reader_1000

I actually meant that pointer type is also important to understand the concept. I may not have stated it well. Yes, it does not store the type of the variable it points to but type of the pointer matters and it is significant because many operations depends on it.

>> A pointer is a variable that contains the address of a variable.

Well, it is a little bit incomplete I think. A pointer contains both the address of a variable and a type. That is why pointer arithmetic works. Without type of pointer, p++ is not calculatable.

Yes, original intent was to flatten the curve. However, as more people got sick, we learned that covid may cause permament damages on patients. Therefore if there is a way to prevent people from getting the diease at all, I think that is path we should follow . If not possible, we should still slow down the spread of the disease until vaccination efforts start to give results or we have better medication.

The way IBM handles this is pretty bad. No company, especially the ones selling a security product, should ignore security researchers reports and feedbacks

Also the bugs described in article are quite surprising since for a IBM-sized company, you expect them to have solid authentication/authorization framework which they use for all their products. Is this a acquired product? Authentication mechanism is very unusual. Why would anyone save a session id coming from the user? This is more than trusting user input, I think.

Also ../../etc/passwd attack is a kind of vulnerability that almost every automated vulnerabilty scanner scans.

Most people assume that authenticated pages do not need that much security precautions however as articles shows, when combined with authentication bypass vulnerabilities, you basically give keys of your systems to the attacker.

I think that work is for improving quality and quantity of translations which is also good.

When I tried Jitsi with my family friends, some of them struggled to use it since they don't know English. So I think changing the language can be easier for nonspeakers of English.

For example, language select box can be placed next to "Go" button (when creating meeting) and next to info button in the meeting. Also using "Accept-Language" HTTP header for choosing the language can be a good default. Another option is to add a language query parameter to the URL so that host can easily share meeting with a particular language.

Also if it would be great if some improvements can be made for low bandwitdh since there are people with slow connections and limited data plans. (On the other hand, there is already an option to lower video quality).

Other than that, kudos to Jitsi team for their great efforts and this great project.

The Data Model Resource Book [1] is a good resource how to design database. It is a kind of reference book

[1] https://www.wiley.com/en-us/The+Data+Model+Resource+Book%2C+...

Hint: copy-pasters*

* from internet or from old codebases of one’s company

In real life, you will always start with simple working implementation and go with it. Then if things are slow, you profile your code with a good profiler while running for some kind of real life scenario and spot the slow parts (also keep in mind that profiling may affect the program's behaviour). After that you may want to consider alternatives with less asymptotic complexity iff that's the part causing slowness.

Once I was asked to look for one project to see that if there is any room for improvement to speed up the program. After I profiled the program with the test data, I saw that program was severely affected by a "size" method call on a lock-free concurrent list. Since the data structure is lock free, size method is not a constant time operation and calling it in a large list takes too much time. It was just there to print some kind of statistics, I changed the code so that it is called only necessary not every time some operation occurs. This immediately made program 2-3 times faster.

There were also some parts I changed with some algorithms with less algorithmic complexith to make it faster. Overall, I made the program 6x faster. So sometimes you need to use fancy algorithms, sometimes you just need to change one line of code after profiling.

Exposing an application server to the internet is not a good idea. It is always better to have a simple proxy that has absolute minimum set of software installed on it and let it to handle the requests coming from internet and forward them to the application server. With this kind of deployment, your attack surface will be much less and you will be protected from the bugs described in the article.

It seems that it does not send "x-client-data" header in private mode, but it sends it when browsing regular mode.

Original title was too long, so edited it a litte bit. The original was: A Systematic Review and Meta-Analysis of Psychological Research on Conspiracy Beliefs: Field Characteristics, Measurement Instruments, and Associations With Personality Traits

Ideally, languages will add built-in support to facilitate this pattern without the associated verbosity. But until then, people will continue to use inheritance just because of how much less verbose it is.

Well, you can somehow achieve a part of it in Python with implementing magic __getattribute__ method:

  class CustomArrayList (object):
    def __init__(self):
        self.list = ArrayList()
    def add(self, item):
        if item == 666:
           raise
        self.list.add(item)

    def __getattribute__(self, key):
      """For rest of the methods use them as they are.
      """
        try:
            attr = object.__getattribute__(self, key)
        except AttributeError:
            attr = object.__getattribute__(self.list, key)
        return attr

However, most probably no one will like you if you use this method :)

Unrelated to cert problem: Yes, clicking on the link installs the plugin, but it is suprising to see that firefox claims that it is the news.ycombinator.com, not storage.googleapis.com, that wants to install plugin. Could it be a security issue since if an attacker somehow manages the post/inject a link for a malicious plugin in a credible site, firefox will claim that plugin is from that site?

Even with sane organization, things get messy quickly. I use everything.exe [1] on windows. It is much better than Windows search.

[1] https://www.voidtools.com/downloads/

Well, since Java evaluates method arguments all the time, if you have a computationally-heavy argument, then it is better to check debug level:

  if(log.isInfoEnabled()) {
    log.info("Foo: {}", someHeavyOperationThatReturnsString());
  }

Escape analysis should handle this [1], but I don't know if it does all the time. Reliably profiling this is hard, I guess.

http://psy-lob-saw.blogspot.com.tr/2014/12/the-escape-of-arr...

atop - http://www.atoptool.nl/ Atop is a good command line monitoring tool. It also keeps historical data.

Thanks for the information. Currently, we are using icinga + check_mk combination and mostly happy with that. However since both icinga and check_mk are going their ways, it is no longer possible to use them together. Also I want to check out some modern alternatives like the ones you suggested.

There is also icinga2. So how does one decide which one to use? For a mixed environment (windows, linux, etc) which monitoring tool is better when both server and client is considered?

There is also paping [1] that lets you "ping" to arbitrary port, although it only works for TCP.

[1] https://code.google.com/archive/p/paping/

John Resig described a way to store secret files in source control here [1]. But there is still a problem transferring encryption password securely.

[1] http://ejohn.org/blog/keeping-passwords-in-source-control/

Our management thinks that sysadmins should not know admin / root passwords and when they need it, they should get it from a privileged identity management [1] software for say 15 minutes. However, I think having an software / appliance that has administrator rights on your all infrastructure is more problematic than a disloyal employee. Since it is the master key that opens all the doors, attacker would love them. If an attack succeeds, its result would be global. For a disloyal employee, effect should stay local for a large organization. Also I don't understand the idea of trusting some random company's employees and their closed source / un-audited software but not trusting your own employees. Our management say that this is the industry best practice. Is this really the case? Do your companies also follow this practice?

[1] https://en.wikipedia.org/wiki/Privileged_Identity_Management

I was talking about how tabs is handled in private window.

When you try to open closed tab back (ctrl+shift+T), Chrome does not open it. I thougt this is a good way of handling history in private mode, you close the tab and everything is gone. However when I tried same thing on Firefox, I saw that Firefox happily opens the closed tab back, which surprised me. So I think while trying to find a balance between usability and privacy, browser vendors choose different paths.

Accessibility is important for us too. What do you use if you don't mind sharing? There is a accessibility plugin for bootstrap from Paypal [1]. Have you ever tried it? Thanks.

[1] https://github.com/paypal/bootstrap-accessibility-plugin

It is interesting to see that they recommend againts using Bootstrap:

  18F specifically does not recommend using Bootstrap for production work because of one, 
  the difficulty in adapting its opinionated styles to bespoke design work and two, 
  its CSS style places semantic layout instructions directly in HTML classes.

https://pages.18f.gov/frontend/css-coding-styleguide/framewo...

Yes, you need to have HISTCONTROL=ignorespace option in your .bashrc

> The Firefox team has spoken publicly about the drop in downloads they experienced when they moved mozilla.org to only support SHA-2 certificates

I was wondering why I could not download firefox from my work computer with the latest Chrome, it seems that not only older browsers have the problem with SHA-2 (hint: cooperate proxies).

Is there a roadmap to reach 1.0 release? I wondered because of this statement in your web site: "it has not yet undergone serious testing or performance optimization. Additionally, we may make backwards-incompatible changes to the behavior before titus reaches version 1.0"