kevinoid

Although this is true on Linux, it's worth noting that this behavior doesn't match the specified behavior of posix_madvise.[1] It was also a subject of Bryan Cantril's hilarious "A crime against common sense" Surge 2015 talk (at ~1:06:50).[2]

[1]: https://pubs.opengroup.org/onlinepubs/9699919799/functions/p...

[2]: https://youtu.be/bg6-LVCHmGM?t=3518

Then you may be happy to learn that OpenAPI documents can be written in YAML (since OpenAPI 2.0).

> Parsing commands should be the responsibility of the shell and all the program should do is check for the existence of flags and values.

I would love to see more consistency in command line parsing, and I think argument splitting has helped add consistency for Unix-likes compared to Windows, but going further has some major challenges:

getopt(3) parsing currently depends on the accepted options. For example, the parsing of `command --option value` depends on whether --option requires an argument. Similarly for `command -cmyfile` which depends on whether -c requires an argument (or -m if -c doesn't, etc.).

For argument, lets say the shell implements the One True CLI Option Syntax™ and passes the parse result to programs. What are the big advantages over the status quo? A stronger encouragement for consistency than getopt(3)? Slightly less work for new option parsing libraries? Unfortunately, most of the code for option handling, which parses and/or validates options and option arguments, prints errors, prints --help, etc. would likely remain largely unchanged.

However, in the same vein, one area that I would love to see more standardization (although probably not at the OS level) is a more expressive way to declare supported options and arguments. There is all sorts of information beyond `struct getopt_long *` which would be useful for parsing/validation, documentation (--help and man pages), and shell autocompletion that is currently ad-hoc.

From the article: Havre, MT is using this approach and has been able to put off a $1MM upgrade to its wastewater plant (in addition to saving $16k to date on alum).

Bozeman, MT but is not currently using the process, as you noted.

> OpenWRT 19.07 adds wpa3 support

Neat! Note that it is not enabled by default and requires installing the -openssl or -wolfssl variant of the hostapd, wpa_supplicant, or wpad package[1] and may require recreating the wireless config file.[2]

1. https://openwrt.org/releases/19.07/notes-19.07.0-rc2#wpa3_su...

2. https://forum.openwrt.org/t/wpa3-support-in-openwrt/10554/68

I can't speak to why it was originally defined, but since the Referer [sic] header has existed for decades, many sites depend on it to function. The Smart Referer extension whitelist[1] and bug tracker[2] have several examples.

1. https://gitlab.com/smart-referer/smart-referer/blob/gh-pages...

2. https://gitlab.com/smart-referer/smart-referer/issues?scope=...

It is. Personally, I find the format far too verbose for casual use and have to process the output to make it concise enough:

  iwlist wlan0 scan | awk -F: '
  BEGIN {
    printf "%-40s | %3s | %5s | %4s\n", "SSID", "Enc", "Qual", "Chan"
  }
  function print_network() {
    printf "%-40s | %3s | %5s | %4s\n", essid, key, quality, channel
  }
  /^[[:space:]]*Cell [0-9]+/ { if (key) { print_network() } }
  /^[[:space:]]*Channel:/ { channel=$2 }
  /^[[:space:]]*Encryption key:/ { key=$2 }
  /^[[:space:]]*ESSID:/ { essid=$2 }
  /^[[:space:]]*Quality=/ {
    match($0, /[0-9]+\/[0-9]+/)
    quality=substr($0, RSTART, RLENGTH)
  }
  END { print_network() }'

Could anyone familiar with this project comment on how it compares to kboot and petitboot?

http://kboot.sourceforge.net/

https://github.com/open-power/petitboot

For EFI systems, the kernel includes a boot stub which allows it to be booted directly by the firmware without an additional bootloader. AFAIK it's not possible to boot directly via BIOS/MBR.

https://www.kernel.org/doc/html/latest/admin-guide/efi-stub....

Using jitter as an entropy source also came up in the recent discussions around Linux getrandom(2) blocking:

https://news.ycombinator.com/item?id=21152552

https://fuchsia.dev/fuchsia-src/zircon/jitterentropy/config-...

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

I was curious as well. According to the author, "All the diagrams were hand-crafted in PowerPoint."

https://github.com/MaiZure/coreutils-8.3/issues/1#issuecomme...

If you are interested in all the gory details, take a look at the TC-39 proposal (especially the Goals section) and associated GitHub issues:

https://tc39.es/Function-prototype-toString-revision/

https://github.com/tc39/Function-prototype-toString-revision...

I've had much better luck using aMLC and pSLC cards than generic TLC ones. I would expect "industrial" MLC/SLC to be even better. There was an enlightening discussion on HN about them at https://news.ycombinator.com/item?id=16776344

You can also reduce risks with your choice of filesystem, read-only partitions, and FS tuning/alignment. I wrote up my findings after looking into it last year: https://kevinlocke.name/bits/2018/04/28/rpi-sd-card-storage-...

First, I would like to challenge the assumption that Debian primarily uses SVN for packaging. We can get a rough idea from the use of Vcs-$name package metadata in the testing distribution:

  </var/lib/apt/lists/*_debian_dists_testing_main_source_Sources.lz4 unlz4 |
    sed -n '/^Vcs-Browser:/n;s/^Vcs-\([A-Za-z]*\): .*/\1/p' |
    sort |
    uniq -c

On my system this gives:

      4 Arch
     72 Bzr
      5 Cvs
      5 Darcs
  24168 Git
     21 Hg
     21 Mtn
    603 Svn

Which shows that git is the overwhelming favorite and about 40 times more popular than SVN for packages which provide VCS metadata.

The sources can be pulled directly from Debian as tarballs using [syncpackage]. Ubuntu maintainers are free to use their preferred VCS for maintaining Ubuntu-specific packaging. Using the same VCS as the Debian maintainer (or upstream developer) is often convenient, but not required.

[syncpackage]: https://manpages.ubuntu.com/manpages/precise/man1/syncpackag...

These are some interesting insights into the economic incentives on the deployment side. I'm looking forward to reading the report.

It is also interesting to consider the incentives (or lack thereof) for IPv6 peering. The fact that HE and Cogent haven't resolved their peering dispute from 2009 suggests to me that there is insufficient incentive (particularly from their customers) to do so, even when there are obvious practical effects. (I can't reach openstreetmap.org via an HE IPv6 tunnel even now.)

Perhaps the technical effectiveness of Happy Eyeballs and other backwards-compatibility mechanisms necessarily reduces incentives for improving IPv6?

> It appears that bash `printf` wraps coreutils printf "with ARGUMENTs converted to proper type first," according to the manual. I guess that's how the "%509s" specifier is able to work without any args.

Actually, coreutils printf follows POSIX/SUS which states that "Any extra b, c, or s conversion specifiers shall be evaluated as if a null string argument were supplied".[1] So that trick will work for many printf(1) implementations (including both bash and coreutils).

Bash printf(1) doesn't have any hooks or wrappers, but it does parse the format string to determine how to convert arguments before calling libc vsnprintf(3). If you are interested in the details, check out how %d/%i is handled in bash[2] and coreutils[3].

1. http://pubs.opengroup.org/onlinepubs/9699919799/utilities/pr... (item 9 under Extended Description)

2. https://git.savannah.gnu.org/cgit/bash.git/tree/builtins/pri...

3. https://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=blob;...

There are some good recommendations in here! Does anyone know of a way to check for, or enforce, these recommendations? The only CMake linters I could find seem to focus on whitespace and naming issues.

I am not aware of any specifications which would prevent using mail hosts on toplevel domains. However, dotless domain names are currently prohibited by the ICANN Board New gTLD Program Committee,[1] so actually creating one may be a challenge.

1. https://www.icann.org/news/announcement-2013-08-30-en

2. https://serverfault.com/a/721929/61174

Same here. It's available on the Internet Archive:

https://web.archive.org/web/20180726150520/https://www.lessw...

Note that I had to disable JavaScript to prevent it from hiding the content and displaying "Sorry, we couldn't find what you were looking for."

Interesting approach. I'm curious to try it out.

After playing around with vm.overcommit_ratio, different swap sizes, earlyoom[1], and a few other variables, I still haven't found a happy medium between high memory utilization and low risk of swapping to death. vm.overcommit_ratio=0 is safe, but on systems where occasional swapping is tolerable and memory is limited (e.g. my laptop), I'd rather allow some overcommit.

The risk is that if many cold or unallocated pages get touched while the system is under high memory pressure, the system can become totally unresponsive. At the moment I use "Magic SysRq"+f to manually start the oom_killer, when possible. Obviously it's not a great solution. Is there some kernel tunable to keep the system responsive that I'm unaware of? What do you guys do for desktop/laptop systems?

1. https://github.com/rfjakob/earlyoom

> there's broad agreement that people with more life experience are often better placed to offer help.

Broad agreement among whom? As with MDs, I would expect several complex trade-offs. Particularly between the value of medical (and life) experience against the value of being trained with the current science and treatment methods. For therapists I would also expect more significant trade-offs due to the difficulty of building strong therapeutic relationships across large age differences for some patients. Are you aware of any studies on the issue?

I played around with that a little, but it seemed like once you start trying to auto-generate SQL from objects you are basically writing a simple ORM. So you either spend time writing queries, spend time building an ORM, spend time fixing an existing ORM, or some combination of those.

That's a fair criticism. There are a lot of tradeoffs in language choice. For this project the choice was out of my hands, but in retrospect I don't think Node was necessarily a bad choice. Node worked well for a lot of things we did. Was the cost spent struggling with SQL outweighed by the other benefits? It's hard to say for sure.

Sure, but I found that I was wasting a lot of time writing dead-simple SQL queries and object mapping that could have been better spent writing application code (and was after switching to MongoDB).

That's great to hear! But given that the first release of knex wasn't until May of 2013, it wouldn't have been an option for me.

Partly it is. I had issues with both sequelize and any-db. However, since not using them resulted in a lot of bespoke SQL and object mapping, I found MongoDB preferable to SQL without these libraries as well.

My example is a bit dated, but may be illustrative: I chose PostgreSQL over MongoDB for a MEAN webapp (making it PEAN?) project started in 2013 and regretted it. I was constantly struggling with the poor support for SQL in Node at the time and spent way too much time fixing bugs or adding workarounds for deficiencies in the SQL abstraction libraries and ORMs, or writing bespoke SQL and object mapping. After switching to MongoDB, I spent significantly less time on storage issues and development speed increased noticeably.

Later we did run into several issues caused by MongoDB which could have been avoided by using SQL (mostly related to consistency, constraint enforcement, and problems with MongoDB's aggregation capabilities). MongoDB got us to market faster, but had higher costs in the long-term.

I think there are two lessons that I'd take away: 1) There are costs to choosing a less popular technology combination, even if the individual technologies might be better (for your particular needs) in isolation. 2) Sometimes it's better to choose the more costly technology in the long-run to avoid costs early (i.e. incurring some technical debt can be the right choice). MongoDB vs SQL for us was an example of both of these.

Note: I assume SQL libraries in Node have matured significantly since 2013, so I wouldn't necessarily recommend MongoDB over SQL for new projects starting today.

I can't speak for nodesocket, but I noticed the $SYMBOL convention become popular to denote a ticker symbol when Twitter started treating $SYMBOL as a hashtag (often called a "cashtag") a few years ago.

https://twitter.com/twitter/status/230098997010911233

Does anyone know what the threat model is for LibreOffice?

For Microsoft Office, VBA Macros are allowed to execute arbitrary code. I assume it's the same for LibreOffice Basic. For files without macros (like this exploit) what are the boundaries that should be enforced? It looks like Excel supports reading data from named files by design.[1] Is it ever safe to open a partially-trusted file in LibreOffice?

Edit: Some quick testing reveals that external links do work in LibreOffice Calc. If you answer "Yes" to "This file contains links to other files. Should they be updated?" on startup, it can read any file (and presumably use WEBSERVICE to upload the contents via query string).

1. https://support.office.com/en-us/article/create-an-external-...

Yes. The advisory is at https://www.libreoffice.org/about-us/security/advisories/cve...