edelbitter

Wait till you see the cPython stdlib email parser..

Any programming language these days should ship a decent rfc5234 API in the standard library, so you do not get these kinds of problems in slightly different fashion for each and every library/program.

I wonder what is so special about onerror, onload and onclick that they need to be positively enumerated - as opposed to the 30 (?) other attributes with equivalent injection utility.

Future readers will find this post if I add what Firefox called it: browser.shopping.experience2023

> after a technical meeting .. I could

To be fair, almost any form of one-on-one exchange looks really effective when you contrast it with the average badly-moderated, way-too-many-peoples-time-wasted-if-you-ask-questions, no-prepared-agenda, in-person meeting.

One contrast I find more impressive is the valuable advice I received from people.. already dead for years. Skipping possibly helping 2 or 3 additional novices, by instead spending that time on refining a quick reply to one person into a reusable misconception-untangling guide. Useful to 100 more, for years to come.

IMNSHO, if a company is not even encouraging such soft-skills via the easy pickings (like turning their buzzword-infested PR slopstream back into a proper technical weblog), they are not missing a key - they got too many locks confining available expert knowledge.

> unguided “water-cooler” interaction

This meme needs to stop. Knowledge transfer from experts to novices is way too important to be left to chance. And thanks to pre-pivot StackOverflow we even have considerable data on how much better it can be done, at least for white collar industries. Reducing the effort of experts to give advice, and enlarging the audience benefiting from a singular effort to write it down is orders of magnitude better than chance.

A really clean abstraction, but not any more once you try to correctly use it over traditional SSL toolkit APIs (e.g. CVE-2025-23419) or in conjunction with any of the the more interesting web scenarios (HTTP/3, rel="preconnect", CORS, CDNs..)

So no IPv6 in the foreseeable future?

"none of the efforts have helped reduce the annual 4,000 reindeer road deaths"

https://apnews.com/general-news-801aa30308b24b459251c60d569d...

The target group may well be strongly biased towards failures resulting in children born. Using birth control for, well, being in control. And we lack data on how bad messing with RAR regulation really is.. too much confounding effects from how bad deficiency & over-supplementation are on the mother.

Android ships a feature called bootchart which you can use to prove that most of the time your phone spends booting.. it is actually far from bottlenecked on storage or compute - bugs to be fixed; not worked around with even more complexity. Heck, some phones do not even stop playing their vendors fancy animated logo when they are finished before the animation is.

>pop-ups that let users reject tracking

No pop-up is needed to reject what is already banned union-wide. Therefore, a banner that is trying to collect my explicit+specific+informed+voluntary consent to partially lift that ban is not a "pop-up that lets users reject". Its a "pop-up that lets users surrender" some of their rights & freedoms.

Is there an opt-in for sharing such analytics/telemetry/statistics/insights (or whatever the euphemism treadmill is at now) -- or did all customers "consent" to this simply by using private settings "used by at least 20 users"?

Content that kind of looks like technical docs, but without linking authoritative sources, date when it was last reviewed, software it was verified against etc.

Nowadays with AI slop websites all over the place, plus formerly legitimate newspapers not attributing sources & edits either, this may not seem that special. But w3schools earned their reputation when that was exceptionally rude. Also, straight up wrong all over the place. But that is more of a symptom. And to be fair a lot of the software back then was straight up wrong, too. Tough job documenting the reality of the WWW correctly while IE was around.

It does align with industry standards: I am now getting dehumanized by Google after three searches including inurl or site filters.

Before StackOverflow pivoted towards "AI", community-moderating dupes was definitely one of the best features. Of course, it only works with humans acting like humans - judging by word similarity only will not suffice to bring the intended benefit for all users.

In German language (kwT) remains reasonably common. "kein weiterer Text" = no further content. Often still duplicated in the body, because people read their messages on all sorts of funny devices / in all sorts of funny clients.

Even better than any such marker: Rearranging so the acronym (e.g. LGTM, NAK, ASAP) or greeting/valediction is the last word, ticking off both the formalities and the EOM marker simultaneously.

This has been going on for so long, other parties feel justified in their similar decisions. E.g. try this accessible-for-some-browsers search result page behind the fastly "Client Challenge": https://pypi.org/search/?q=pip

Many systems do not fetch updates from the Mozilla root store, but from their (possibly Debian-derived) stable distribution of it. Meaning two highly respected entities, known for being well aware of the wider impact of their careful enforcement of strict policies, need to agree to cause any major breakage. When that happens, I can blindly trust they did the thing needed to keep the unaffected parts of that weird system working as intended.. and then still head to bugzilla and read about the background - to laugh at whoever triggered the mess.

If my revealed preference is that you should pay extra to subsidize my shopping, does that really make you any more complicit in the redistribution scheme?

>bury any negatives

I was looking for the x86-specific rant, and did not find it. You'd think that team would have had something to say about architecture complexity.

I never gave my poem to Facebook. My site is for humans. And there was absolutely no problem with that website being public, until Facebook et al wanted to move the goalpost.. again. Remember when companies started to claim that their abuse is on you, because you failed to publish the correct headers/robots.txt and their bot needs to be told the rules in specific language? And now we get the same attempt at making such distinction again, just this time its our fault for .. having a public website in the first place (should have operated a paywall, duh!)

They flat out refuse to show what the origin server sent, unless you run some Javascript. Which is sufficient to no longer care about what the browser states in the request headers.

It is difficult to gauge the size of the Cloudflare effect.. if the usage statistics the site owner is collecting.. are also not collected for those undesirables.

Well yes: if Canonical cared they could make most of their snaps work almost as good as the Debian packages they dropped, and then it would be the same to the user.

But also no: even if they spent years catching up they would not reach the level of not-sucking that .deb get without extra effort, as a result of decades of policy ossified into the supporting tools. Such as the strong expectation that apt deals with packages that can be (re)built from their declared inputs and share common build-essentials. Whereas snapcraft does not even provide the tools yet to easily rule out building from ephemeral inputs or merely-accidentally working rust versions.

Even twine decoupled itself from my python toolchain some time ago [1], through some dependency. Cannot install it unless you are on a system trusting trust in rust™.

[1] https://github.com/pypa/twine/issues/1015

I've seen people do that, and the results are.. just sad. These modern models insert their twitter-era "what grabs attention must be true" view into the very little authentic past we still possess.

We're at something like 116 now and they keep coming up with funny terms for it.

secure enclaves, secure virtualization, trusted execution environment, trusted platform, confidential computing, protected execution, LaGrande, protected launch, hardware attestation, ..

Source: https://developers.cloudflare.com/dns/nameservers/custom-nam...

"Our Free plan gives Cloudflare access to unique threat intelligence"

https://blog.cloudflare.com/cloudflares-commitment-to-free/

de-clickbaited: to spot minor differences between two images, view them like stereograms