HNHacker News
TopNewBestAskShowJobs

missblit

1,049 karma · joined December 2, 2013

submissionscomments
missblit··on Noto emoji, a new black and white emoji font with less color
Google already had a black and white emoji font. I think from before color fonts were a thing. However they stopped updating that in 2015 (https://github.com/googlefonts/noto-emoji/commits/2f1ffdd6fb...). This is likely a descendant of that rather than completely from scratch.

It's also interesting they call out emoji being too detailed as a problem. For some characters like Pistol (apple-fied into Squirt Gun) they've copied Apples style -- presumably to avoid confusion. So acknowledging that not all fonts need to look the same is a bit refreshing there.

Though of course the black and white pistol still looks like a squirt-gun

missblit··on SerenityOS Browser now passes the Acid3 test
Your link also only gets 99/100 on modern browsers.

Why? Well...

    // test 64: more attribute tests
    // attributes of the <object> element
    var obj1 = document.createElement('object');
    obj1.setAttribute('data', 'test.html');
    // ...
    assert(obj1.data.match(/^http:/), "object.data isn't absolute");
See that "http" in test 64? Turns out you'll get a score of 100/100 if you use the http version of the URL instead of HTTPS.
missblit··on On infinite ethics
I can only reason about infinitely many universes if they're sufficiently similar to my own universe. But in that case I might as well just forget about the whole infinity thing since they're all independent and average out. If something is worth doing here on Earth then it's worth doing.

Also the whole "acasual" thing never made sense to me. What I do doesn't influence anything in another universe by definition, so other universes shouldn't influence my decision making at all.

missblit··on Two-minute battery changes push India’s delivery riders to switch to e-scooters
This reminds me of winter biking back in university in Idaho (fairly cold winters)... with a night shift that got off at 23:00.

The path I was on wasn't really maintained with winter bikers in mind, and I never even thought of researching winter tires, and I wasn't a particularly skilled cyclist (I don't think I cleaned the chain once in several years).

So I did what any stubborn-minded fool who had to bike to their job rain or shine would do: I simply fell over repeatedly until I started getting the hang of things (pro-tip: just don't turn at all and you won't fall over)

Nowadays I'm too old to consider regularly crashing during my commute to be a particularly sane idea; though I still don't have a car and wish cycling infrastructure would get even a fraction of the attention that car infrastructure does.

missblit··on Doctors who use Google Translate to talk to patients want a better option
Unless a recent immigrant or tourist has a medical emergency right?

Or even a longer-term immigrant who never quite learned much medical vocabulary.

missblit··on Namecheap: Russia Service Termination
Regardless of your intentions, your list idea would be used for racist discrimination.

You might consider a list of registrars that do stuff you disagree with instead.

missblit··on Explain the first 10 lines of Twitter's source code to me
Per https://html.spec.whatwg.org/multipage/dom.html#the-dir-attr... it'll default to LTR

> The directionality of an element (any element, not just an HTML element) is either 'ltr' or 'rtl', and is determined as per the first appropriate set of steps from the following list:

> ... If the element is a document element and the dir attribute is not in a defined state (i.e. it is not present or has an invalid value) ...

> ... The directionality of the element is 'ltr'.

It's not that common to see LTR explicitly specified for the document, but you could imagine some code that either outputs ltr or rtl based on the user's preferences. (Indeed I just checked and twitter puts a rtl there if you're using it in Arabic)

missblit··on Explain the first 10 lines of Twitter's source code to me
So actually reading the post now:

> People even used to use * { margin: 0 } which is totally overkill and not great for performance.

Wait why would that be bad for performance? Zero margins should be just as fast as 8px margins, and if you have this style in the head section it's not like the browser will have to relayout a bunch of stuff.

missblit··on Explain the first 10 lines of Twitter's source code to me
So... how did I do? ;)

---

<!DOCTYPE html> is a magic string that indicates the document should be parsed as an HTML5 document (possibly avoiding quirks mode too? I don't remember what triggers that).

"Doctype" comes from the XML concept, and XHTML documents may have a different doctype.

<html> is the document's root element. It's supposed to be there but the browser will create it if you leave it off.

ltr means the document direction is left to right. direction here refers to the direction of lines (e.g. in English lines go left to right, in Arabic lines go right to left). There's another value that influences writing mode too below the document level, but I forget what it's called.

Browser implementers and webmasters have to be careful with a non RTL direction; as it changes the scrolling element origin, the browser will have to deal with logical vs physical coordinates, and scrollX may go negative. I believe scrollX was reconciled across the different browsers fairly recently.

The meta tags tell you metadata about the document. I believe they're supposed to go in the head section, but again the browser will create that for you if you don't.

lang just tells you the language of the page. I'm not familiar with what this is used for, but you could imagine a search engine using it for one thing (e.g. Google's "display only results in English").

The two letter country code comes from some standard I don't remember the name of. Also used in TLDs. Watch out for easy to confuse countries like cn, ca. Some websites like to use the trendy .io TLD, but I heard rumors it wasn't run very well.

charset="utf-8" means the document's bytes should be treated as unicode. Note that this meta tag should occur in the first 1024 bytes of the document or browsers may not notice it. Without specifying the charset the browser will likely fall back to... I think latin1?

Anyway I read once that browsers don't get too fancy with the encoding detection on purpose, to avoid people relying on unreliable heuristics.

Another interesting point is that Chrome can load utf-8 documents as utf-8 without a metatag if it's a file:// URL. I guess conceptually this is because local files can't specify the encoding in HTTP headers or something?

Viewport specifies the responsive sizing behavior. This is described in the CSS Device Adaptation Level 3 spec; but the section on actually parsing this tag is pretty gnarly. If I remember right it was a non-normative section and had a few weird corners that were likely left over from matching browser implementation quirks.

Anyway you need the viewport for responsive viewport sizing. 99% of the time you can just copy-paste the usual string and don't need to get fancy with custom values or anything. There's also a newer way to specify the viewport behavior through CSS (and indeed Chrome basically converts the meta tag to this internally), but it didn't really work right last time I tried it.

"og:" is from some semantic web standard. I never learned the details, but basically it tells crawlers some basic information about the page's contents.

For the remaining lines; presumably Safari recognize some custom meta tags to change Apple device theming. The "origin-trial" may refer to Chrome (or Safari?) origin-trials, where webpages can opt into (or sometimes out of) experimental browser behavior.

Line 10 is CSS. Presumably there was a <style> tag off the right end of the screenshot on line 9.

Interesting point about CSS or JS embedded in HTML:

This actually changes the parser's language from HTML parsing to CSS or JS parsing on the fly. But with a special rule to look for the end tag and switch back to HTML. This is why you'll see people break up the string "<script/>" if they have to embed it in JS embedded in HTML.

But my favorite is the <plaintext> tag which switches the parser to... plaintext. Unlike CSS or JS there is no special escape-hatch and it's just plaintext for the rest of the document.

Speaking of embedded languages: SVGs have a title element but it isn't the document's title element. Poorly written browsers or crawlers could confuse the SVG title with the document title if they don't have an understanding of tag namespaces (another relic from XML perhaps?!)

missblit··on DuckDuckGo \u202E
The title of the page is "u202e at DuckDuckGo" which doesn't even have any funky unicode in it.

So you might have something else going on if it shows up as "[object Object]" in your browser history.

missblit··on DuckDuckGo \u202E
For unicode security considerations see http://www.unicode.org/reports/tr36/

The report is divided into visual and non-visual security issues. Our old friend RTL override is covered, but mostly in the context of URLs.

missblit··on DuckDuckGo \u202E
> `innerText` doesn't include the RTL marker

I'm too under the weather to dig into this, but this might be a mismatch between Firefox and the spec. I don't see in the spec [1][2] where this character could be removed since it shouldn't count as whitespace for whitespace processing.

It looks like in Chrome `innerText` contains the override. And the innerText spec is only 6 or so years old (!) so it wouldn't be too surprising if there were was a lingering incompatibility.

[1] https://html.spec.whatwg.org/multipage/dom.html#the-innertex... [2] https://drafts.csswg.org/css-text/#white-space-processing

missblit··on Decommissioned Atlas F missile silo complex for sale
$300/person/day and you're serving them hot pockets and Mountain Dew for breakfast?
missblit··on The Manga Guide Series
Who Is Fourier was the OG manga guide to fourier analysis. And kind of a weird book in general.
missblit··on I read the federal government’s Zero-Trust Memo so you don’t have to
TV streaming services already do as much of this nonsense as they can get away with. The more "secure" of an environment their DRM runs in, the higher resolution the image they'll let you see.

It's just subtle enough (e.g. lower definition but will still play) and most people use "secure" enough setups that only techies, media gurus, or that one guy who's still using a VGA monitor connection end up noticing

missblit··on Surprises in the Bitcoin blockchain and how they are stored (2014)
I don't see why bitcoin nodes would be immune to DMCA takedown notices or other legal remedies. Sure it'd be a pain and (so far) not usually worth the hassle, but it'll have to come up eventually right?

What's that? It's impossible to take down a block without messing up the entire blockchain? Well maybe Mr. Bitcoin should have thought of that when making the data so disturbingly entangled!

missblit··on More Americans are saying they’re ‘vaxxed and done’
> Then this new omni variant comes out and they're badgering everyone to get boosted NOW or your no longer considered fully vaccinated.

Currently the CDC still considers someone fully vaccinated after the two dose series. As far as I can tell there aren't any booster requirements at the national level.

missblit··on Keyboard lets people type so fast it’s banned from typing competitions
Every time I get a new laptop I have to adjust my muscle memory since their layouts vary so much :( still can't type the upper right letters consistently on my current laptop.
missblit··on FAA investigating controversial crash video
His youtube channel really sets the scene...

"I got stuck on a chairlift", "Skydive ends in police car", "A helicopter left me in the ocean", "I Brought My Dog Flying (Bad Idea)"... just on and on.

In the don't bring your dog flying one he starts with "this story may or may not be true", mentions that his gopro coincidentally didn't capture the critical moments, then talks about nearly crashing during takeoff and all his electronics going out and his dog panicking. So of course he alledgedly continued on without navigation into a no-fly zone instead of y'know turning around and landing.

I'm not totally 100% convinced the stuff is all fake, but at the very least he probably shouldn't be flying...

missblit··on Facebook said my article was false – now the fact-checkers admit they were wrong
Snopes would usually list that as mostly true or true right?

That said I stopped following them when the websaite was taken over by ads and whitespace.

missblit··on Ask HN: Working with large code base for the first time
A codebase has a time dimension, and utilizing this effectively is critical.

Not sure when a bug was introduced? Write a test then bisect (if you can't automatically bisect frontend code you have other problems, but manual bisects work in a pinch).

Not sure why something was written the way it was? Hey sometimes this stuff just evolves naturally, try looking back through blame history to see how different commits effected the code.

Not sure what needs touching to add a new feature? Try seeing if you can find a similar feature that someone else wrote in the past.

missblit··on Sonic the Hedgehog for Commodore 64/128 + REU
Here's your wonky bootleg: https://en.wikipedia.org/wiki/Somari https://www.youtube.com/watch?v=DNRBcjhT2Wc

Sonic The Hegehog. For the NES. And you play as Mario.

missblit··on Bitcoin Price Tumbles After Wall Street Selloff
The price of bitcoin is just the most someone's willing to pay for it right now.

If it dropped to zero it wouldn't mean any bitcoin or USD disappeared, just that no one wants to buy it; mathematically everything still adds up.

The 300B number comes from market cap. Take the current price of BTC, multiply it by the number of BTC, and call that the value of bitcoin as a whole. But that's just an overly simple guess to the total value, not a mathematical fact.

Reality is of course more complicated: Imagine the BTC market as an order book. Maybe there's 10 people with an order to buy for 6k or less, 3 people with an order to buy at 5.7k 5 people with an order to buy at 5.5k or less, etc.

Then if someone sells 18 bitcoin they'll get 6k for the first 10, 5.7k for the next 3, and 5.5k for the rest; while causing the price to lower from 6k to 5.5k. Since there's way more BTC than this hypothetical person sold, it causes the market cap to lower much more than the amount of money they made.

And of course this too isn't static in the real world. Some people may sell when they see the price going down, some people may _buy_ when they see the price going down, and general unregulated chaos.

missblit··on Is watching the 1984 Ghostbusters movie killing people?
Well for one thing we don't have tens of thousands of years to wait for a natural ice age to counteract industrial warming that has happened within the past century or two.
missblit··on LLVM relicensing update and call for help
https://jakebinstein.com/blog/google-drive-remove-option-gra...

> The right-click menu option with the trash can symbol can’t be clicked, but dragging the file over to the trash can works just fine.

missblit··on FDA asks federal judge to wait until 2076 to fully release Covid vaccine data
They can distinguish it... at a rate of around 500 pages per month.
missblit··on Chrome may start restricting requests to private networks
> While the specification has some suggestions, I'm not sure that it would allow our specific situation even if we could get all of the people with web servers that are possibly affected by this to make changes to them.

Wouldn't this be as simple as an `Access-Control-Allow-Origin: *` (plus all the other junk mentioned in the opt-in section[1] of the draft spec).

I'm having a hard time of thinking what wouldn't be workable in the author's situation (assuming he gets all the people with webservers to add headers to them).

And yes... understanding CORS should absolutely be a requirement for writing local webservers that people can poke from the public internet; being able to stumble your way through writing a CORS policy is basic web security at this point.

[1] https://wicg.github.io/private-network-access/#example-opt-i...

missblit··on Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS
Yeah, and really the moral of the story shouldn't be (just) to get good at parsing, but to assume that any two parsers may disagree on how to parse a piece of data as part of your security model.
missblit··on Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS
Note that the spec is stricter for field-name than for field-value. Field names are ASCII, while field values are latin1 (or mime encoded but no one cares about mime encoding).

And yes I have seen bytes in both names and values in the wild (where bytes in names are invalid but need to be handled gracefully, while bytes in values are effectively valid latin1 if only for legacy reasons)

Looking at the bug you linked to, looks like this almost bit them too. Here's the final field-value behavior they landed on: https://go-review.googlesource.com/c/go/+/18375/

missblit··on Chromium: Permit blocking of view-source: with URLBlocklist
This kind of stuff can make sense when you consider "enterprise" environments like school labs.

Notice on the bug report that the reproduction steps include setting a "DeveloperToolsDisabled" registry entry. Curl / wget wouldn't always be accessible in this kind of locked down setup (and they're probably trying to make it difficult even if it's impossible to block completely).

← PreviousPage 3 of 9Next →