who want coffee, not customers.

[@gravitytech]

honestly why even have security ever? don't need it. Apple should fire all their security related employees

[@7heMech]

Apple has security personnel‽

[@sunderkeenin]

- FBI after dealing with too many iPhones

[@richardkanshen]

honestly why even have security ever? Don't need it. no users - no security needed.

[@jamiw1]

fr they haven't leaked in forever what's the point of them being there 🥱

[@7heMech]

@@jamiw1 they've had a ton of zero days, but they're keeping it under the rug

[@lightning_11]

I carry a USB drive on very specific days when I'm using a console that isn't able to connect to the internet (no wifi chip at all, as far as I can tell). I take it out, like, twice a month when I'm using that console so I can make a backup, and other than that, I use services like Google Drive (or Discord, if I'm feeling lazy) to transfer files.

[@d1t183]

I think the point about devs being customers is the most important part. LOTS of services, ie. novel databases, new routing methods, high availability, were not in demand until they existed, and are now standard. The average user doesn’t know what React is or care, but it makes all the difference to someone who can harness it.

[@2lay]

No need for security? Right... Let me expose my admin dash on my SAAS for everyone :D

[@lu2000luk]

yes please! You know what: dropping DB credentials tomorrow!!!

[@2lay]

@@lu2000luk .env to prod!

[@Kids-n6n]

I love uploadthing. I use it for all of my clients in real world projects. Saved me a ton of time in a current e-commerce app I am currently on the verge of finalizing. Thanks Theo. And in the end, people say things from very dark places. That person is probably going through some personal things and his comment had absolutely no impact on how many peoples projects you’ve helped. Thank you man.

[@shapelessed]

I once worked at a company with that same security mindset... Why bother if you have no users? They deployed some test service and coincidentally got hit by an attack. Somebody somehow found out about that service, got an RCE working and bulldozed everything they could have. That's the RCE I didn't notice because it wasn't a project I had access to, but the other? - Patched 2 0-click RCEs, a RegExp DoS and 3 different poorly secured DB endpoints - On the first week.

[@lu2000luk]

I mean, if you dont like a product, just dont use it. I think uploadthing isnt bad but since i dont use react or next i probably wont use it.

[@t3dotgg]

Totally fair! If your backend is not using JS/TS, we aren’t a great option (yet)

[@2lay]

You do not need to use React with UploadThing. UT supports most front-end and back-end adapters, and if it doesn’t, implementing support requires just a few lines of code. (Using my scuffy UT impl on my django server)

[@t3dotgg]

@@2lay Down to share more on your Python implementation? DM me wherever (Twitter and Discord are easiest) - you can use my email listed on the channel too Really want to make it easier for everyone to use

[@greyshopleskin2315]

@@t3dotggif you want to add Python support I would recommend you do a framework-independent package, and another one for Django, doing it the Django way, following typical patterns. For things like fast api, I guess the generic package should be enough. It should support asyncio and if possible have a sync version.

[@BloodRoseRecords]

8:28 -- "We added resumability so people with bad internet can upload without worrying about drop outs" I feel like so few companies care about this anymore and it sucks. My internet isn't the best, I'm from a small nowhere town and slow or intermittent connection is the norm. so like, I super appreciate that foresight

[@0nepeop1e]

i am not uploadthing user, but i can tell uploadthing is not only a "better upload button", it is a service trying to solve the fustration of handling upload, especially large files, it might not fit into my system but it still capable of solving a lot of problems

[@yuralis123]

19:52 theo: Im like the anti edge compute guy Old Theo's comment on screen: Not against edge compute

[@yuralis123]

No hater btw, just thought it was funny

[@vinnylozada]

Yeah, I noticed that too and paused the video to see if anyone caught it in the comments. 😆

[@aibeginnertutorials]

You are the best of the best. I am an ML/AI Engineer and former Silicon Valley Corp Engineer and started following you months ago. You have taught me a great deal and I am deeply grateful. I am also getting ready to test uploadthing as I trust that if you and your team built it, it must be great.

[@alexholker1309]

2:30 An upload service has to be secure not just because of what you put there, but also what you don't put there. If an attacker can replace your document with one containing a malicious macro, they can do far more damage than they could just by reading your grocery list.

[@tsukinoko_kun]

Theo is asking his own Chat GPT now in xD (Twitch Chat)

[@Mempler]

"You dont need security" is what youre gonna say until you have a security breach and a lawsuit on your ass

[@cyberrb25]

One should never say, not even if they believe it to be true, that security should not be integrated on a release product. What that signals is "I don't care about the things my customers trust for me to hold". I doubt even Facebook and Google say it, and I'd say with a reasonable degree of cynicism that they are the first that will sell your data second one.

[@rtpHarry]

Use case that we need: a wordpress plugin for this. I think ill end up having to write it myself. Basically we have a dashboard where sculptors can upload pictures of their work. We request print resolution images so we can also use it for the catalogue. But then wordpress starts chomping through massive image resizes from a flood of users and cripples the server. So i need a way to offload that one bit of functionality. Is that what uploadthing is?

[@bvdlio]

We've been pushing for "security by design" for so long now. How long before it gets through the thick skulls of some people...

[@mchajen511]

It's not that end users don't care; end users don't know they care.

[@Vorenus875]

Honestly ethics around security just came up in a meeting and this speaks straight to me right now.

[@killerpixel2k3]

lol who TF thinks that your opinions and convictions can never change? The ability to change one's opinions when presented with new information is a sign of an intelligent, open-minded person with integrity. The people that think they are clever to call someone out for saying something contradicting from X months/years ago are ridiculous to me. "but back then you said X". "Yes, and then I learned more and revised my opinion. It's called growth".

[@weird_autumn42]

4:24 200Mbps is insanely slow lmao? i'd consider that insanely fast

[@shapelessed]

Well, considering majority of people alive can barely get 50Mb/s wired, yeah...

[@kamiien887]

he said it's slow for 2gbps seconds later

[@weird_autumn42]

@@kamiien887 i'd still consider it insanely fast, given i get about 40 Mbps

[@edwardallenthree]

The numbers don't really matter on this discussion. What matters is the relationship between the numbers you get versus the numbers you pay for.

[@ARandomUserOfThisWorld]

I recently moved, and the WiFi there is better, I got ~50MB/s download speed, and my eyeballs nearly fell out of my sockets, seeing as getting 1MB/s was good on my previous network. And that was for download.

[@bvdlio]

Upload thing makes file upload effortless for developers. The fact that it's 5x faster then before is not it's main selling point, it's an added bonus. + Customer notice more frequent updates, since it's so easy to use.

[@Mempler]

lol, ping's roasts are awesome.

[@chr0matic556]

i'm a high schooler and using uploadthing for a school project :)

[@VincentFulco]

Don't let the knuckle draggers get you down.

[@naughtiousmaximus7853]

Ask Andrew Tate if he needs security

[@lenrik_]

andrew tate didn't even put in the work to make his shitty subscription platform (it's stolen code), he won't understand

[@shirkit]

Wow this video is actually 2 months old?

[@shirkit]

I bet most of those that criticized you never watched the videos

[@RemotHuman]

28:20 not 100% sure but I think cloudflare workers have already done this (they bill on cpu time not waiting time) idk it would apply to file uploads though

[@nullbeyondo]

All these takes overlook the fact that you're dogfooding UploadThing within your own products, making you-by definition-a customer of what you're building. What affects you directly affects all your users. The claim that "you don’t need security with fewer than 100 paying users" is ridiculous and I wouldn't trust anything built with that mindset. And literally Yes, your customers are developers. We _care_ about speed, latency, global caching, rate limits, security, and all the technical details. I felt the pain reading all these tweets with you lol.

[@killerpixel2k3]

lol devs are the most important thing arguably... Why did stripe become the dominant place to facilitate charging things to credit cards in the web? Because it has the best DX and devs are the ones that need to use it to make your business work. This applies to non-internet things too. There's lots of tools, brands, etc. that companies use because it's better for the workers to deal with. Construction: foamboards or fluid applied vapor barrier VS housewrap? --> the former is more expensive but installing 4x8 sheets is easier than stapling flapping paper to a house, especially when there's wind. Woodworking: Festool and Craig are expensive and vendor-lock you, but it makes the work for the people using it easier and faster. There's a reason, Dewalt and Rigid have higher sales # and revenue than Ryobi. When you build for the professionals that use your stuff to make end-user facing products you are more likely to win, than to build what end-users say they want. Primagen even made the joke the other day "we will all lose our jobs to AI the moment a Product Manager can accurately describe what they want. So our jobs are safe ad infinitum" :)

[@RemotHuman]

Just move the database into the edge too (eg cloudflare durable objects) or move it all the way onto the device (local-first)

[@farang_lao]

Curious about thought process around HTTP security headers on uploadthing. Scores a D on Scott Helmets site. The reason for allowing all origins to Iframe the site isn't obvious. Big fan of your content 👍 🇬🇧

[@dumboluzz]

the camera feed looks like ungraded log footage 😅

[@mohamed1996anda]

step one : Work in twitch Step two: create an audience on KZbin by saying you worked on Twitch. step three : sell a product to developers with skill issues

[@LukasKrotovic]

hmm... imagine something like hermes on serverless edges... it would be even faster coldstart

[@rangerboi9715]

Upload for a 5 mb file took around 8 minutes that too on cable uploadthing region is Southeast Asia south India region. Pls fix it Theo 😢.

[@edwardallenthree]

Hate is a problem with our discourse, especially on KZbin and Twitter.

[@XDBjoernXD]

We are better than this. Let us continue to be nice to each other.

[@373323]

is javascript the only language used these days?

[@scoomplers]

it's twitter, silly.

[@Mr-Raptor]

there's no dark mode on the free version??

[@JhonSabowsla]

hell yeah colombia mention

[@AaronHendersonTheM0XIE]

lol blurs out the author of the tweet that kicks off this video. Shows at 1:26 without blurring

[@jamesgphillips91]

I’m still just mad that you think we can’t read the s3 docs

[@martinlesko1521]

30:48 Look mom, i am in Theo´s video

[@FinRL]

Ignored all the actual criticism and just cherry picked the jokes and dumb takes. I shouldn't have expected any more

[@BurgerBurglar8964]

where is the Theo Wojak meme?

[@100timezcooler]

40min yap sesh. great for listening. didnt learn much in this vid. 5/10

[@web3simplified793]

ye all those comments are dumb. the upload thing codebase is very good and handles async and concurrent code/pipelines etc with effect really well. i actually only discovered effect for availing of things like pipelines for streams and iterables recently. i used to use the "it" (iterable) library for similar usages before effect. But the upload codebase uses this library really well, their code is very good for handling async stuff fantastically, i literally just had a glance there. it deffo isn't a "useless product" lol

[@RemotHuman]

29:55 shout out to de arrow

[@lackcsgo6750]

we need servers on argentina.

[@TheJubeiam]

Dam i'm amaized how ppl paying for some dumb integration I can make i 2 hours.

[@ahadutech9670]

😅who whould join a platform with zero security lol

[@schtormm]

ah yes, zero security

[@d3vm305]

“That’s how we got fined and lost the compliance certificates!”

[@dead-claudia]

0:02 that's a hell of an opening 😅

[@bossmusa9075]

when even JS developer advocate to implement security for the app even when you currently don't have any users then you know that we are cooked.

[@dankestfkelive]

is it possible for uploadthing to have features like github raw files?

[@Alkaris]

So many dumb takes from people who don't understand how thing works. _"Ahh!! why would you use this, when you can use XYZ thing instead"_ or just really dumb bad takes like; _"You don't need security, blah blah blah..."_