ahochhaus

SameGoal Inc | Staff Software Engineer | Madison, WI | ONSITE (Post-Covid) | Full-Time | https://samegoal.com/

SameGoal's web application allows districts to collaboratively and compliantly document student participation in K-12 Special Programs such as Special Education, Gifted Education, English Language Learning and TGRG. We are a privately held, profitable company that operates without external capital to ensure stability and strategic direction.

We are looking for someone with 5+ years of Software Engineering experience ; 10+ preferred, who can architect and develop significant infrastructure projects, debug complex systems to isolate and resolve problems quickly, mentor junior engineers to increase their productivity and foster a highly collaborative environment, develop key new features & functionality end-to-end including modification to our frontend and backend, initiates and leads tactical engineering projects to streamline operations across the company, and can keep our users happy with a user-friendly, low latency, highly stable application experience.

Technology Stack: Backend - Go, PostgreSQL, K8s | Frontend - Closure Tools, SPA | SCM - Git, Gerrit

Competitive salary and benefits package included. FLSA: Exempt. To comply with federal law, SameGoal participates in E-Verify. SameGoal is an Equal Opportunity Employer.

To apply, email cover letter and resume to [email protected]

Thanks for the clarification. I did not realize that `upgrade-insecure-requests` applies cross origin. If you do not load any insecure content is setting HSTS and `block-all-mixed-content` the best strategy?

Does using `Content-Security-Policy: upgrade-insecure-requests` in addition to HSTS add value?

MS open sourced ChakraCore (the core of the Chakra JavaScript engine). EdgeHTML is still closed to the best of my knowledge.

Google's standard template language (soy / closure-templates) does mininfy whitespace by default [1]. However, it does not omit optional tags. I think this is why the style guide is written as it is.

Still, I agree that both types of optimization / minification should be done by the tooling layer.

[1] https://developers.google.com/closure/templates/docs/concept...

I agree that the API limitation is most likely not malicious and I did not intend to imply otherwise. Still, lack of malice does not change the fact that the Google Cast extension has a competitive advantage over other non-Google extensions (which can't use all of the same APIs).

One example of "google only APIs" that I ran into recently is the chrome extension browserAction.openPopup API. This API is whitelisted (in stable) for use by the Google Cast extension. Extensions authored outside of Google cannot use it. This is creates an uneven playing field.

https://bugs.chromium.org/p/chromium/issues/detail?id=436489

Fair point. It is reasonable to demote this post.

Personally, I always read the release notes but am less interested in the press release. I think many others prefer the opposite, hence my posting both. You raise a valid point though.

This post links to the release notes. The post you mention links to the press release. They contain similar but different information.

Interesting. Can you offer any details on which production Google apps were presented?

For a bit more context, the technology that allows the client to communicate to the server which hostname it is attempting to connect to is called Server Name Indication.

https://en.wikipedia.org/wiki/Server_Name_Indication