ecjhdnc2025

You may already know, but Slant 3D (print farm) do _some_ of this with Etsy and Shopify, and have an API for further integrations.

(I am working on a product myself, but it would likely have assembly needs beyond what Slant 3D do, and at any rate I am not in the USA)

Milk is not a loss leader: they aren’t losing money on it to get you to spend elsewhere.

It’s profitable for supermarkets.

(They definitely do manipulate milk prices to get consumers to shop with them rather than competitors, and sometimes they artificially lower the prices. But they don’t ever do this at their own expense. They do it by forcing farmers to supply below the true cost of production. Because dairy farmers can’t just sell some of their milk. Essentially as soon as a dairy farmer can’t get a buyer for the totality of their product they are out of business. It’s remarkably precarious. So most are pressured into selling below cost for long periods of time.)

Supermarkets might be using it to get customers deeper into the store but milk is also heavy, awkward, refrigerated, and shorter shelf life, which means they are always going to put it closest to the back of the store.

It does exist, it just doesn't get linked in the page. Click on the media item, your URL bar has changed.

> Another point that Patreon isn't really emphasizing here that seems relevant to any conversations about "fairness" is that Apple's fees on Patreon subscriptions in-app are now higher than Patreon's fees.

Unfortunately this is in the nature of suppliers and retailers.

Supermarkets make more profit on a litre of milk than farmers. Way way way more. Because they know farmers in practice have to sell _all_ their milk, not just some of it.

And what Apple really has, and knows it, is the only supermarket on the main road out of iBorough. And there are no corner shops.

It does have that feel, but it's decidedly cramped compared to, say, the VT100's font, or even that of the VT52, which are both a bit closer to the "server" heritage they are alluding to.

Many other "code page 437" (console graphics fonts) do much better than this for readability at base line-height.

Oh I am not saying it should be.

The problem is that to resolve the readability issues many people seem to be observing on that page you need to set it to 1.1 or 1.2 (try it!)

But that will break the console pseudographics.

Part of the problem with this font appears to be large, space-filling (yes, squareness is another way to put it) glyphs, when if they had a bit more of a difference between the cap height and the ascender height the full-height pseudo graphical glyph stuff would still work without the textual characters feeling so cramped.

At least, I think that is right. I know just about this stuff to be wrong in important ways.

Either way there must be a solution to this; it feels like a missed opportunity.

The line spacing is way too tight (this is line-spacing: 1).

Obviously that is beneficial for ASCII-art (smaller vertical gaps), but plain text would benefit from at least 1.1 and maybe 1.2.

I am not a typographer but the cap height of this font (I think it's the cap height) appears quite large, when perhaps it would be better to have a slightly smaller cap height so the ASCII-art features would work well at line-height 1.0 without the letters feeling so vertically cramped.

Basically, slightly less-tall letters.

But as I say, not an expert.

It used to be that all-lower-case brought to mind bell hooks, ee cummings, kd lang…

Now it’s a signifier for e/acc narcissism and grift.

> You are a senior full-stack developer, one of those rare 10x devs

I am not disputing that this improves answer quality, but it does make me despair that it does.

All the relations: this is a bit excessive.

But before CTEs this sort of thing had regular use with recursive tree structures, in caching hierarchies. You'd make use of whatever SQL options you had to concatenate a group of IDs into a comma-separated string.

e.g. all the parent nodes of a given node in the hierarchy, and even (selectively) for caching all the descendent node IDs of enclosures. Though there are better ways to do this for trees that could be truly arbitrarily deep.

I would argue for this, I guess, except that "forced me to write all my code with AI" is obvious misrepresentation. It doesn't sit well with me except as representative of the same over-egged hype that surrounded the Apple Vision Pro.

Hm. Says "hand" not arm.

I don't want to second guess whether there were other undisclosed injuries but the image does show someone who could possibly have carried on typing without the use of his right thumb? Like I did for this paragraph. (Albeit perhaps it would be more comfortable using a split keyboard for more comfortable right arm position? And probably after a few days of rest)

Or perhaps with left hand only, using sticky keys? Like I did with this paragraph.

OK so code is a bit more effort, and particularly Rust or PHP would not be as fun. Python is a bit more one-hand friendly. (Quiet at the back!)

But still. _Something_ was forced here, but it wasn't the use of AI. I'm thinking more the marketing.

That's great :-)

(I am very much not an expert)

You're missing something but it's actually easy to get confused about.

GPIO: general purpose input/output. A pin that can be used by the main CPU core(s) to interrogate the outside world.

PIO: programmable input-output. A small, I/O dedicated state-machine that can be custom-programmed in a minimal assembly language to handle I/O tasks/simple protocols/state management, over GPIO/I2C/SPI etc., without taxing the primary CPU.

https://www.raspberrypi.com/news/what-is-pio/

https://tutoduino.fr/en/pio-rp2040-en/

Some microcontrollers have basic features a little similar, but it's something the RP series is taking a lot more seriously than most. The RP2040 has eight of these PIO state machines; the RP2350 has 12.

There are some astonishing examples of what these things can do. But basically think of these as delegated GPIO/SPI/I2C etc. co-processors that can blaze away at high speeds on I/O tasks without needing the main cores until something "high-level" occurs.

I don't think it is "clutching at straws" for a bar to want glasses that break less frequently, causing fewer safety concerns, and to be prepared to pay the extra, but whatever.

Broken glasses in bars, for example, have a lot more impacts than just waste.

Broken glass has to be cleaned up, causes injuries, even causes lost product in some situations.

I was in a cocktail bar once with three friends who ordered us the same chilled cocktail, served there day in, day out, and as the cocktails were poured into the glasses, three of the four glasses broke. Plink, plink, plink.

Glasses too hot, cocktail too cold, some other handling problem. Who knows. But tougher glass might not have done that.

> It shows the gigantic double standard that only anti-establishment conservatives are scrutinized by the establishment and persecuted into oblivion

No it doesn't. It shows that opposition research is done on everyone, and Trump (who already had an unprecedented reputation for lying, racism, sharp business practices, infidelities, bankruptcies, bullyig lawsuits and dubious associations) maybe got more.

Everyone in business and politics has always known Trump is a shady, thin-skinned bullying narcissist. Of course the opposition research on him was going to be a field day.

> Before J6 he was still the most hated person by the establishment and those who trust the establishment.

Because he's a shady, narcissistic bully with an unprecedented record of dodgy dealings.

There is imprecision and conceptual forcing and there are sketchy constructs in this post that are annoying given its subject area. It is also shoehorning in other known vulnerability issues to pad out the article, when it is a pretty concise topic.

I am not sure how widespread this specific nonce problem is.

It definitely is a problem -- I am not disputing that.

(Just as it's a problem that people have tended to assume that is_admin() or admin-ajax implies that by the time your hook runs, there's already a valid administrator session, when there isn't. But this is covered in the documentation.)

But the concept here is actually pretty obscure to WP developers so I would imagine they tend to consult the documentation, where they will encounter this at the end of the process:

https://developer.wordpress.org/reference/functions/wp_verif...

Nonces should never be relied on for authentication or authorization, access control. Protect your functions using current_user_can(), always assume Nonces can be compromised.

--

As to the rest of the article, I wish it were written less lazily:

> Unfortunately, as history shows, most WordPress plugins, even popular ones, often contain security vulnerabilities.

Most of them often do?

Not so. Definitely some often do, and there are repeat offenders, and many have, but by volume most WordPress plugins are small and do pretty simple things.

> So far this year, 280 critical (CVSS score 9.0+) vulnerabilities have been found in WordPress and its plugins.

This is disingenuously phrased, to my mind: "WordPress and its plugins" suggests a single authorship and conflates WP with the plugins.

WordPress itself has had no 9+ vulnerabilities this year (or indeed since 2021).

https://www.cvedetails.com/vulnerability-list/vendor_id-2337...

(Not to mention that the post is talking about 280 9.0+ vulnerabilities in seventy thousand plugins, the long tail of which have maybe dozens of activations at most.)

> There are dozens of SQL queries in every WP plugin.

Overreach again. Sure, many (perhaps the majority) of plugins cause additional SQL queries through the posts and options APIs, but most plugins contain little to no custom SQL.

> They tried extremely hard and the best they could do was find some minor charges on Trump's team.

Lying to the FBI to impede an investigation is not minor. It's federal time. The investigation faltered partly because of these lies. (This is why Patrick Fitzgerald indicted Scooter Libby)

> Yeah he did, but the context is that Trump thinks there was election fraud, and millions of people also had the same concerns.

No, he doesn't. All the fraud claims were inflated to try to find a way to explain his loss and hold on to power. And if they were not, he said, on that call:'I just want to find 11,780 votes’. Plenty of witnesses.

That is not concern over fraud, it's an attempt to pressure the election officials to change the result by a specific number. There's no honesty or civic function there.

> There is precedent for what Trump was trying to do, and pursuing every legal path aggressively is still completely different than trying to end democracy.

Producing alternate slates of electors is a criminal offence. Which is why they met in secret -- one group, Georgia IIRC, met in a parking garage -- and tried to sneak into the state houses. It's an obvious, anti-democratic, criminal conspiracy. And we will know how it was co-ordinated and linked to Trump because Jenna Ellis has now pleaded guilty to her involvement in attempts to create a false slate in two states -- Georgia and Arizona.

> It was clearly meant to be a protest to show support and then it devolved into a large riot.

No, it wasn't. "Mike Pence didn't have the courage" shows you what it was about. It was an attempt to pressure Pence and the legislature into an illegal action. And everyone knew what would happen. The internet was alive with what was going to happen, days before, and it could have been stopped; stopping it would have been presidential. Because he had lost the election and there was no more measure for which "support" could possibly have a legal outcome that changed it.

> Let's not forget the Steele dossier that as far as I know was full of lies.

So what if it was? And it's not clear it was. It was opposition research. Initially funded by a Republican. But written by an experienced spy who did ordinary human intelligence work and qualified all his claims.

If I were a gambling man I'd bet that it is true in substance.

FrankenPHP doesn't proxy to the PHP dev server. It is a PHP SAPI process manager itself.

You should be able to run FrankenPHP as the front end server just fine -- Caddy is excellent and it's my production front-end almost everywhere anyway (the Let's Encrypt support alone is worth it).

Though depending on the deployment I sometimes use Apache and mod_php still for the backend; this is still modestly less painful if you want to use WordPress in the same environment.

There is absolutely no way I would put node at the front of any server; I'd reverse proxy to it as a matter of principle, with very locked-down routing. The security situation with node package dependencies is hilariously bad, and some other server should be managing HTTPS.

Personally I consider the NPM ecosystem to be a horrific side-road in web development, and I think by contrast PHP is at least honest about what it is and what it is not. The amount of cargo-culting advice around package management in NPM is frightening.

> Node doesn't require an upstream CGI server at all. There's a server built-in to the Node binary

Though you'll still want a process manager for this to make sure it stays up. Which it won't, over the long term.

PHP also has a built-in webserver, which you shouldn't use.

FrankenPHP is the better way to do this with PHP: you get a full Caddy build, with all that offers, with a built-in PHP engine.

Do you disagree that Trump pressured the Georgia elections people to find him votes? On a phone call? Because he very clearly did. He had no business making that call at all otherwise. And lots of people were on it and were in no doubt about what it was about.

Do you disagree that his campaign -- headed by him, reporting to him, with him aware of it -- created fake slates of electors to try to steal electoral college votes? Because that seems pretty obviously to have happened.

Do you disagree that Trump knew the January 6th protests would lead to people marching on the Capitol? Do you think it plausible he didn't know and wasn't advised what would happen? He had no business organising that march otherwise -- there was nothing that could happen on January 6th to change the outcome that wasn't against the constitution.

--

The Russia collusion stuff was not, in fact, all a lie, at all.

https://time.com/5556331/mueller-investigation-indictments-g...

People were convicted for actively misleading the FBI about their contacts with Russia, so it could not be prosecuted properly. That's pretty serious (and it has precedents: Scooter Libby for example).

Mueller just pulled the final punches. Including that Trump -- then a sitting president -- lied to the investigation.

Nobody has ever "admitted that it is not true" because nobody knows for sure except probably the people who lied to the FBI about pretty much everything. But there is a hell of a stink (and that stink started with Manafort, who -- surprise surprise -- Trump tried to recruit again for this cycle, and who got the 2016 RNC platform changed to stop promising to arm Ukraine)

Right. Then you are too young (as a developer at least!) to remember. Except that Object.entries() is there to remind you. And two different for() enumeration syntaxes (for...in and for...of).

JS has an enormous amount of bad-design scar tissue.

I find it interesting that JS developers will forgive it all (global variables, iterables confusion, broken this handling, insane implicit number and int conversions, not to mention simple stuff like semicolon handling) and think PHP developers doing the same for theirs are inferior.

It's a classic example of fundamental attribution error.

> 1) Okay, but in terms of getting shit done (one of your points) how is it helpful to people to learn two languages?

It's actually pretty clarifying. Two different perspectives on one single problem domain is almost always good for your brain. Like being bilingual.

Also I would dispute that there are not, fundamentally, two different environments in the browser and Node backend even now. One of those environments is a GUI which is naturally a good application for async. The other is not. Backend web development is still largely input -> process -> output. Node is just shoehorning JS in, and pretending that JavaScript's weaknesses are strengths.

> Also speaking of over engineered, how is having to run a standalone web server along with PHP, and then having to have an entire JS stack as well not over engineered?

Not sure what you mean. There are a bunch of ways to run PHP -- one is with a process manager (php-fpm, not unlike things like PM2). Another is to run Apache as a backend to something like Caddy or nginx or some other cacher; this is actually a highly robust way to do things, because Apache can be tuned in so many different ways. And yet another is to use FrankenPHP, which is Caddy with a PHP process manager.

I personally treat JS at the front end (Vue/Nuxt) as a client application development environment, and PHP as a backend development environment, as clean separate things defined by an interface. I don't believe that blurring the boundary between code running in the client and code running in the server has ever been a good idea, nor will it ever be. It just leads to edge cases where the code has to ask, and developer traps where developers don't realise they need to know.

Elixir looks great. It reminds me of the functional and pseudofunctional programming languages I used at uni and their environments like Poplog.

I agree it's mind-expanding.

But I don't think most web development work is mind-expanding or a realistic application for it.

I also don't think using it to criticise PHP is really the right target. If you want to use a functional programming language/environment as a critique of modern web development... maybe start by targeting server-side JS.

I remember someone trying to recruit me for a London-based startup whose developers were obsessed with async and Meteor. They struggled to ship (it was a silly idea anyway) and I don't think they survived their pivot. But the tools choice was a good part of the problem: it wasn't ready and they were imagining it had harnessable pixie dust.

I can see applications for async work within the wider backend all over the place.

But the objective justification for the async stuff being involved in the rendering of page content is thin.

And since the other applications are for sort of "high level systems" programming -- that boundary between the app and the OS -- I personally prefer Go for all of that.

Node is a significant devOps/package management pain that belongs in as few places as possible.

It is also funny to see a JS developer criticise the architecture of PHP arrays specifically.

It does hint that perhaps bearjaws is (lucky for them!) too young to remember the mess that incomplete implementation of array/object duality got the JS world into.

Exactly right. I would not call myself a PHP "proponent" because at fifty I have too little time in my life left to tell people what they should or should not choose, but I do think it is rich to see this criticism from the JS side. Everything bad about Node is bad because JS is also a "fractal of bad design".

> 1. You will still need to learn JS, and now it may even be embedded in PHP depending on the type of app you are working with!

Yes, you will. But to me this is an irrelevance: JS has IMO very little business near the back end. I have absolutely no patience for the JS-everywhere thing.

(It is never necessary to directly embed JS in PHP; there are always choices. Sure, you might sometimes need to briefly template your JS, but that's true of all web environments; it's fundamental to the problem)

> 2. It still has horrible conventions

It does. But for example JavaScript is still riddled with bad conventions. Look at the mess that inconsistent array/object duality, inconsistent property enumeration, has wrought across the language for a whole generation of programmers

> 3. It was built for the web as it stood 20 years ago, HTML embedded in code, single server sessions, cgi servers, and minimal latency server to server communication.

So was JavaScript.

Laravel is, I think, the most sensibly-designed web framework that has ever existed. Every single other framework I have used has disappeared too far into the developers' own biases towards tier after tier of NIH decisions. Laravel doesn't have pretensions.

(I used to love Ruby on Rails but even I remember when the people who were the talk of the developer world with their brand new easy to use developer framework did not know that GETs should be idempotent)

> Trump did nothing of that sort for four years

This just isn't true. Look at how he proposed to force the sale of Tiktok USA to Microsoft: purely dictatorial. And there was an enormous amount of pure strongman talk, which is a harbinger of dictatorialism.

He wasn't merely "grossly negligent" on January 6th, and anyone sane knows that. Simply because: there is no legal way the Vice President could intervene.

Everything that happened on January 6th was planned, promoted (including by Trump -- "will be wild") and deliberately focussed to put pressure on Pence to act illegally. "Mike Pence didn't have the courage".

Trump even wanted armed people to be able to gather in the protest (because they weren't coming for him).

> If Trump was left alone after losing 2020, I'm pretty sure people would have moved on

Except with all the bits where he and his campaign tried everything possible including illegal means to stay in power, on a multi-state basis.

Normal presidents don't ring up the people who run elections and ask them to "find" votes.