zwp

> Perhaps the crack in "B" is supposed to mean something.

B was the _flawed_ predecessor to C. Wikipedia alleges a lack of types was the main issue that consequently drove C's invention.

https://en.wikipedia.org/wiki/B_(programming_language)

Thanks for your great contributions in this thread.

Can you please help me understand "rock is super messy"? The traditional narrative is "rock was mostly derived from blues (+ some other influences)" but the counter(?)example you provided is a classic 12 bar blues.

Do you have some messier examples? Or did I miss your point?

I agree. The article even says that these odd formats are used to bypass filters but cannot pinpoint why BSD 4.2 added support for them in 1983.

It hints that certificate validation fails in some cases, but that seems even more niche. What applications are using certs with IP-in-CN anyway in 2021? Shouldn't any IPs be in the "typed" SAN extension?

Commit is here: https://github.com/curl/curl/commit/56a037cc0ad1b2a770d0c08d...

> style and methods run parallel but never quite meet

Or as if they were on the same tracks but on... different trains?

Glass generates a rhythmic tension that is similar to Reich's loops moving in and out of phase by changing the time signature feel (eg duplets vs. triplets). These are not the same mechanisms but for me both generate a curious shifting feeling where suddenly I'm listening to the "wrong" line. With Glass, I'm now also feeling the "wrong" beat! The effect from Reich's loop asynchrony is more gradual, transformational, just as surprising (perhaps even more so) but they are definitely different animals.

Yes, that's essentially what I was trying to communicate.

Since we are engine agnostic here be careful interpreting ^ or $ as start/end of _string_ though. In some regex engines this means start/end of _line_. If that's the case and if a regex validates input up to $ an attacker might be able to sneak in extra data after a newline. In Python you'd need multiline enabled but Ruby matches by default:

  irb(main):001:0> /^okay$/ =~ "okay\noops"
  => 0  # matches from position 0

(Ruby has \A and \Z for start and end of string to address this).

Great list. I would add

- Anchor when possible (^, $)

The second graph links to datawrapper.de. The shades of blue appear to be the default palette in that application. It wasn't a stylistic choice "blue because fish".

I tried one of datawrapper's sample data sets, "Gender pay gap" and added a couple of extra columns. The resulting line graph has four shades of blue.

https://datawrapper.dwcdn.net/g98Jd/1/

(There are "base color" and "customize colors" buttons so the author could have changed this. Seems like a nice little app).

If you're on a non-touchscreen device then there is a hover-over pop-up with the fish name and tonnage caught.

That still doesn't cut it: there are 18 fish in the graph key but at first glance the graph has around half that number. The others can be seen if you zoom right in but it's still not easy to hover over the pixel-wide slivers of similar blue.

That said I don't think the tonnage details are the point of this graph but rather a more general message: "Tuna fishing increased 6-fold over 65 years, skipjack makes up most of the increase". I think it communicates this message well. Perhaps more "infographic" than "graph"?

Yeah, you got it, see my reply to capableweb. Thanks!

Thanks, I had also looked for a definition. Instances of Method fulfill both of the cited criteria -- example in this thread, above. Also: Method != Proc, but the article's comments help.

I, aha, notice this:

    $ irb
    2.3.3 :001 > Kernel.method(:puts).object_id
     => 47165335040720 
    2.3.3 :002 > Kernel.method(:puts).object_id
     => 47165334993360 # not the same!
    2.3.3 :003 > 

That is: #method doesn't return the Kernel.puts method, it returns a new Kernel.puts Method instance on each invocation. So the returned object from Kernel#method isn't the "real" (first-class) method object.

I feel like I'm a lot closer but I'd still like a better definition :)

So the functionality is equivalent, but ruby's syntax is slightly longer. Is there something other than ruby's slightly longer syntax that you find lacking?

Ruby's Method class matches the design "everything is an object" (strings, numbers, modules & classes themselves...). Are regular expressions first class in ruby? There is top-level syntactic sugar for REs (/.../) but REs are just instances of `Regexp`. It's just syntax. I don't think you can argue Python REs are first class: I have to drag in `re` and then `re.compile()` a string (and my editor won't know to syntax highlight metachars or interpolation). I use REs more often than method references in either language...

But I'm not trying to "whataboutwhataboutwhatabout" here. I'm trying to say there's a difference of philosophy. Ruby Methods are just more objects (Method<Object). They aren't some sort of blessed type, just like everything else. Everything descends from Object. Kernel is just a module. Method is just a class. And so on. In that context, what does it mean to be "first class"? Objects are first class and methods are objects. QED. No?

(FWIW I agree on ruby's optional parens, too much inconsistency for a few less lit pixels on the screen).

What are the restrictions on passing around a ruby `Method` object?

(Please see my sibling comment for example).

Maybe I misunderstand your use of the word "function" here, but in addition to Proc/lambda you can certainly reference a method, pass that around, return it, call it?

See:

  * https://ruby-doc.org/core-2.7.1/Method.html
  * https://ruby-doc.org/core-2.7.1/Object.html#method-i-method

    $ irb
    2.3.3 :001 > p = Kernel.method(:puts)
     => #<Method: Kernel.puts> 
    2.3.3 :002 > p.call "Hello"
    Hello
     => nil 
    2.3.3 :003 > def run_a_method(meth, *args)
    2.3.3 :004?>   meth.call(*args)
    2.3.3 :005?> end
     => :run_a_method 
    2.3.3 :006 > run_a_method(p, "Hi!")
    Hi!
     => nil 
    2.3.3 :007 > 

ps. this also works with the "to_proc" operator (&) so you can do this:

    [1, 2, 3].each(&Kernel.method(:puts))

(but I wouldn't necessarily recommend this since it's not very readable, at least to my eyes).

Afghanistan? Air force? Uh, as fuck? Really?

I'm not prudish about words but .lol would've been clearer.

You've dismissed (or are perhaps not aware of) a substantial chunk of winter climbing with this analysis: so-called "water ice" (as opposed to "alpine ice") climbing. Waterfalls.

Approaches for winter day climbs involve skiing or snowshoeing. The calculus of avalanche risk is part of the game for climbers too else, as you put it, we'd also be limited to some pretty boring climbing.

> original definition of "hacking" was "hacking code together"

Hmm. Right spirit but not so much "hacking code together" going on at MIT's Tech Model Railroad Club in 1958.

"a project undertaken or a product built not solely to fulfill some constructive goal but with some wild pleasure taken in mere involvement, was called a `hack'".

(Steven Levy, "Hackers").

The schematic wasn't in the C64 User Guide delivered with the machine, but it was in an additional Commodore publication "Commodore 64 Programmer's Reference Guide". The PRG was essential if you wanted to do anything more than the most basic BASIC contained in the UG.

See p.514- for the schematic https://archive.org/details/c64-programmer-ref/page/n513/mod...

Washington Post attributed the attack to Russian actor APT29/Cozy Bear on Dec 14th [1], quoting unnamed sources.

FireEye [2] Dec 13th & Volexity [3] Dec 14th were more cautious, citing an unknown actor that they dubbed UNC2452, and Dark Halo, respectively.

Recorded Future made a fair but ultimately inconclusive case for Chinese attribution [4], Dec 30th.

US gov/CISA continues to claim "Russian linked" [5], Jan 5th.

Kaspersky reported a link to the Kazuar malware used by Russian actor Turla [6], Jan 11th.

CrowdStrike's report on the malware injector [7], Jan 11th says "does not attribute the SUNSPOT implant, SUNBURST backdoor or TEARDROP post-exploitation tool to any known adversary".

[1] https://www.washingtonpost.com/national-security/russian-gov...

[2] https://www.fireeye.com/blog/threat-research/2020/12/evasive...

[3] https://www.volexity.com/blog/2020/12/14/dark-halo-leverages...

[4] https://www.recordedfuture.com/solarwinds-attribution/

[5] https://www.cisa.gov/news/2021/01/05/joint-statement-federal...

[6] https://securelist.com/sunburst-backdoor-kazuar/99981/

[7] https://www.crowdstrike.com/blog/sunspot-malware-technical-a...

I agree. The risk from this intrusion is not a whole lot different (and considerably more overt) than from the access that any number of other people have had to this building in the past. (Tour guides, visiting civilians, contractors, cleaners, ...).

Professional attackers were not waiting to follow a Jamiroquai knock-off around during an event whose CCTV footage will be heavily scrutinized.

(See for example (50 years ago) https://www.nytimes.com/1988/11/15/world/the-bugged-embassy-...).

This may be a good incentive to review policies such as full disk encryption and proximity-card workstation lock/unlock but pulling miles of CAT-6 from this building is not a sensible response: defenses _should_ already account for this sort of threat. If purple team has not already "what if"'ed this particular variant of the evil maid problem then that's a serious issue but clearly weak physical security was already a known feature of the threat model.

Perhaps it is a scam?

Ha, that's funny, I abandonned lilypond precisely to create combined stave/tab scores more easily. I found that flipping back and forth between the lilypond "source" and the rendered result was too slow. I read music notation much better than lilypond's "musical LaTex" notation and I found it hard to remember the nuances each time I came back to it. (Adding lyrics to an existing piece was the last straw).

I switched to Musecore. Although I generally eschew GUI apps I much prefer it to LP: I can see my editing changes directly without the "compile, run" steps. My efforts are less DRY, to continue the programming metaphor (eg copy/paste the chorus) but that's acceptable. I don't plan on writing any massive symphonies. As @rekado elsewhere on this page, I don't have to act-as-programmer when I'm making music.

Musecore has had lots of criticism of its design but that area has apparently improved a lot recently. It might be "Word for music" but it's a mostly-complete-but-simple version (so... Word 6? AbiWord?). Works for me.

I have a vague recollection of feature parity with Mercurial's shelves but I don't remember which came first. They look very similar: https://www.mercurial-scm.org/wiki/ShelveExtension

Perhaps a Mercurial user can say if shelves are more useful? (And if so, why?).

It was fixed in 2012. The debian bug report (2009) cites numerous users that fell into the trap before the fix.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=558044

    commit 1af18c260a87dc38f0e33bfeb6de6163f91be4ad
    Author: Sami Kerola <kerolasa@iki.fi>
    Date:   Sat Feb 11 20:33:17 2012 +0100

        pkill: remove -v match inversion option
    
        The option -v does not make much sense in pkill context.

Can an attacker use a formatting change to alter the sense of a document? Eg. make the text color the same as the background color or invisibly small?

Query params often end in stuff like web server (WAF, load-balancer, reverse proxy, ...) access logs and they might get accidentally exposed.

They shouldn't get exposed of course, but they do. [EDIT: redacted an example of some random dude's access log]

If you search for "password" in there you will likely see a new Mirai bot variant [1] bouncing credentials off the server looking for weblogin.cgi on vulnerable Zyxel devices.

I imagine PA highlit this detail in their post ("weblogin.cgi accepts both HTTP GET and POST") exactly to ensure sure defenders don't restrict themselves to blocking or investigating only the more normal POST mechanism.

[1] https://unit42.paloaltonetworks.com/new-mirai-variant-mukash...

Oh my. Barely the price of two drop pedals, has great reviews, and I can even pretend it's for the kid! Maybe I will become a bass player after all.

That would definitely work (and we could also use it in "Cobain emulation mode"!). Thanks for the tip.

Great article, I wish I'd seen the mid-project posting to HN. I was skeptical about the Alexa integration but that seems to work well.

> ludicrously difficult to set up. Laptop + low-latency Linux + Ardour + QLC+...

This resonates [sorry] with me. Linux sound today seems painfully reminiscent of Linux X-Windows 20 years ago. There's a lot of painful voodoo, competing control systems and legions of mostly out-dated forum threads of dead-ends, anecdotal advice, misinformation. I'm hoping that the next Ubuntu Studio will Just Work on the laptop that I have put aside for it and that I won't have to waste more time in the Pulse/Alsa/Jack soup.

I was aware of Guitarix but have not yet played with it. My youngest is learning electric and we've got to the point where we can play together, with me pounding out the bass line on an old classical we had lying around(!). That is a blast but I wasn't really intending to become a bassist. If I were to pick up an electric guitar to fool around on, can Guitarix drop me down an octave and make me a pretend bass player? (I had a quick poke around the Guitarix wiki, couldn't see anything). There must be DAW processing plugins to do this, but I'd really like to be live. Are there other solutions? (apart from buying more instruments I mean...).

Oh, and I love this:

> So I bought a 3D printer and became a CAD guy, I guess

"I had a hard problem to solve... so I... casually nuked it" :)

This is a good question. I found a copy of Fujitsu COBOL 85 manual [1] (the next release was post y2k, in 2002) and was surprised to see that CURRENT-DATE, INTEGER-OF-DATE use 4-digit years.

However some functions from that time (eg ACCEPT, p. 544) do use 2-digit years. I think you have it exactly right, it was about facilitating string formatting/display: ACCEPT took input from the terminal screen. (I think it is, approximately, gets() + strptime(), though I don't see any talk of error handling). Programmers probably just stuffed the result into a record before writing to DASD (disk), optimizing for programmer time and program complexity over storage.

Perhaps 2-digit years for ACCEPT were an optimization for data entry workers?

A modern z/OS COBOL guide [2] has 4-digit years throughout as far as I can see.

Whilst I'm here, I'm also going to say: "VSAM", "PDS", TSO", "LRECL" and "ABEND" (just because I haven't heard those words for a quarter century and now I'm feeling nostalgic).

[1] http://testa.roberta.free.fr/My%20Books/Mainframe/Fujitsu%20...

[2] https://www.ibm.com/support/knowledgecenter/SS6SG3_4.2.0/com...

I saw this in Perl a long time ago but it could just as easily have happened in Python. The dict (Perl hash) was a set of mappings for template replacement of "from" strings to "to" strings.

    "FOO" => "bar" # Replace FOO with bar

The author had considered the case where one key (FOO) might be a left-substring of another (FOOBAR), and so reversed the output from keys() before iterating over the hash. This ensured that FOOBAR, which sorts later, would be substituted before FOO (else FOOBAR -> barBAR, oops).

Unfortunately, despite empirical evidence to the contrary at the time, keys() does not guarantee sort-order results https://perldoc.perl.org/functions/keys.html

This worked for a while (appeared to work?) and but was subsequently caught by another developer, who added a sort().

(Get a templating library alreay yeesh).

Incidentally Ruby made the transition to sorted Hash some years ago (1.9 maybe?) and I don't remember any great fall-out.