metafunctor

The issue is that docker circumvents a platform security control without warning.

Docker on Ubuntu has a critical security vulnerability, with a track record of being exploited. That, clearly, is something that should be fixed ASAP.

If you have just a single layer, sure, blame yourself for poor security practices. Services should listen to unix domain sockets or internal networks only. They should have authentication in place. Machines should not have routable IP addresses. Machines should have externally applied firewalls. And so on. That doesn't mean the security layer that did fail shouldn't be fixed.

Yeah, configure `ufw default deny incoming` and Docker will sneakily bypass that and gives the internet unfettered access to your ElasticSearch and MongoDB and whatever. And somehow, that's apparently "not a bug". It's one of the biggest footguns I know of, and could not believe it was expected behavior when I first encountered it.

We have a strict policy that servers must not have a routable IP address at all, and must have an external firewall applied. It's a good idea in any case, but turns out it's absolutely necessary with Docker.

Instead of driving, I suggest taking long walks.

It's not just a meme, JS was literally inspired by Scheme (garbage collection, lexical scoping, type system) and Java (some superficial syntax) and Self (object orientation).

I agree that the core language is not the worst problem with JS; that's what I was trying to say.

Regarding the other point about knowing whether something is async or not. Few languages will tell you if a function does side effects. They might spawn threads or processes, mutate the data you sent them, all after the call has returned. Languages where you can easily see that this will happen are few and far between, and they have strong static type systems.

Not a "JavaScript dev", but I think JS is a fine language. Perhaps I'm biased, because I like Scheme. The browser environment is the shitshow.

A function can call a third party service, or some subsystem running on the same computer, whatever. Regardless of the programming language, that service may or may not do stuff asynchronously after your call. There's no way to tell. I regard the console.log to be a third party service. Who the heck knows what it does, except it has access to your memory!

OK, agreed. That's an important distinction. The console log will synchronously receive a reference to an object; later if you expand something in the log window it shows you the current state.

That's... what asynchronous means. The call to console.log() will return before the console output is actually produced.

One thing to watch out is that console.log is asynchronous.

If the objects to be printed change between console.log() and the actual printing, the output you see may not represent the state when console.log() was called.

It’s not like companies can or will actually hire globally. There are huge timezone, language, cultural, trust, connections, and other barriers.

What kind of server room allows you to bring food?

Yep. A different language, a different viewpoint, a different audience. It helps to keep things simple, consistent, and familiar.

If you're designing, say, a RESTful API, it's a good idea to write a couple of client programs in different languages. See what kind of hell you would be putting your users through.

The idea generalizes, as well. Marketing is, sort of, documentation for the value proposition of your business. If you can't make the marketing work, maybe your business fundamentals need to be adjusted instead of hiring a “better marketer”.

Writing documentation is painful, because it reveals inconsistencies and fuzzy areas in your design. If you're not paying attention, you may associate that pain with the act of writing documentation. In reality, the problem lies with your designs.

How is that? Lots of sites server their code to any client, but the data contained within the service is still secure.

TFA seems to have copied text mostly from this (much better) blog post from 2012: https://www.jasoncolavito.com/blog/the-pineapple-of-pompeii

Here's a larger image of the mosaic: https://upload.wikimedia.org/wikipedia/commons/e/e8/0_Mosaic...

Also, I think it's just a pine cone.

Are you not invoking a classic no true Scotsman argument, “a true product team always leads to success”?

I think a more interesting view might be to understand boundaries between product, sales, marketing, customer development, business strategy, support, operations, etc. Those boundaries may be where the problem is at.

Of course, no single safeguard will prevent 100% of possible accidents. What is your point?

I dunno, I’ve bought several guitars in a row…

As others have explained, this is most likely your credit card purchasing data being sold, by your credit card issuer, to any interested party willing to pay for it. Yes, the data sold includes detailed product information linked to your identity.

What I'd like to know is if the same happens when I pay with Apple Card, or when I use Apple Play with, say, a VISA card?

The seller decides on the price, and labels the goods accordingly. Whatever "recommended retail price" may be printed on the box is of course covered with a sticker with the actual price.

It's about consumer protection. Buyers must know exactly how much they will need to pay to purchase an item BEFORE they pay. It would be unfair to expect consumers to calculate these things.

What, is "password managers are insecure" really a thing?

Some of the blame should be placed on the "worse is better" dogma. Often it really just means "my library does whatever was easy to implement". It has it's merits, but it's a very leaky abstraction. It's part of why writing good C code is hard: much of the hard stuff is left to the caller, because the library implementation would be more difficult otherwise.

Use sekey: https://github.com/sekey/sekey

If you run things under tmux, you'll also need this: https://github.com/fabianishere/pam_reattach

Yes. However, Arch Linux means you need to spend time, probably several times per year, to fix stuff that worked yesterday but doesn't work anymore.

Arch Linux is just an entirely different thing compared to Ubuntu. I'd like someone who isn't me to make sure stuff works. Only very rarely will I be bothered to do actual work to upgrade to a new breaking version on my daily driver. Randomly breaking my shit on a Tuesday will make me install something more stable. On the rare occasion that I'd like to try something unstable, I can usually find a PPA or something. I don't like edges that make me bleed on my base OS.

This might be a language dependent thing. In my native language, Finnish, I don't think I've ever seen a quoted passage, quote marks intact, edited to grammatically fit in a sentence. A quote is a verbatim reproduction, a holy thing. Rather, you would work your sentence to accommodate for the quote. If you cannot do that, you'll leave out the quotes, and they are your words instead of a quote.

Just because a quote doesn't fit your favourite sentence may not mean that you “shouldn't be using that quote”.

Yep, then I agree. I'm not advocating for trying to time the market, or holding cash instead of being on the market.

But selling your position simply does NOT mean you take on "unlimited loss potential". It's simply being outside of the market, which means you're missing out on gains. It's not like selling stock is suddenly the same as shorting the same stock. I think the terminology here is clear-cut and well established.

Yeah, well, pfft. Not being on the market is an opportunity loss, sure. But it's not "unlimited".

How does holding money have an "unlimited loss potential"? You just buy back at whatever value the stock is at the time.

I would argue that money is a neutral position (adjusting for inflation which is nowadays quite low). After all, we buy stuff with money, not stock.

Now, selling short, that has an unlimited loss potential, but it's very very different from a cash position.

Yeah, I like to order from Sweden. It's usually faster to ship stuff from Sweden to Finland than ordering from a Finnish faux "in stock" webshop :)

The big issue for me is delivery times. When I order something the website claims is "in stock", it often takes weeks to be delivered. Clearly they don't have the item in stock, but are backordering it from somewhere else (usually Germany). That sucks so much. I am perfectly capable of ordering from Germany myself, and it is much faster than ordering from these faux "in stock" websites.

Not Amazon, though. They get it. Quick delivery is key.

The problem here for Wolt is to get an accurate (and I mean _accurate_) picture of what they can actually deliver very quickly. Most brick & mortar stores don't have the ERP to support that. They have no computer system that correctly tracks what items they actually have on their shelves. It's crazy, but it's true.

P.S. The above may be wildly different in different locales. I'm in Finland, where Wolt was conceived. I sometimes order lunch from Wolt but I have serious reservations they can pull this off with items that are back-ordered through a lengthy supply chain.