I think this may also be a problem with malicious clients. Currently the user enters the username and password via the client’s login dialog. It’s an effective way to collect credentials.

Exactly. Even though one doesn’t need it often, it’s an important tool.

This is how I used it too. Write a test that fails with the “bad” version. Use a script to cherry-pick and run the test. It’s fun to watch it find the first bad commit even though what git bisect does is quite simple.

In this conference talk, Evans explains some of the most important concepts related to Domain-Driven Design while taking a critical look at how we traditionally think about models. Suggests asking “which model would be more useful to solve this problem” instead of relying on our understanding of objects “in real world”. He also emphasizes the importance of communication with domain experts an use of ubiquitous language.