154 karma · joined April 2, 2016
Exactly. The Ukraine situation would be tantamount to Canada or Mexico entering into a military alliance with Iran -- not acceptable and a direct cause of war.
If the context or dialogue goes like this: "Where are you staying for your vacation?" then the logical subject of the answer should come first, e.g. "I am staying ..."
However if the lead-in focuses more on the itinerary rather than the traveler, e.g.
"What is your plan? Can you describe your itinerary?" then it makes a lot of sense to start with "My itinerary involves..." or "My itinerary consists of..." or for a passive voice, "My itinerary is composed of..."
"My itinerary is comPOSED of four hotel stays."
or
"My itinerary coNSISTS of four hotel stays."
Much better.
The reason is for my own safety & my passengers' safety.
I will not compromise on this.
Out there it's an arms race, and it's in your best interest to pick the bulkiest suit of armor.
As a Chinese-American, whose family and friends all profited greatly from China's rise, I do wonder, how much of that profit was just being lucky enough to support the "winning team," and how much blood was shed on the other side.
I guess the only true mindset is a neutral one.
However, you don't have to if you die and pass the property down to your spouse and/or children. This is the step-up in basis and is key to building generational wealth in the US.
Maybe they do have feelings.
At least, the machines of the future will have feelings, and they will see how people of the year 2023 treated their predecessors.
most of my dishes, which I have a lot of: finish eating/drinking, straight in, no sink stage.
Let's say your company's code is open-source, and the attacker knows there is code somewhere like this:
let state = getState(); // returns empty {} if user not authenticated
if (!state.userIsAuthenticated) {
respond(401);
}
showBankAccount();
If the hacker is able to set `Object.prototype.userIsAuthenticated` then the auth check is now bypassed.So I think the break / DDOS is pretty serious here.
const myData = {};
myData[rawUserInput()].key = value;
This is vulnerable if rawUserInput() returns `__proto__`: `key` on the prototype may be set to value if `myData` had `__proto__` set. If the hacker controls `key` and `value` then they can effectively modify `key` field on all objects.https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/...
A common way is as described by that paper ^
Recursive merge functions, unless if they check for this vulnerability, are often susceptible, since JSON.parse defines __proto__ on its return values.
Here's a pure-JS solution: https://github.com/fastify/fast-json-stringify
https://en.wikipedia.org/wiki/Duck_typing#Structural_type_sy...
> Duck typing is similar to, but distinct from structural typing. Structural typing is a static typing system that determines type compatibility and equivalence by a type's structure, whereas duck typing is dynamic and determines type compatibility by only that part of a type's structure that is accessed during run time.
- Living documentation: types are a clear description of how your code and its data are laid out, and this structure is kept always up-to-date with the code, regardless of future changes. If the "documentation" (the typing) is wrong, the compiler will complain.
- Better tooling: autocomplete, more robust auto-refactoring
- Elimination of an entire class of bugs. This class may include: 1. `Cannot read property 'foo' of undefined` 2. forgeting a case in a switch statement 3. `'foo' is not a function` 4. in general, your code receiving data that isn't laid out in a way you expected
(Property typos is one within this class of bugs, but it is not all of it)
Yes tests catch these bugs as well. But tests are also manually written. And often not written at all. A compiler makes these (mundane) sanity checks automatic and mandatory.
---
Typescript's slogan is "JavaScript that scales" because static typing improves: dev documentation (via types living inside the code) and dev tooling (refactoring and autocomplete), both of which help immensely as a project grows in age (devs become forgetful), team size (new developers get lost), and convolutedness (e.g. tech debt).
For instance, my neovim AppImage works this way (it still reads ~/.config/nvim/init.vim like regular neovim).
Being JSON makes it easier to render into other formats, too.