DCoder

Can you define "not-image content"? Steganography begs to differ.

Then again, Vodafone Portugal was caught rewriting CSPs of all your visited pages to whitelist their own domain last year [0].

[0]: https://twitter.com/JackyHallyday/status/968263408003973121

Even good old C includes several functions that seem "redundant" at first glance [0] but are necessary for edge cases. I suppose this is similar to mechanics like fused multiply-add [1].

[0]: https://www.johndcook.com/blog/2010/06/07/math-library-funct...

[1]: https://en.wikipedia.org/wiki/Multiply%E2%80%93accumulate_op...

Depends on whether that temporary file gets properly cleaned up or not. A myriad of temporary files with more showing up every day could be a significant disk hog, especially for an enterprise with thousands of affected employees.

If you can plainly see the gun on their belt, is it really concealed carry?

Also known as "use a whitelist instead of a blacklist".

> There has grown up in the minds of certain groups in this country the notion that because a man or corporation has made a profit out of the public for a number of years, the government and the courts are charged with the duty of guaranteeing such profit in the future, even in the face of changing circumstances and contrary to the public interest. This strange doctrine is not supported by statute not common law. Neither individuals not corporations have any right to come into court and ask that the clock of history be stopped, or turned back.

R. A. Heinlein, Life-Line (1939)

> We discovered and immediately patched this bug in March 2018.

I do believe the problem here is that they didn't disclose it in March or April. Disclosing it six months after the fact does not help trust.

It's quite similar to being a senior programmer and assisting junior colleagues instead of doing their own work. Though in this case I suppose the blame falls on management for not allocating time properly.

I have tinkered with modding Diablo II (which uses tab-separated values for parameters) and the classic Command & Conquer series (which uses INI files).

Both approaches have tradeoffs:

- TSV files can have so many columns that you can't really edit them in a text editor, you'll never find your place. Some of these in D2 have more than 256 columns.

- INI files don't give you a full list of configurable parameters, so you might not even know what flags the engine supports if they're mentioned only once in the entire file or not mentioned at all. Some object types in Red Alert 2 support over 700 flags, not all of them are actually used in the default config…

- two items described in a TSV file are easier to compare than two INI sections, with INI you need a second editor window and some ordering of the keys to make sense of things.

- on the other hand, diffing a TSV file for changes is a lot more challenging.

At the time, I remember thinking how a proper database would make this easier.

---

I have also seen a game where a \n was used as a record separator and \r was used to insert newlines into the text string within a record. Fun times when your text editor tries to "intelligently" handle and normalize line endings.

Trivia: Diablo 2 stores its data as tab-separated value files. Some of those files have more columns than Excel could support at the time… so the modding community made their own editors.

FWIW, here in Eastern Europe we have a similar saying that "A spoonful of tar ruins a whole cask of honey" .

Hofstadter's Law, data breach edition: the breach's always worse than you think it is, even after you factor in Hofstadter's Law.

> Also, where in that Bugzilla thread are bookmark descriptions mentioned as being an attack vector? I can't find anything about it.

I was wondering the same thing. The only relevant item I could find is in bug 1402890 [0] linked in the very last comment. It says:

> Websites dictating what goes in a user's bookmark without any way to change that would be a terrible idea. Doubly so if it's secretly stored without even being viewable.

To me that seems like a valid privacy concern, but it should be solvable without discarding the entire feature. The "it's too hard to maintain this, let's just drop it, some volunteer will implement this again if it's needed (yeah, it won't integrate with our own UI like the current solution does, so what)" mindset in both those bugs just reeks of CADT [1].

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1402890#c3

[1] https://www.jwz.org/doc/cadt.html

It's interesting to compare this behaviour against IIS. If Apache can't identify the MIME type of the requested file, it will serve it without a Content-Type header. IIS will return a 404 instead.

FWIW, OpenSSH already does this and calls it "randomart".

When autocorrect meets "buttock-clenching", I'd guess.

Worth noting that this is not just for your actual code. You can also typecheck (and, just as importantly, refactor) JSX-based views like React's. You can't do that on stringly-typed templates like jQuery.tmpl, Knockout templates, or similar.

If you've ever had to debug a misbehaving Knockout template just to find it was referencing a misspelled object property, you can appreciate how much cleaner TSX templating is.

> It can't help you figure out why Bill (who left the company a while back) set ThreadMax to 650 when he changed the code 6 months ago. There cold be a commit message that references it, but that's more disconnected from the change that just slapping a comment on top that says why.

Also worth noting is that not all config files are committed to version control as-is. If a deployment process bakes the config file from variables, it can be even more disconnected and difficult to find the change.

Isn't that a technical solution to an organizational problem?

TSX views with full typechecking blow all stringly-typed templating solutions like Knockout Templates out of the water. In addition to that, immediate DOM repaint without any consolidation is inefficient and hard to debug at times.

Ghostery can replace scripts like Google Analytics with stubs that expose the same API but don't do anything. Last time I checked, NoScript/uMatrix can only outright block those scripts from loading, which breaks some poorly-coded sites.

> the ones who were more likely to do a chargeback would log in, download much of the site's content in a few days

I download a lot of that content too (sans the chargeback). I like to have it available locally, even when the internet is down, when the site decides to take a particular video down for whatever reason, or even when my account expires. And paying for it makes it just a little more likely they will continue to produce more of it in the future.

> someone who really knows HTML, CSS and Javascript at a deep level can write it directly and maintain it a lot more efficiently

My brain cycles are limited. I would rather let my toolchain catch the trivial errors and focus on more important tasks. I love TypeScript and React/JSX for this – typechecking my code, including views with data bindings and event listeners, saves my sanity.

> If I give a company my data, and they lose it, oh well. I wish all personal data was treated like HIPAA, at a minimum.

And yet, when GDPR tries to address the issue, HN is full of "blocking the damned EU users completely" and "stop stifling honest companies".

And you haven't even touched localization (digit grouping, decimal separators, singular/plural noun forms, currency formats, week/month names with correct capitalization, …) yet.

Many years ago, I was asked to look at why all the content had vanished from a site (not built by me). After digging in a bit, I found that:

1) the original developer's idea of handling an unauthorized /admin request was just to set a redirect header and continue processing the current request .

2) the /admin page had a grid of all the content on the site, with handy 'Delete' links that ran over GET without confirmation.

You can probably guess where this is going – some search bot hit the overview page, ignored the redirect header, saw the content, and dutifully crawled every single link on it…

This is a pretty popular pattern known as Entity-Attribute-Value [0]. It's used by many products where a) data model needs to be very flexible and allow new attributes without schema changes, or b) a typical entity has a large number of possible attributes that may or may not be set for all entities ("sparse" attributes). WordPress uses this to store post metadata, Magento uses this to store product attributes and most of other data, Drupal uses a variation of this to store all the posts and other content you create… I have too much experience with this model to be surprised.

[0]: https://en.wikipedia.org/wiki/Entity%E2%80%93attribute%E2%80...

I can see both sides of the argument here — from the technical point of view, it is certainly unappealing to maintain such kludges, and from the business point of view, "it's been working fine so whatever changed on the other end is broken, we won't spend money fixing it"…

Do you have any thoughts on how this quagmire can be avoided on the web? I can imagine solutions similar to Ghostery's stub scripts, but putting that in a browser, let alone many browsers, sounds like a large legal problem.