bluetech

It would be nice if you could sign the tarball with the binary. I see the tag is already signed so hopefully it's not much trouble: https://wiki.debian.org/Creating%20signed%20GitHub%20release...

What does "flat install" mean?

All of the apps fail this test:

1. Go to main page. 2. Enter a long comments section. 3. Scroll down. 4. Hit back (back to main page again). 5. Hit forward (back to comments section).

Expected: Scroll position is restored.

Actual: Scroll position is not restored (most of them), back is broken (Svelte), scroll is some random place (Polymer).

A cache without any eviction! Probably should not expose `fnmatch` to the network where the pattern varies.

There is this: https://github.com/maggiepint/proposal-temporal

A proposal to copy java.time to javascript. Hopefully this will happen eventually!

Interesting article.

Another related article I found interesting: https://www.coverfire.com/articles/queueing-in-the-linux-net... Discusses some of the queues in the Linux network stack.

> How will you avoid having two variants of each and every lib ?

The python community is also struggling with this problem. The emerging approach, which seems to me to be the right approach, is to write the libraries such that they do not do any IO; then you can use them anywhere, with some integration. So basically it's just the principle of separation of concerns.

See more here: https://sans-io.readthedocs.io/how-to-sans-io.html

Has anyone suggested some sort of postfix macro syntax? I don't have one in mind, but perhaps there is some nice looking, viable one. That might have been a more general solution than a new operator.

One example:

www.dropboxlocalhost.com -> 127.0.0.1

I don't know if dropbox are still using that in their client though.

There is memfd_create(2) (see discussion under "File sealing" and the related fcntls).

Quoting redis docs (http://redis.io/topics/benchmarks):

> When the server and client benchmark programs run on the same box, both the TCP/IP loopback and unix domain sockets can be used. Depending on the platform, unix domain sockets can achieve around 50% more throughput than the TCP/IP loopback (on Linux for instance). The default behavior of redis-benchmark is to use the TCP/IP loopback.

Haven't measured myself though.

This is still a similar problem for the memcached cache backend (which django recommends): https://code.djangoproject.com/ticket/11331

I have recently deployed Content Security Policy (CSP) on a website. When I first looked at violation reports, my jaw dropped. The amount of malware (rouge extensions, toolbars, viruses, ...) that is blocked is staggering.

If you really want to help your (clueless) users, never ever serve a login, registration or credit card form without CSP. It really helps - at least until the malware catches on (I already see "Kaspersky Labs" is injecting its domain into the CSP itself).

Heh, a long time ago I wrote a script using BeautifulSoup which given an ORA-XXX would return a detailed explanation. Amazingly, it still works: https://gist.github.com/bluetech/f9aa4ede5a25c765c6e6 (don't hold me to the code though :)

Off topic, but: I thought in rust they like to statically link everything. So how does that go with the LGPL license you chose?

[From all the bad things I hear about PHP, the code is very readble without any previous experience - nice].

Here are some things a lexer for a programming language might have to deal with:

1. Comments (some even do nested - which means regular expressions are out for that).

2. Continuation lines.

3. Includes (if done at the lexical level).

4. Filename/line/column number for nice error messages (can really hurt with branch mispredictions).

5. Evaluation of literals: decimal/hex/octal/binary integers, floats, strings (with escapes), etc.

6. Identifiers.

So matching keywords is mostly the straightforward part. However I have found that matching many keywords is the perfect (and in my experience so far, the only) use case for a perfect hashing tool like gperf - it would normally be much faster than any pointer-chasing trie. gperf mostly elminated keyword matching from the profile of any lexer I've done.

Pre-compressing is possible, but why shouldn't the http server do it for you? The server can cache the compressed files in memory and/or disk as it sees fit (although gzip was pretty cheap last time I checked). It can also deal with cache invalidation better than humans - I speak from experience :).

What is wrong with compressing static files?

Maybe they can use something like javascript's and perl's "strict" annotations.

I don't really understand what's the point of tracking the sources when copying files? A security policy which restricts my actions over an object I had copied (with permissions to do so) seems a bit strange to me. But the slides don't really explain why this is wrong?

vim allows you to select a region and operate on it. It sometimes necessary, but in practice, people use the compositional commands. They are faster and mentally easier. So empirically it seems your preference is different than most.

Also, what do you mean, maps better to other forms of editing?

Are you sure? The TweetNaCl paper says u32 is an unsigned >= 32-bit (see towards the end): http://tweetnacl.cr.yp.to/papers.html

Right, void* is used quite a lot for "generic" data structures. But I'm not sure that's what he meant. The reason I said "only" was that from my own experience, most C data structures are tailored for a specific use and so I don't see void* too much in this context.

And may I ask why you say "typedef" is unsafe? It is merely a type alias, like e.g. Haskell's and ML's "type", or isn't it?

Why do you say C has no type safety? Only way around the type system is void, explicit casts and I guess unions.

It admittedly doesn't have a very advanced type system, that's true.

But the author encourages their use for all types of numbers.

Ah, the 'git checkout -p' is great. I always did 'git stash -p; git stash drop' for that. Putting this under 'checkout' is completely non-obvious.

Feels like the developers said, "hi, we're starting to get too many of those pesky users, let's make each of them run a bunch of obscure commands just to get started".

Well, I'm not being fair here, the commands are not really obscure (except the ones they made up), and I'm sure they had a reason. But I just recently had to reinstall Arch after many years, and found the new "installer" strange and kind of daunting compared to the old one.

  sum(random.uniform(1, 5)**3 for i in range(10000)) / 10000

Many people don't know that the random module allows to sample from many distributions directly without having to construct your own.

Use an alias! I like

  git config --global alias.s 'status --short --branch'

For people interested in cryptography, mentioning Shamir's secret-sharing scheme might also be cool.