onetwotree

> There's nothing wrong with running E-Commerce on Wordpress also, as long as your payment solution does not include storing sensitive data such as credit card numbers in the database.

This is just not true. Suppose I get write access to the content your Wordpress site is serving. Now I can replace, say, the Stripe (or any other managed payment solution) JS and HTML with my own, to save the CC info and forward the unmodified request to Stripe. Game over.

> I don't recommend doing ecommerce...or anything that could gather sensitive information

The problem with this kind of thinking is that if I can get remote code execution, or even just content control over your no-ecommerce-or-sensitive-information blog, I can have a great time. Sure, it's not as valuable as CC info, but the potential for malware distribution, credential phishing (password reuse for the win!), various kinds of social engineering, or even just as an anonymizing host to hide illegal activity, is still huge.

So, a reasonable question to ask is what can I recommend to non-technical people when they need a website quickly and inexpensively that won't make me feel like I'm setting them up to get owned?

Also what advice should I give to WordPress users to help them improve security, other than the rather useless and bratty "don't use wordpress lol" answer? I'm a security professional and I follow the constant stream of "lol WordPress exploit" articles, but proactive security measures for WordPress are a bit outside my usual enterprise infrastructure work.

Putting even a very short lived cache in front of it basically removes the issue. But perhaps asking people to understand, for example, nginx micro-caching, defeats the purpose of WP.

I'm not terribly concerned about WP performance, it's just a blog, after all - it's the security issues.

What's interesting about dealers (at least the very low level ones that addicts typically buy directly from) is that they're often selling dope to support their own habits or to get ahead in a world they see as being stacked against them.

Thus, many of these people are not ruthless sociopaths, and recognize on some level that what they're doing is wrong. Through a great deal of rationalization, they are often able to convince themselves that it's morally OK.

These people would prefer not to have to bring murder into line with their already quite dissonant mental schema.

This is my experience talking to current and former dealers, mostly as part of my work with recovering addicts - I've had dealers help me track down relapsed sponsees, for instance, with very little convincing.

When the article is less sensationalist, HN often expresses an interest in stories about drug addiction.

I can see a couple of reasons for this.

First, there seems to be a prevailing view here is that the war on drugs is an abject failure.

Furthermore, I believe addiction gets attention here as a fascinating scientific puzzle, whose questions and answers are deeply involved with philosophical issues such as free will and the nature of desire.

This is probably why the article made it as far up as it did on HN.

True - although one often prefers the OD not be fatal.

The mention of Fentanyl here is pure clickbait. Fentanyl is pretty well known amongst opiate addicts (and has been for a while). Everyone knows it's dangerous, including dealers, who like to avoid killing their customers and catching murder charges, believe it or not.

Aside from that and a bit of gateway drug BS towards the beginning, this is a solid and somewhat moving, if long, account of the standard Heroin story, and is more or less the same as the ones I hear from fellow recovering addicts all the time.

Key features, so you can avoid the longread:

* Insurance refusing to pay for treatment

* Parents being forced to get their kids arrested to protect them (and the plan failing)

* Relapse, relapse, and more relapse despite full knowledge of the consequences and a strong desire not to relapse.

* Terror of being dope sick

* Doing stuff you don't want to do to avoid being dope sick

* Death

It's possible that he refers to a cache miss "going out to disk" by requiring a read from a different data store (a SQL database, for example).

But this is really kind of silly - the entire idea with caching is that misses are much slower than hits. The statement is something like "you need a stupid good cache because misses hurt". Software engineering is always about tradeoffs, and antirez does a fantastic job of describing them in this post.

Great post. Antirez delivers once again!

I think this is an excellent read for anyone who wants to gain some insight into coming up with pragmatic, real world solutions to problems (caching) that are usually taught in a very formal, "use this bestest algorithm or you're a dummy" kind of way.

Also the tricks used here are beyond clever.

> money launder your bias

I like this phrase. I'm stealing it :-)

This stuff has been in use in the probation and parole system for decades now.

Whether it's a "sophisticated" algorithm or a sheet where a parole officer writes down numbers and adds them up, there's this constant idea that it can be used to determine how likely an individual is to re-offend.

Rejecting the use of such a system would call into question the methodology used in deciding whether or not to revoke someone's parole/probation - this is incredibly significant, because, to take the example of Wisconsin, over half of the state prison inmates are in on revocation.

I'm just saying this by way of presenting an alternative idea of why the court might have rejected the appeal. It's also important to note that in Wisconsin we have a very conservative supreme court.

I find that the more I learn about the criminal justice system, the more shocked I am that we allow it to continue. It's not a law and order vs. wishy-washy liberalism thing - our criminal justice system demonstrably increases recidivism.

I'm not really advocating a simplistic reading of Russia's history. There are broad themes that are very important to understanding it, and these are generally constant. Among them is the tension between looking inward and outward, which does, as you mention, swing back and forth over time.

Another important theme is, of course, that the Enlightenment never made it out of the Hermitage.

It goes back and forth. There's a constant tension in Russia's history between the West and "East", used in this context to mean an essentially anti-western turn.

Really interesting read there too. Thanks :-)

This is still relevant today. As Kennan points out, Marxism was a mere "moral fig leaf" covering the nakedness of "insecure nationalism".

The fig leaf seems to have been replaced in the era of Putin by a sort of generalized disdain for the west, and for western ideas like democracy and liberalism (in the sense of the word used in Europe, not the US).

But nothing ever really changes for the Russian state. Putin's Russia can be described and understood in the same terms as Soviet Russia and Czarist Russia before it.

I'll end by pointing out, again, as Kennan does, that I'm referring to the Russian state, rather than its long suffering people, who are some of the most warm hearted and genuine folks I've ever met.

I'm much happier for being in possession of the technologies of human experience that the humanities gave me.

I think for people with good rational abilities it's tempting to think that we can logic our way through all of our internal (meaning, emotion, relationships) problems the way we can with external (business, financial, engineering) problems. It doesn't work, and the tools provided by both the humanities and spiritual traditions[1] do work, marvelously.

[1] When approached pragmatically, rather than dogmatically. Dogmatically religious people seem to suffer from as much or more angst than anyone.

So...sounds like a hellhole? That might be the point of your comment...sarcasm is hard on the interwebs.

I think OPs point is that while they might have treated OP like gold, he couldn't conscious taking part in the horrifying things they do to their own people, to say nothing of migrant workers (taking passports as a means of control).

Don't authenticate to servers with a password. Ever. Use public key authentication.

What's wrong with good old fashioned pam modules to put users in sudo/non-sudo groups?

Er, 12 or 13 to go, depending on whether you count the one ring.

You probably forgot the elves. If I had a nickle for every time I forgot the godamn elves...

TIL if you want to get a bomb onto a plane, declare a gun!

I'm kidding, of course. There are probably multiple reasons that wouldn't work. But this whole notion that by molesting passengers sufficiently and putting on a big enough show, we can significantly reduce casualties from terrorism is laughable.

At some point there has to be a tradeoff between safety and convenience, or no one in their right mind would drive a car.

Also, SciHub exists.

I think the data were taken among Americans (they included Native Americans). You're right though, and looking at data from other countries with stronger gun restrictions would be an interesting way to check this hypothesis.

A mistake and an insight.

The idea that white men have the highest suicide rate is misleading - they have the highest rate of success, which is very likely because they are the most likely to own guns, which are far and away the most effective and effortless way to commit suicide. Effortlessness is important, because depression makes planning so difficult. FWIW I'd really appreciate it if we could not turn this into a debate about gun control.

The insight, of course, is that Elliot Smith didn't have a drug problem, he was looking for a drug solution. This is an incredibly accurate description of addiction. The saying in AA is "If alcohol didn't do anything for me, I'd never have let it do anything to me". Drugs and alcohol are a solution to the underlying problem, one in which we simply can't feel ok the way others can. Of course, they are a solution with horrible side effects, and one that eventually stops working. Many members of AA describe getting sober because the drugs and alcohol weren't working anymore, only to become suicidal and realize that the drugs and alcohol were only symptoms of a much deeper problem.

I haven't played since early WotLK, so I'm not too familiar with the latest in WoW tech :-)

Thanks for this. I really feel like I understand the algorithm, and more importantly, the tradeoffs involved, after reading that.

My company makes a product that involves a sort of primary feature that's insanely read heavy (something like 10k to 1 read to write ratio), and a secondary feature that's exactly the opposite. We just use Postgres with for both (and it's obviously the winner for the read heavy workload) but I think I'll have to look more into this stuff.

One interesting thing to note about our write heavy workload is that the reads are usually in chronological order, with a filter. Anyone know what that implies for LSM based stores?

The `/run` command is pretty essential for debugging mods. I think that it'd be a wise idea to disable it by default, and allow an advanced user to change a setting in a file to turn it back on.

Sort of. Blizzard goes to great lengths to keep players from running "bots". For example, a bot might allow a player to run an account 24/7 that would just kill a specific monster over and over until a certain rare and valuable item dropped. This isn't possible, because certain actions (such as "Attack the monster") can only be taken in a script that is running in response to a UI event. This isn't a security fix though, just a way to prevent players from gaining an unfair advantage by running bots.

On the other hand, I did write a handy few handy little addons despite this restriction. For example, when you're doing lots of wheeling and dealing at the auction house (a perfectly legitimate way to make in game money), you tend to receive a huge amount of "mail". When another player buys an item you're selling, you receive the payment via your mailbox. It can be tedious to go through all the messages and take the money or items (mostly a UX issue if you ask me). To get around this, I just added a "take all AH stuff" button to the mailbox UI. There were a few problems, in particular that you'd have to "pump" it, because moving to the "next page" of mailbox items was an asynchronous operation, and the callback wouldn't be able to do the "take item" action.

Users contribute huge numbers of useful addons despite this restriction - for example, auction house addons can remember price data and show you items that are substantially above or below their general market value. The famous "Carbonite" addon made gigantic improvements to the in-game map, most of which were later incorporated into the default interface. And no serious raider would go into battle without a host of combat helpers, DPS meters, and so forth.

I don't have experience with Sequel and rails 5 specifically. The thing is, models are really not very coupled to rails. We don't have to do anything special to use Sequel models - it has good support for Rails migrations and everything.

Regarding authentication, my company makes authorization and access control software, so authentication isn't something we just toss a plugin at.

Good work!

On some work projects I've gotten a lot of mileage out of breaking with the traditional Rails patterns in favor of stuff like `Operation` objects. Too bad I didn't know about Trailblazer!

I also agree about Rails making excessive use of Ruby magic. Just because it's possible, doesn't mean you should do it.

Regarding non-ActiveRecord models, I use Sequel[1] exclusively at work - in addition to being decidedly less magical, it has wonderful support for most Postgresql specific features.

I'll be consulting this in the future before embarking on new Ruby adventures.

[1] http://sequel.jeremyevans.net/