Hacker News Reader

jooonon When str.lower() is a security vulnerability in Python

Reminds me of an old security incident at Spotify https://engineering.atspotify.com/2013/06/creative-usernames

jooonon Experimental Dependency Vendoring in Go 1.5

There are two proposals.

You seem to refer to the Google doc proposal that was linked to in the first message of the mailing list thread several months ago.

The link on hackernews points to an answer by Google that was written just a few hours ago that instead "propose" the following:

> If there is a source directory d/vendor, then, when compiling a source file within the subtree rooted at d, import "p" is interpreted as import "d/vendor/p" if that exists.

jooonon Experimental Dependency Vendoring in Go 1.5

and if you have both: (A (vendor (B (C (vendor (D E))) D E)))

C would pick D E in its C/vendor before D E in A/vendor before D E in $GOPATH/src

ps. I have edited these comments about 5 times to get the parentheses right. :)

jooonon Experimental Dependency Vendoring in Go 1.5

Yes. That would work. However, I also believe this will work: (A (vendor (B (C (vendor (D E)))))).

https://groups.google.com/d/msg/golang-dev/74zjMON9glU/LjrVU...

https://groups.google.com/d/msg/golang-dev/74zjMON9glU/0e7M7...

https://groups.google.com/d/msg/golang-dev/74zjMON9glU/qGzsS...