ayrx

You are clearly not a frequent user of Stack Exchange because you do not know about the meta sites which are available to discuss moderation decisions. And if you are not a frequent user who are you to say that "the moderation here is so clearly wrong that I'm not sure the people who made that call should have posting privileges on the site, let alone moderation"?

Duplicate: https://news.ycombinator.com/item?id=9043756

It's about a thousand lines of Python. Not particularly much.

Semver isn't the one and only way of versioning stuff. Heck, it's a pretty ridiculous model for projects that do releases based on time rather than features...

In all my projects (and the projects I contribute to), style issues are a build-breaking defect.

In Python this usually means running flake8 as a Travis job.

There is. It's called a PaaS. You write the app, the PaaS providers handles the rest.

> You would not get (much) child molestation if there was no public for these images in the first place.

Citation needed.

Not to mention `from __future__ import braces`.

I'm the one that reported issue #1279. The owner of the project has shown that he has absolutely no interest in addressing (or even politely replying to) security issues in his code so I'd advise anyone to steer clear of opencart.

I love Python and Python's standard lib but it's hardly the defacto best solution.

urllib gets trumped by requests, ujson is much much better than the stdlib json module, hardly anyone still uses distutils over setuptools for example.

> The kind of mistakes that good programmers make are not normally caught in code reviews. That's pretty much the definition of a good programmer; their mistakes are rare and subtle.

That's just arrogance. Good programmers make stupid mistakes all the time as well. It's the ability to recognize and fix such mistakes that separate "good" programmers from "normal" programmers and that's precisely where code review comes in.

I very much doubt that's the case for their web servers. Note how they only opted for 48GB on their web servers vs the much larger numbers on their DB servers?

Looks like a custom written service. I quote from http://highscalability.com/blog/2014/7/21/stackoverflow-upda...

The Tag Engine is entirely self-contained, which means not having to depend on an external service for very, very core functionality. It's a huge in-memory struct array structure that is optimized for SO use cases and precomputed results for heavily hit combinations. It's a simple windows service running on a few boxes working in a redundant team. CPU is about 2-5% almost always. Three boxes are not needed for load, just redundancy. If all those do fail at once, the local web servers will load the tag engine in memory and keep on going.

Plus they have a lot of spare capacity on the hardware. Even if traffic were to double they wouldn't need new servers to keep things running smoothly.

I'm pretty sure that ZFS' hefty RAM requirements are only when you turn on dedupe. It's generally recommended that dedupe be turned off unless you have a very good reason why you want it on. It has pretty hefty memory requirements and doesn't buy you much.

I honestly do not get the point of this page.

None of the time differences in all the test cases are significant at all. Concerning yourself with this is premature optimization of the highest level especially in a language like Python. One should definitely be more concerned about writing clearer and more idiomatic code.

I'm willing to bet that this (at least the stated price) is completely fake. There is no way that laptop can sell for $480, that won't even cover the cost of the components. Heck, that processor alone probably costs $200 from Intel.

Just wondering out loud: maybe it's possible that tooling for this just hasn't been written yet?

Something along the lines of declaratively stating what a JSON endpoint should be like and having a tool automatically assert that the services conform to that interface doesn't look impossible.

No kidding. That entire blog post was quite painful to read.

"Meanwhile, openssl and bash, while getting security updates very recently, are in their very latest versions still compatible with programs from probably over 8 years ago."

You have obviously never worked with OpenSSL.

Also, the problems with `pip` is entirely due to Ubuntu not updating their dependencies properly. Upstream `pip` vendors their dependencies so that this precise situation does not occur.

> Is it really that hard to come up with something like that for Python?

Nope, we just need a large company willing to spend tons of money funding the effort.

PyPy has made incredible strides in this area, especially for long running processes where the JIT has time to warm up. But they need a lot more funding if people ever want Python to get fast.

GitHub introduced side-by-side diffs recently.

Mostly through plugins really.

Jedi is really awesome for autocomplete: https://github.com/davidhalter/jedi-vim

This plugin really helps in formatting code: https://github.com/hynek/vim-python-pep8-indent

There's another plugin that helps with PEP8 linting: https://github.com/nvie/vim-flake8

I just use a combination of print statements and pdb for debugging, I don't trust automatic re-factoring for Python though, so I tend to do them manually with regex.

What really helps vim beat PyCharm/IntelliJ for me is the fact that I work with a lot of C code as well as Python. IntelliJ's C support sadly isn't quite there yet.

> I never heard of the issue (and it wasn't on HN) prior to the release of the patch.

What? HN is suddenly the be-all and end-all of security announcements? I heard of the issue way before the release of the patch. Anyone that subscribes to announcements from Drupal has heard of the issue.

You say that 5 days isn't enough? What period of time is? A week? A month? A year? You can always find people who somehow miss the announcement.

> It's trivial to find out what a patch affects but it's not necessarily easy to find out what the issue is unless the patch actually addresses the specific bug.

It is trivial Take the recent POODLE attack for example. The rumors floating around points to it being an issue in SSL 3 and not TLS 1.0. That contained enough information for someone to preempt the actual announcement with the exact attack.

> Nov 1st: Story about scale of hacks hits mainstream media.

Who the hell cares about the mainstream media when monitoring issues related to software you administer? That's just negligence.

I recognize editor preferences is a deeply personal taste but it's been very different for me. :) I used to swear by IntelliJ but after taking a day to configure Sublime Text (and then vim), I very much prefer them.

> You can announce the timing of the patch availability in advance.

They did. https://groups.drupal.org/node/445893

> You can tell everyone to take their site down between the release of the patch and the application.

Do you honestly believe businesses relying on Drupal for core parts of their business will do this? You are seriously naive.

> Depending on the vulnerability there may be a way of blocking it without specifically advertising the vulnerability (e.g. block it in unrelated code).

If there's a patch it's trivial to find out what it affects.

> I can't quite think of a worst approach; even never patching at all might be preferable to that.

No, that's just stupid talk because it assumes that no one else has known about the vulnerability before the announcement.

> If it were to be banned outright, you'd likely have plenty of notice and be able to sell it before the laws took effect.

Ah, but who would want to buy Bitcoin in that scenario?

Stack Exchange is a .NET shop as well.

That is a absolutely horrible idea for frameworks that Drupal. That essentially implies that someone has arbitrary write access to your servers and is free to modify things as he or she wishes.

How do you propose someone fix a vulnerability without releasing a patch that fixes the vulnerability?