imakesnowflakes

I thinks this is where our difference in comes from.

When we are reading code, we are not usually reading the strings contained within.

We are reading variables names, we are looking at where they are used, where they are assigned, stuff like that.

I very rarely look inside the strings when we are actually reading code. When reading code, strings are just black boxes where nothing can happen. So we can completely ignore them.

With this pep, that will change. And readability takes a big hit. Strings are no longer black boxes.

And actually you can get the " {value} if very long text" format right now using the format function, but it right now requires an explicit list/dictionary of variables.

This explicit list of variables really helps in the context of reading code. And forcing users to write down that explicit list of variables to use, is good.

Exactly when you need to apply this principle...

https://en.wikipedia.org/wiki/Wikipedia:Chesterton's_fence

>In the matter of reforming things, as distinct from deforming them, there is one plain and simple principle; a principle which will probably be called a paradox. There exists in such a case a certain institution or law; let us say, for the sake of simplicity, a fence or gate erected across a road. The more modern type of reformer goes gaily up to it and says, “I don’t see the use of this; let us clear it away.” To which the more intelligent type of reformer will do well to answer: “If you don’t see the use of it, I certainly won’t let you clear it away. Go away and think. Then, when you can come back and tell me that you do see the use of it, I may allow you to destroy it

I will go further and say that I will even take readability over convenience.

This is a step in the reverse direction. Please don't do this. I am not sure why this is even considered. We already have ways to do this clearly. Let us not add another way to do this in a less readable way that is a lot more easier to write. That is a deadly combination.

Features in python are geared towards more readable code (I know about the stuff you can do with things like comprehensions, but hey I think their power justifies them enough). This will lead to people using this format due to initial convenience, but ends up regretting doing so.

Please remember that code is read more often than it is written. So a requiring a little verbosity if that can enhance readability even a little bit, is good. I hope these kinds of good things about python does not get removed.

I am coming from 9 years of experience with PHP. And I will say that this is not worth it. And this is actually one of the features I have come to like in Python now.

And that is not considering the implications of having expression evaluation inside strings...

> tab sandboxing

Cookieplux[1] is a plugin I made for Firefox, It is still waiting for approval from Moziall. But I have released the source. So you can build it yourself.

[1] http://firstglitch.com/cookieplux/cookieplux-firfox-plugin-f...

I have been working on this plugin for a while. I just wrote up it's documentation. It is still waiting in the Mozilla's approval queue.

1. http://firstglitch.com/cookieplux/cookieplux-firfox-plugin-f...

Feel free to try it out.

>Am I the only one who actualy finds DuckDuckGo's search results overall better?

At least for vague technical queries, I still find googles results vastly superior, consistently .

I agree with you that it is not a crime by definition. But I think there should be a sufficient detriment to prevent people from doing this. And I think labeling it as a crime is the easiest thing to this end.

What is the alternative? Being frowned upon?

You say about how people automatically agree drunk driving should be a crime. But I always use to wonder how blindly we trust others on the road to behave responsibly. How often we leave our lives and our loved ones, to the fair judgement of a stranger.

Driving on roads will be impossible, without that trust. When you are drunk, and choose to drive when you judgement is poor, you are betraying the trust implicitly placed on you by every other person on the road. So isn't that something like a crime? Just thinking loudly.

I tell this as a moderate drinker myself.

>How are there security concerns?

It is more about breaking a general principle of not mixing executable stuff and non-executable stuff. I have written more about it here.

https://news.ycombinator.com/item?id=10063637

>its optional to use explicit variables for clarity

I don't think it is optional. If it was optional, then the behavior would be to interpolate from local variables by default, and do them selectively if an argument list is provided.

So someone, in the past, thought about this and decided that it is best to always require an explicit list of variables for interpolation.

This pep is trying to undo that decision. Why? What was the reason to always require an explicit list of variables? Didn't they think that it would be convenient to automatically interpolate from locals? What was it that made them decide against it? Isn't that reason still relevant?

Without answering these questions, I think it is not wise to continue with this pep.

Ah yes. You are right.

> You could, of course, act on user input inside an f string, but the fault of that lies with the developer not sanitizing inputs, which is an issue with anything....

A good language protects the experienced developers from making a stupid mistake, and forbids the novices from them to trigger a learning response and guide them to better ways.

Example: In python if you use a normal map to implement an algorithm that depends on the elements being ordered in some way, then you will get different results for each run. If I remember correctly, I think python will randomize the order of the map every time it is iterated over. You see, developers could have got away with blaming the user for using an ordinary map when they should have used ordered map. But instead, they implementation map in such a way that it would be impossible to use it incorrectly.

> I think may be you gave the PHP example as how this mixing can lead to certain unintended issues (not necessarily in python with this PEP..

Yes. correct.

>it's just a convenience..

I come from a land filled with such 'conveniences'. it is called PHP. You can compare

    var_dump("228" == "0xe4");  -> True

See? a convenience. You can compare hex and decimal strings with out explicit conversion. And what is the result? Countless exploits and security holes that leverage things like these, all that can be possible blamed on the programmer. So was this worth it? Where would you draw the line? How much correctness are you willing to trade off for a minor convenience?

I may be over-reacting. But I think this pep is a step in the wrong direction and should be aggressively corrected.

>can you expand upon this..

It is more of a matter of breaking a general principle, which is don't mix executable stuff (expressions) with non-executable stuff (strings) implicitly. This has been a frequent cause of various security issues in the past eg: Sql injection, xss, various remote code execution vulnerabilities.

Strings should be dumb and without any ambiguity. On top of breaking this general principle of not mixing data and code, this pep also want to introduce numerous rules regarding various edge cases, which further makes it harder to reason about it, which increases the chances of slipping a vulnerability. For example, right now, you see a long string, you only need to look at the argument list to see what possible things it can do. Because the string itself is dumb, it cannot lie, and whatever execution that is required to produce that string, happens in the context of code itself. With this pep, this changes. Now a string is not dumb. It is smart. It can do 'stuff' on its own. It can 'hide' things, it can lie and masquerade as something innocent. I think this is bad.

Take an example of PHP. You can embedd php code in what ever content. In fact you can embedd php code in a valid image file in the metadata fields, and pass it as an Image. if you can call the image file as a script, then the embedded php code will execute to do your bidding. This has to be one of the most commonly used technique to hack sites running php. Here is one from last day [1].

Those are some of my reasons for the concerns..I know I am not still giving anything specific. But if we could easily think specific cases about how something could be exploited, we wouldn't be implementing that in the first place. So sometimes we must rely on general principles learned from the past while assessing the issues associated with something. Hence my concerns.

[1] https://www.reddit.com/r/PHP/comments/3gq3mh/my_site_was_hac...

Reddit discussion

https://www.reddit.com/r/Python/comments/3gfaji/pep_501_tran...

I think this and pep 498 are a pretty horrible proposals and does not fit well with the rest of the language and it's spirit.

1. Decrements readability. When variables are hidden inside strings, you need to check for presence of a variable in two contexts. In the code and inside the strings. With format and % functions, you will be able to spot the variable in the argument list, which is part of the code itself.

2. Security concerns regarding automatic evaluation of expressions inside the strings.

Also, why was format and % made in such a way as to require an explicit list of variables? What was the reasoning behind it? Is that reason no longer relevant?

If I had unlimited amount of money, I would buy all the advertisement channels of the world and fill them with classical music. I would by all the billboards spaces and burn them to ground or if that is not possible, I will paint them sky blue with white fluffy clouds or camouflage them.

Just kidding (not really).

A bit more realistically, I would build an open source car company. I mean, a car which is 100% documented and documentation publicly available. with all the diagnostic tools and information how to use them available publicly.

I have one uploaded on Mar 12, 2015, it is at position 25 right now. And it has been at around that position for quite a while.

> The absence of free will forces us to stop judging people..

Why would that be?

If A harms B, then your argument is that B has no right to retaliate it, because, that A should harm B was inevitable, and was totally out of the control of A.

But my argument is that just like A's harming B was inevitable, so is B's judgement of A and the further retaliation in response to the A's action..Inevitable.

In other words, the world should just go on as it is, even in the total absence of free will. What is important, I think, like many other things, is the 'appearance' of having free will. Because without that, all life looses it's meaning.

One year? That is like "Takeaways from riding a Superbike in first gear, for one minute - Verdict. Super bikes are way overhyped!"

A correction. it is

    if ($k === '1') instead of if ($a === '1')..

>we went from Hello World, to doing VGA graphics with the different SCREEN modes and FILL, LINE, etc, making programs that could play christmas carols using the built-in MIDI commands

I miss these in the new generation of languages. You could do so much cool stuff with swithcing to graphics mode and using pixel, line and circle commands. I was able to write a (1) shooter where you shoot down a plane that moves horizontally across the screen and the projectile was subject to 'gravity'. (2) A program that 'morphs' one outline to another. (3) A wireframe/3d space shooter.

I was able to build all this without the internet, with plain high school math and physics. And I wonder if I was a kid who grew up in todays environment, I would have been able to build the same. I have the internet, but I doubt I would be enticed into making stuff like that, like I was enticed by QBasic. I mean, one minute you are printing multiplication tables, the next minute you are turning individual pixels on/off on the screen. I remember it being a very empowering feeling.

>It will still work calling $a['1'] with the quotes so what exactly is the issue?

Oh yea. Try this.

    $a = array ('1' => 'one');

    foreach ($a as $k=>$v) {

    if ($a === '1') {

      echo "found one";

    }

    }

Surprise! Never prints "found one".

THAT is the issue! I used '===' so I should be safe from type coercion issues, right? Well, a hidden rule in php says no.

See this bug..oops feature, when it bit even experienced php programmers here

https://www.reddit.com/r/PHP/comments/2zhg6z/how_true_is_thi...

See that post and the comment from the user e-tron. Both of them who are experienced php programmers

> This is the exact bull* that good hearted Haskell and Lisp guys have to face and fix because of arrogant people like you.

No. It is not. It takes a lot more effort to produce the code of same quality in php. For one thin, you have to consider that one has to keep and endless list of gotchas and edge cases (yes, all languages have these, but the list is nowhere near as long as it is in php) in mind when writing any amount of php code.

>You can write crystal clear code in PHP that anyone who started with C..

tell me, what does this code do, in php?

$a = array('1' => 'one');

What is the value of $a after this statement?

Answer: It appears that it is creating a dictionary with a string key that maps to another string value, but instead it creates a numerically indexed array with value 'one' stored at numeric index 1.

Do you call this 'Crystal clear'?

PHP is a language that breaks the principle of least surprise at every turn. Please don't say you can write crystal clear code in it, if you are actually interested in spreading information and knowledge, as you put it.

As someone who has worked with php over 9 years, I can confirm this. I think beginners should not be, under any circumstances, suggested to start with PHP.

I shudder when thinking about the damage that showing == vs === stuff (PHP's type coercion rules, in general) to someone new to programming! It is such a waste to force someone new to learn a bunch of edge cases and weird behaviors and an endless list of php lol's that literally have zero value outside the context of PHP.

> Where does this inherent distrust come from?

It is quite simple. It comes from looking at the concerned incentives.

>but it has the shortest path to "shit's on screen" amongst web-based scripting languages

Let us see. You follow the shortest path to make a service/web app. I use your service/app. You get hacked. (By the way, has the php community yet have a clue how the php.net site got hacked, like, I don't know, 2 years back?), I am fucked.

Who wins?

Instead, what if you put in the effort to actually educate yourself about the stuff you need to know before you put a service online? What if you actually use a language that is not a complete mine field. What if you actually use a language that will actually tell you that you are wrong, right to your face, instead of conveniently working half of the time?

And the funny thing is that it is not even the shortest path to "shit on screen". Check out how easy it is in python to put stuff on screen

http://flask.pocoo.org/

The worst thing right now is people who are actually promoting php to new comers! My earlier comment was removed from here, because I told not to start programming careers with PHP.

> if you chose PHP (or worse program in it because it was what you inherited as well) you are a "lesser programmer".

If you choose php, I will assume that you.

1. Either is not aware of that php has a million gotchas that you need to avoid at every step. Take a look at the ever growing (!) list at /r/lolphp.

2. You don't see the significance of the aforementioned gotchas. For eg, you can show things like php's registerglobals to a newbie, and he will be impressed by how convenient it is. He won't see how bad it actually can be. This is not because he is a "lesser programmer", but due to a case of "unknown unknowns". Note that you can have 10 years of PHP experience and can still be like this.

> Also modern PHP really isn't like old PHP, composer, PSR's, The FIG....

These things does make a difference. But only on the surface, not deep down where it is really rotten.

I am in no way justifying it. Oh. In fact, I hate it to the very last shred. I hate it so much that if I somehow end up looking at such a billboard, I avert my eyes before my gaze end up where they want it to end up which is their (brand name/ caption). So fuck you ad!

>If I choose Pepsi over Coke because of some subconciously altered motive, eh. Whatever.

It is not about choosing Pepsi over Coke. What make you choose (Coke OR Pepsi) over plain old cold water, when you feel thirsty?

Another issue is when you let Ads work, you are allowing the brand that had the most aggressive ad campaign to reap a profit. Not the one with a better product. Wont this prevent a better product from rising in the market?

The purpose of the image is to guide your gaze to the ad. And nothing does it better than a scantly clad beautiful women. It is like the oldest trick of the trade.

Ever wonder why all those billboards feature beautiful women when the product has nothing to do with women? If you try, you can recognize how your gaze is captured by the image of the women (thanks to a strong evolutionary instinct built over million of years to quickly identify potential mates), and how your gaze naturally follows to the name of the brand/caption on the board...If it was only the brand name/caption, then you would never have even looked at it.

I think this quote from the movie Network, might be relevant here.

http://www.imdb.com/title/tt0074958/quotes?item=qt0447849

The scene (in fact, the whole movie also) is worth watching too: https://www.youtube.com/watch?v=NKkRDMil0bw

I have asked here about this in the past [1]

I am not sure regulations will help much. For one thing, is is hard to specify where the limits lie, and to objectively detect when an ad cross the limits. Another thing is that all regulations bend depending on how much money you have to throw at those. And in this case it is a lot.

So along with regulations, I think it is also necessary to educate kids to defend against manipulations like this. I don't think schools will ever do something like this. So it should come from parents, from home. Teach them how such manipulations work, teach them how to recognize and avoid them. In the process, you will also teach them very useful critical thinking.

But there may be social aspects that work against these. For example, if you never watch ads in your home, your kid may get ridiculed in the school because he/she does not know about Ad xyz. The same way you will be ridiculed today for not using Facebook or whatsapp.

So, in short, I think we should talk about this, A LOT. Both online and offline.

Build a public awareness.

Make it cool, to NOT watch ads.

[1] https://news.ycombinator.com/item?id=9690432

>How much more might we advance the state of the art in every field if the experts in those fields are still around..

That will also keep bad guys around indefinitely. I think we can agree that things can be better. (I mean things like, environmental issues, corruption and foreign policies). But one cannot really hope to change the viewpoints/values/priorities of people already in power. Our only hope is the new generations, which we can hope to bring up with better values, which will eventually replace them.

Imagine if Hitler could live indefinitely or created an army of clones. Imagine every corrupt/powerful person in the world right, has the capability for doing this.

The point I am trying to make, is good cannot do good, when evil forces are in power. And the only thing that prevents evil forces in power indefinitely, is natural death. (We can all agree that things like democracy are not really doing a good job at that, right?)