DCoder

The Unix-Haters Handbook also has a story about backcompat:

> Way back in the early 1980s, before each of the bugs in Unix had such a large cult following, a programmer at BBN actually fixed the bug in Berkeley’s `make` that requires starting rule lines with tab characters instead of any whitespace. It wasn’t a hard fix—just a few lines of code.

> Like any group of responsible citizens, the hackers at BBN sent the patch back to Berkeley so the fix could be incorporated into the master Unix sources. A year later, Berkeley released a new version of Unix with the `make` bug still there. The BBN hackers fixed the bug a second time, and once again sent the patch back to Berkeley.

> …The _third_ time that Berkeley released a version of `make` with the same bug present, the hackers at BBN gave up. Instead of fixing the bug in Berkeley `make`, they went through all of their Makefiles, found the lines that began with spaces, and turned the spaces into tabs. After all, BBN was paying them to write new programs, not to fix the same old bugs over and over again.

> (According to legend, Stu Feldman didn’t fix `make`’s syntax, after he realized that the syntax was broken, because he already had 10 users.)

> as long as I delete Array.prototype.whatever first, I get an enumerable property when I polyfill it.

The key point there is "deleting first". If you assign to a property without deleting it first, it continues to be non-enumerable.

> it's certainly not a matter where MooTools would have to completely rework what they're doing

> it'd be easy enough to use a compatability shim on the site side

MooTools has released a patch for this problem. The problem is indeed the sites that have been built and left to their own devices.

This is not at all dissimilar to Windows dragging around garbage needed "to permit four programs written in 1994 to continue running" [1].

[1]: https://blogs.msdn.microsoft.com/oldnewthing/20031103-00/?p=...

Even if their implementation is identical to the standard, it is still problematic. The key problem is the way MooTools tries to copy over that method (and many other methods):

> Currently, Array.prototype.flatten = mooToolsFlattenImplementation creates an enumerable flatten property, so it’s later copied to Elements. But if we ship a native version of flatten, it becomes non-enumerable, and isn’t copied to Elements. Any code relying on MooTools’ Elements.prototype.flatten is now broken.

> Although it seems like changing the native Array.prototype.flatten to be enumerable would fix the problem, it would likely cause even more compatibility issues. Every website relying on for-in to iterate over an array (which is a bad practice, but it happens) would then suddenly get an additional loop iteration for the flatten property.

> The bigger underlying problem here is modifying built-in objects. Extending native prototypes is generally accepted as a bad practice nowadays, as it doesn’t compose nicely with other libraries and third-party code. Don’t modify objects you don’t own!

It should be pointed out that the README is wrong about the race condition – it is not limited to /dev/console, you can use the -e option to point it to a different output device.

> Is this an OpenSSL bug?

> No.

> How do I uninstall Linux?

> Please follow instructions.

Shirley it's not meant as a serious resource.

That section says:

> there's only one file opening, and while there is a potential race condition there, it's with /dev/console. If someone can exploit this race by replacing /dev/console, you've got bigger problems. :)

However, by reading the source one can see that you can now tell beep where it should direct its output (-e, which is not documented anywhere), so the note above is no longer accurate.

I would guess that this is the crux of the problem – the patch that fixes the security issue basically changes "open the output device once for each beep" to "open the output device on startup", greatly reducing the number of races. (It also zeroes out the buffer that's being written to certain output devices, but I have no idea if that is also to patch this security hole or to proactively prevent uninitialized bytes from leaking.)

If you're connected to a remote server, `echo` will annoy you and your cat, but `beep` will annoy the server administrator :)

> I swear these people must sit F5-spamming their review queue, just itching to flag every question possible.

Hey, you have to earn those sweet internet points somehow... Gamification has its downsides like this.

One simplistic state machine in web/mobile is mouse/swipe motion handling – mousedown transitions into "in motion" state, mousemove tracks that state, mouseup transitions into "finished motion" state, runs event handlers, and transitions again into "idle" state.

And some of us in Eastern Europe are expecting -24 °C .

> a lot of JavaScript packages are written in awkward ways that makes lots of assumptions about the packages loaded, the order of the load, monkey patching require, and a whole lot of other oddities

And therein lies the bigger problem. As long as this cancerous code style is tolerated, we'll be putting workarounds on top of other workarounds instead of making actual progress.

In theory, that's all you need. In reality, though…

"Can we make it scroll to section 1 slowly, so the user sees what's going on?"

"The heading of section 1 gets covered by the sticky top menu bar, change it so scrolling places section 1 just below the sticky."

Welcome to magpie-driven development – "just glue it together and move on".

Look at any other website - is there a FB Like button saying "25 of your friends liked this"? Congratulations, FB now knows you visit that site.

I have seen sites where the "Download this foobar" link only works when the referrer is the "Details of this foobar" page, where the download link is placed. If you sent a referrer of some other page on the site, e.g. the "list of all foobars" page, downloads would fail.

Welcome to the Baader-Meinhof Phenomenon [0].

[0]: https://www.damninteresting.com/the-baader-meinhof-phenomeno...

There's a plugin for IntelliJ IDEs called "PHP Inspections (EA Extended)" [0] that detects some of these compatibility and security problems.

[0]: https://plugins.jetbrains.com/plugin/7622-php-inspections-ea...

There was also an episode of The Twilight Zone with the same plot [0]. Based on a short story by Richard Matheson.

[0]: https://en.wikipedia.org/wiki/Button,_Button_(The_Twilight_Z...

Semi-related: there's a startup in Denmark [0] trying to do this for parcel/freight transportation. I'm not sure how well they're doing, though.

[0] https://www.badabring.com/ (link in Danish)

Just keep in mind that Technic design is substantially different from regular Lego design, and even the main "bricks" (liftarms) have slightly different dimensions than System ones. Connecting Technic with System is an art in itself - for example, the recent Porsche 911 [0] drew a lot of criticism for its design, whereas the upcoming Mack Anthem [1] is much more appealing.

[0]: https://shop.lego.com/en-US/Porsche-911-GT3-RS-42056

[1]: https://brickset.com/sets/42078-1/Mack-Anthem

This would make a great story for The Daily WTF: https://what.thedailywtf.com/

I tried it - I lost nearly 25% my weight (down from 132 kg to 101 kg) over this year by eating less and walking on foot a lot more. Eating less is certainly having a lesser effect than it did at first, but I'm still losing weight bit by bit.

Does "all user input prefilled" include file uploads?

You can see overall statistics for CAs at [0] or [1]. Google recently created its own CA for its properties [2].

[0]: https://trends.builtwith.com/ssl/root-authority

[1]: https://en.wikipedia.org/wiki/Certificate_authority#Provider...

[2]: https://pki.google.com/

See also SCM Breeze [0], which shortens git commands even more:

    git status -> gs
    git add -> ga
    git commit -> gc
    ...

[0]: https://github.com/scmbreeze/scm_breeze

It's quite possible they did do that. For example, Angular parses your source to perform Dependency Injection based on argument names.

A simple example could be the Twitter API's handling for references (URLs/hashtags/at-user mentions) in a tweet [0]. The tweet text is returned in one field, and all references are listed in a different field together with first/last character index within the tweet where that reference was found. You don't need to parse the tweet text yourself, just display it as plain text and insert links where the references say you should.

[0]: https://dev.twitter.com/overview/api/entities-in-twitter-obj...

Then again, a project with <20 dependencies has fewer "entry points" for this attack than a typical NPM project with 500+ transitive dependencies.

MySQL's silent data truncation is such a nuisance. It's off by default in 5.7, and can be disabled in earlier versions by adding STRICT_ALL_TABLES/STRICT_TRANS_TABLES to sql_mode [1].

I inherited a system where, among other things, the entire response body from a payment gateway callback is saved into a text field using utf8 character set, despite the fact that most of the supported payment gateways send data in iso-8859-x (and indicate the used charset inside the body itself, how's that for a chicken-and-egg problem). Of course when the data gets truncated due to not actually being utf8, nobody notices. Fun times.

[1]: https://dev.mysql.com/doc/refman/5.7/en/sql-mode.html#sql-mo...

The old Command & Conquer series (Tiberian Sun/Red Alert 2, 1999/2000) still have an active mod community. A significant factor is a few dedicated people who reverse-engineer the engine and make C++ patches/additions to it, giving regular modders much more power.

I used to be one of those people reverse-engineering Red Alert 2, and those years were certainly fun and challenging, as well as illuminating in the "this is why you don't <bad coding practice>" sense.

Fun fact: When EA repackaged those old C&C games for The First Decade bundle, they removed the No-CD checks. Most of the games were recompiled to achieve that, but since Red Alert 2 had these engine patches relying on absolute addresses, they went through the trouble of hex-editing the executable to keep the patches working.