missblit

A browser rendering engine's output isn't purely graphical, and most things can be tested through other means such as by reading console.log output, looking at the DOM, or looking at computed CSS styles and/or bounding-box information.

In fact there's a good reason to keep graphical tests to a minimum: web specs do not dictate things down to the pixel level, so pixels can shift around from version to version, requiring the occasional golden data rebase.

Fun aside: Chrome's test suite contains a font named ahem.ttf where (almost) every character is an identical black rectangle. This allows tests to include text without relying too much on the details of a particular font.

It means that the web is built on top of a bunch of working draft specifications.

If you work in the web space you quickly learn to shrug, double check that browsers do actually implement this version, and proceed.

Yeah, but any excuse to talk about memory profiling! It's one of my favorite past-times.

> Understanding we are memory-bound is crucial, as it directs our efforts towards reducing memory consumption in order to accommodate more users on the server.

While this is true, it bears mentioning that in a service handling many requests they all smear together memory-wise, so _any_ latency savings can also ease memory pressure (a memory allocation has an area: bytes × time). So for instance it can make sense to minimize memory held across an RPC boundary, or even to perform CPU optimizations if they would improve the latency,

> e.g. examining a memdump rather than just measuring overall memory utilization

A flame graph also would have highlighted this (without the need to look at what might be user data), and is usually where I start looking for memory optimization. I mean if you don't know what code is allocating lots of memory where would you even start anyway?

Additionally I've found that looking at outliers, while a good idea, can sometimes lead to wild goose chases if you're not careful. There can be pathological edges cases which are rare enough to not actually matter in practice.

I am admittedly extremely biased against cryptocurrencies (stop reading unless you're ready for this re-hashed rant), but I don't see how users (read: people with real money) care about any of this stuff.

On-chain games? I don't want to feel like I'm in a laggy casino, I just want to blast zombies with a rocket launcher and I can already do that perfectly fine.

Uncensorable Github? Yeah, it's called "git".

Decentralized DNS and Postgres? Yeah, it's called "DNS" and "Postgres" respectively.

Web3 twitter?

> The winning Web3 Twitter will ultimately offer the features we have been eager to see: data truly owned by users themselves, uncontrolled by one entity or even one man, multiple clients permissionlessly built, multiple options of curation algorithms that users can choose from.

Congratulations you just described Mastodon and ActivityPub. No blockchain required (though it does depend on those boring web2 technologies like HTTPS and DNS).

Counter counterpoint: Chrome also has an entire system for gating features behind flags without needing to write a new command line flag for each one.

Counter counter counterpoint: I like command line flags and you can take them from my cold dead hands.

The word "Zygote" will actually be really clear to anyone who's been exposed to Chrome's multiprocess architecture.

https://chromium.googlesource.com/chromium/src/+/HEAD/docs/l...

> A zygote process is one that listens for spawn requests from a main process and forks itself in response. Generally they are used because forking a process after some expensive setup has been performed can save time and share extra memory pages.

With that background, --zygote isn't actually a flag at all. If you click on it it takes you to a string constant, but that string is actually a value for the --type flag. e.g. anzygote process would have `--type=zygote`.

`--type` is itself an internal flag, explaining it's lax description of "Flags spied upon from other layers.". However it is briefly described in the documentation I linked above.

Dear Santa,

The one thing I really really want for Christmas is for you to respond to my email with an assortment of well known phishing attempts, spam, and scams.

Sincerely, - Jane "Good luck with the email filters" Doe.

Edit: Also hopefully Santa doesn't trust a spoofed "From:" line.

I'd guess approx. zero code is ready for overflow unless it's fuzzed extensively, written in a language that makes you think about it, or part of a section where security or reliability was paramount.

At my job we have fuzz tests which complain about this class of bugs all the time. So far I haven't been able to prioritize fixing them since there's always bigger fish to fry (and the alignment bugs are more fun to fix anyway!).

"Zero cost" here means the author is asserting it doesn't add a bunch of extra branches or instructions or whatever (compared to normal addition) by the time it gets compiled down to assembly.

For example there's a slow looking if statement in there:

    if ((_is_neg() && _storage < usmin) ||
        (!_is_neg() && _storage > usmax))

But in theory an optimizing compiler could remove it entirely since it can never be true (on C++20 or above).

Whether the compiler does this in practice depends on a variety of factors, but in general they're fairly good at spotting "obvious" optimizations.

Flashing lights can cause seizures yes. That's why you'll often see a warning at the start of more visually frenetic videogames.

Famously an old Pokemon episode gave several hundred kids seizures. The wikipedia article contains the scene if you're feeling particularly brave :) https://en.wikipedia.org/wiki/Denn%C5%8D_Senshi_Porygon recommend not watching fullscreen and being ready to click away, as it is a bit intense -- I'm not epilectic but it makes me feel _weird_.

I also remember back in the day learning OpenGL I accidentally wrote a program which would flash between my desktop and a solid color at 60hz. It was literally painful to look at in the few seconds it took to shut it down.

Streets of Sim City was great. I'd use a bug to create glitchy self-intersecting bridges I called "super springs" which launched cars straight up. The AI certainly didn't know what to make of that.

QPDF is a good C++ library for "content preserving" PDF transformations, and is used by the Python PikePDF library.

Note that CData can _only_ be used what HTML calls foreign content.

So `<math><![CDATA[x<y]]></math>` will print x<7, but `<p><![CDATA[x<y]]></p>` will emit a `cdata-in-html-content` parse error (your compliant HTML parser is allowed to give up here if it's lazy) and is parsed as `<p><!--[CDATA[x<y]]--></p>` (your HTML parser will actually do this because giving up leads to poor user experience when no one else does)

<plaintext> is also fun. Unlike <xmp> you can't get out of it with a closing tag.

Aside: plaintext is one reason browser DOM is a superset of HTML. By which I mean you can add <plaintext> to the middle of your DOM through JavaScript and everything is hunky-dory, but it's impossible to serialize the DOM to HTML so it'll HTML-parse back to the same DOM (at least if the serializer doesn't produce any JavaScript).

It's milliseconds (well except for 0, which stockfish considers an edge case)

See: http://wbec-ridderkerk.nl/html/UCIProtocol.html , https://github.com/official-stockfish/Stockfish/issues/3720

That said I don't think a strong chess engine alone would be enough to pass this puzzle.

Weird, it's not letting me promote my pawn even though it looks like a valid move (unless I suck at chess and it's not valid for some reason).

The first challenge was fun, but I'll probably stop there since I really don't have the patience to do the more complex stuff (at some point debugging computers just feels like work even though I don't work in security at all haha).

I loved Free Lunch Design as a kid since good free PC games were slim pickings back then.

Icy Tower, Operation Spacehog, and Happyland Adventures were all amazingly high quality for software that was given away for free.

How to implement a state machine in Python:

    def next_state(state):
      if state == 90000:
        return 0
      return state + 1

But more seriously; once I was asked to implement offsetof in an interview for an entry level C++ position. I didn't quite remember that this was impossible during the heat of the interview, but I did remember enough to not produce an incorrect solution that relies on undefined behavior. I didn't get that job.

Weird Al said it best:

> It's hard to bargle nawdle zouss with all these marbles in my mouth.

FWIW as a professional C++ programmer since I graduated university 7 years ago I haven't really had that experience.

There's certainly a large learning gap; both for "classic" C++ as well as the popular modern features. But once you get over that I haven't found other peoples C++ any harder to read than other peoples C or JavaScript or Python.

No one's reaching to esoteric features like "..." or atomics unless they're some low level library wizard (in which case all their friends are also low level library wizards) or the situation actually calls for it.

It was mentioned at the end of the blog-post as the solution the author used.

> Fixed the Gooble App Engine behaviour by adding an explicit configuration to the appengine-web.xml

C++ gives lots of optional features, so it requires a bit of discipline to use effectively and avoid running into the state explosion that the author ran into for both their gripes.

But ironically one the reasons the author chose C++ is that enforced a consistent coding style (As a C++ programmer: I don't believe you). There's just as many pitfalls in C as well like unstructured programming via goto, signal handlers, not being disciplined about structs when doing OOP, etc.

---

Take the second issue about partially initialized objects being hard to avoid without using exceptions in C++. You can actually do something similar to the C approach the author prefers! Just make the iffy constructor private, then wrap it in a builder function which can either return the object or an error.

However that requires the intuition that requiring the user to call a follow up init() or is_valid() function is a bad idea, which requires a lot of C++ experience.

> The Solid DID method specification is a specialisation of the Web DID method [DID-WEB] whereby write (create, update, delete) operations are more tightly specified. The Solid DID method is designed to be generic enough to be compatible with other Web-based systems which implement read and write operations using HTTP methods (RFC 7231). For this reason, we are considering whether to name the DID method did:https or did:rest or similar.

From this paragraph it seems pretty messy that there's both did:web and did:solid. Is the idea that every random company under the sun writes their own slightly different did-url to https mapping? And that every user-agent implements all of them?

So we have:

* Statically allocated ("frozen") core modules for fast imports

* Avoid memory allocation for frames / faster frame creation

* Inlined python functions are called in pure python without needing to jump through C

* Optimizations that take advantage of speculative typing (Reminds me of Javascript JIT compilers -- though according to the FAQ Python isn't JIT yet)

* Smaller memory usage for frames, objects, and exceptions

Dang that certainly does sound like low hanging fruit. There's probably a lot more opportunities left if they want Python to go even faster.

Couldn't you use a Content-Security-Policy for this?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

> browsers no longer cache resources across top level sites.

Wait is this true? Definitely warrants some kind of citation. If no one's heard one way or another I might test it later because I'm pretty skeptical of this claim.

Edit: mind blown

Yes. From the article:

> To learn more about the scale of the global arachnid trade, the authors of the new paper used a handful of search terms — “spider,” “scorpion,” “arachnid” — in nine languages to identify websites that might be selling the animals.

It is however a lot easier to cart around a chain tool and a replacement chain than a replacement generator.

There is a place in the web for animated images, which should be obvious from how much people still use GIF in 2022. Images can be easily embedded in user contents by a wide variety of websites.

Also if you forbid animated gifs, you should go one step further and forbid animated SVGs!