DCoder

> I also believe there are some nice SQL sanitation libraries out there. This is not the right approach. Separating the query structure from the data is the right way to go - parametrized queries are much safer than sanitization, which is subject to all sorts of encoding headaches.

It's from [0], which was on HN not too long ago [1].

[0] http://natashenka.ca/posters/ [1] https://news.ycombinator.com/item?id=7156405

> how many times have I bought a movie on iTunes to show my kids how to do it right, and then torrented it as I couldn't wait for the download, too slow.

Hey, at least you have the option of getting it on iTunes. Where I am, neither iTunes, Amazon Instant Video or any other online service is willing to even sell me the content I want.

Since you're using MySQL, you can start it with --i-am-a-dummy [1]. Not a backup, but still handy.

[1] http://dev.mysql.com/doc/refman/5.6/en/mysql-tips.html#safe-...

> It appears that you can't provide answers without first asking questions.

That's not true. You can write answers right away, but you need to acquire some rep before you can write comments .

Not entirely true. PHP definitely tries to perform a numeric comparison on two strings if it thinks they are both numerical strings, but this behaviour changed in PHP 5.4 [0]. heron87's scenario was reported as a bug [1], changed in PHP 5.4 and caused new problems [2].

See the string comparison routine in 5.3 [3] and 5.4 [4]. The new implementation still inspects the strings to see if they are numeric and then tries to do a numeric equality check rather than string equality check, leading to amusing tricks like

     var_dump("0xFF" == "255.0"); // true!

But if both values overflow the long type and their double representations are equal, the new implementation falls back to actual string equality. A quick check at [5] shows that both values heron87 compared have identical double representations, assuming (sizeof double == 8), so the new representation detects the long overflow, then it sees that double representations are also identical, and then it returns to string equality rather than numeric equality. The old implementation did not consider long overflow and ended up comparing the numeric values.

[0] http://3v4l.org/a0nKq

[1] https://bugs.php.net/bug.php?id=54547

[2] https://bugs.php.net/bug.php?id=62097

[3] https://github.com/php/php-src/blob/PHP-5.3/Zend/zend_operat...

[4] https://github.com/php/php-src/blob/5.4/Zend/zend_operators....

[5] http://babbage.cs.qc.cuny.edu/IEEE-754/index.xhtml

While I admit that using a framework instead of your own solution is a good solution, please note that that's not "zero work", it just passes the buck to the client. The framework's knowledge of the timezones still has to be kept up to date. For example, Israel used to have ad-hoc DST times changing each year and "...the unpredictability of IDT in Israel became frustrating enough that Microsoft Windows stopped trying to track changes and just made Israeli time be Greenwich Mean Time plus two hours (GMT+2) (and disabled the daylight saving option). This has led to various ad hoc solutions to the problem in Windows systems and other Microsoft software (e.g. Outlook calendar entries are often off by an hour when shared, due to the lack of IDT support)." [1]

[1]http://en.wikipedia.org/wiki/Israel_Summer_Time

Seen this pattern many times before. One of those 'en' strings is the current user's language being written into the source, the other is hardcoded. If your server-side templating engine is impotent and only supports variable interpolation without conditionals, this approach is easier than pulling the right JS snippet from somewhere else.

TypeScript only does enough run-time argument checking to support default argument values.

Full run-time type checking would have overhead. It would also be unnecessary in places where data flows from Typescript function to Typescript function — those places should already be foolproof after the compile-time checks.

This was discussed on Reddit after Sourceforge announced the new installer three weeks ago: http://www.reddit.com/r/technology/comments/1jk1gz/sourcefor... , several users confirmed the crapware in the installers.

It appears I misremembered this a little bit - the issue was with license ownership, not license type. The answer we got from Hetzner support was: " we don't offer MSSQL licenses, if you want it you need your own license for MSSQL and also for Windows server 2008 R2, because you can't use your own licenses with our Windows license. "

And yes, it is reasonable to expect the customer to provide the licenses for the software, but hosting companies can also sell monthly software usage to their customers - we ended up choosing a host that did exactly this. The monthly cost we pay for Windows + MSSQL will not reach the total cost of a full MSSQL license for three years.

Be careful and ask support to confirm all the software in your stack will be runnable. We tried to launch an SQL Server (MSSQL) -backed system on one of their root servers and their support said "the Windows licenses we use do not allow installing MSSQL - you will have to buy your own licenses for Windows and SQL Server".

You probably meant "speck", not "spec".

See also discussion on Reddit [1] and a particularly interesting comment [2].

[1] http://www.reddit.com/r/programming/comments/1gfve8/how_not_...

[2] http://www.reddit.com/r/programming/comments/1gfve8/how_not_...

I'm talking about a managed server. No root access. If there was root access, I wouldn't be listening to their "we can't limit access because that's how our management tools work".

I host several customer projects on Hetzner managed servers. Ports of all the services, MySQL, Postgres, smtp, everything else are open to the world and their support refuses to lock that down in any way.

I accept that for managed servers they need to connect from outside to manage them, but how hard would it be to drop all traffic except for the IP range their management systems use?

That tag can stop you from scrolling sideways because it also says "the width of this document should be the same as the width of the device", killing all horizontal scrolling. It shouldn't affect vertical scroll though, unless height is constrained through some other styling rules.

What's there to fix? The tag says "you cannot zoom this site to levels less than 1.0 or more than 1.0", the browser complies. I'm not proud of it, but I've used this very approach to fix a stupid bug in iOS Safari - rotating the device without this zoom lock changed the zoom in ridiculous ways.

It doesn't record where you click or what you open, just every request as it moves over the wire.

I am getting quite different results - it records http requests and user input (keyboard/mouse).

Windows 7 x64, Chrome 25.0.1364.172 m :

  # navigate to chrome directory
  cd C:\Users\User\AppData\Local\Google\Chrome\Application\
  # run chrome with a new profile
  chrome --user-data-dir="../User Data/recording_test" --first-run --record-mode
  # use the new chrome profile to browse around
  # close chrome
  # launch it in playback mode
  chrome --user-data-dir="../User Data/recording_test" --playback-mode
  # watch disaster ensue as it locks your mouse (not keyboard), 
  #   replays all activity (url bar input, navigation, mouse cursor movements...), 
  #   and doesn't even stop when you alt-tab 
  #   to a different application

It feels unpolished - mouse scroll wasn't recorded, the "translate this page?" bar wasn't showing up the same way as in the recording, and most importantly, I managed to switch to a different application and it continued sending input to that application. HTTP requests did get cached as promised, and non-cached requests (due to missing scroll event, it clicked on a different link) resulted in a cache error.

Create a separate profile or close _all_ open Chrome windows first.

  "c:\path\to\chrome\dir\chrome" --user-data-dir="c:\path\to\chrome\dir\User Data/test" --record-mode

Yes, The West Wing is worth watching in its entirety.

Because that's how the Mercator projection distorts object size: http://en.wikipedia.org/wiki/Mercator_projection#Distortion

That makes sense (thank you, don't know why I didn't realize that myself), but if I override that with css height: auto; , the browser no longer reserves space for the image while loading it... quite unfortunate.

If you specify width and height explicitly, certain browsers will have issues resizing them (if you set max-width: 100%, Chrome will squish a larger image horizontally but leave the height as it was, IE will scale it proportionally).

And the effort not to give up when your reverse-engineering efforts reveal remarkable stupidities in the original code. We all know crunch happens, but that doesn't make dealing with the resulting spaghetti any easier.

(I spent several years reverse-engineering Command & Conquer RA2, I should know - that game has hacks and flukes everywhere.)

There is the Pointer Lock API [1], but it's still WIP.

[1] http://www.html5rocks.com/en/tutorials/pointerlock/intro/

SO users with 10k+ reputation can still see deleted questions.

FYI: the email: field in your profile is private, other users can only see the about: field.

That is what "Close as too localized" option is for.

Compare that to a training exercise the soviets carried out - 40+ thousand troops engaging in combat while a nuke is detonated overhead: http://www.johnstonsarchive.net/nuclear/radevents/1954USSR1....