I’m for ending the war through a unilateral surrender of Russian forces and the trial of Mr Putin for crimes against humanity. However, my opinion doesn’t have a lot of influence over whether that happens.

Similarly, I’m for ending the war in Gaza through the voluntary disarmament of Hamas, the repudiation of terrorism as a way of life, the handover of illegal settlements to displaced Palestinian Arab civilians, and the prosecution of Netanyahu for treason and war crimes. But I don’t expect to get to make that decision either.

If you’re looking for commercial games on Linux, Steam has pretty much solved this with the “Steam Play” compatibility feature, which uses a customized version of WINE to run Windows games. For example, Baldur’s Gate 3 runs perfectly. It should work anywhere Steam does.

https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign

Here’s the actual security advisory, which contains much more information than the fluff article about it.

Ubuntu on Desktop I can understand.

Not anymore. A whole extra, unneeded, proprietary, locked-in package system. Ads in the default install.

There’s Mint, Pop!, and plenty of other options that actually respect the user.

People pay for this?

Cutting someone’s brake lines has been a means of assassination for a while. What’s new here is that it could potentially be done remotely, e.g. an attacker in Bucharest targeting a victim in Seattle on behalf of a payer in Moscow.

Other way around. Unsupervised OTA updates are dangerous.

First: A car is a piece of safety-critical equipment. It has a skilled operator who has familiarized themselves with its operation. Any change to its operation, without the operator being aware that a change was made, puts the operator and other people at risk. If the operator takes the car into the shop for a documented recall, they know that something is being changed. An unsupervised OTA update can (and will) alter the behavior of safety-critical equipment without the operator’s knowledge.

Second: Any facility for OTA updates is an attack vector. If a car can receive OTA updates from the manufacturer, then it can receive harmful OTA updates from an attacker who has compromised the car’s update mechanism or the manufacturer. Because the car is safety-critical equipment — unlike your phone, it can kill people — it is unreasonable to expose it to these attacks.

Driving is literally the most deadly thing that most people do every day. It is unreasonable to make driving even more dangerous by allowing car manufacturers — or attackers — to change the behavior of cars without the operator being fully aware that a change is being made.

This is not a matter of “it’s my property, you need my consent” that can be whitewashed with a contract provision. This is a matter of life safety.

Remember SOAP? Remember XML-RPC? Remember CORBA?

Those were not very good.

This has been going on for over 25 years now.

The kind of people who go into business building censorship software turn out to quite often be the kind of people who think feminism is a hate group, atheism is a cult, birth control is a dangerous drug, evolutionary biology is political extremism, and therapists are child-molesters. As such, it is unsurprising that this software’s behavior has quite often reflected those views.

I’m confused. To me, “building a tree” and “parsing” are the same thing. If you end up with a tree representation of the structure of your document, the thing you did to get there is parsing.

If you can’t tar to a pipe into ssh to a remote host and untar into an arbitrary location there, are you really using Unix?

I’m reminded of the character names that show up in MIT CS textbooks, like Alyssa P. Hacker (“a Lisp hacker”) and Eva Lu Ator.

Rust does memory-safety in the most manual way possible, by requiring the programmer prove to the compiler that the code is memory-safe. This allows memory-safety with no runtime overhead, but makes the language comparatively difficult to learn and use.

Garbage-collected compiled languages — including Java, Go, Kotlin, Haskell, or Common Lisp — can provide memory-safety while putting the extra work on the runtime rather than on the programmer. This can impose a small performance penalty but typically makes for a language that’s much easier on the programmer.

And, of course, in many cases the raw performance of a native-code compiled language is not necessary, and a bytecode interpreter like Python is just fine.

If you threaten violence to people for calling you a fascist … you might be a fascist.

The best code editor is the one that works well with your other tools, including your compiler and your keyboard.

Corollary: If you use an unusual compiler or an unusual keyboard, this may change what the best editor for you is.

Some other ways:

Cultivate bitterness.

Find the pessimists in your organization, and disappoint them.

Make mean cynicism a part of your workplace culture. Do this by example: Promote mean cynics and put them in charge of things. But do it also by conversion: Behave in a way that makes mean cynics’ view of the world correct.

Reward bad personal habits to create internal conflicts between work and health.

If someone skips sleep to finish a project, give them a bonus. This gives them an internal conflict between approval and health, and teaches them that they can sacrifice their health to receive a reward.

Encourage a hard-drinking culture in teams that have stressful roles that demand team cohesion, like SRE or Ops teams with on-call requirements. This gives them an internal conflict between their support network and health.

If someone is sick, injured, bereaved, or otherwise suffering: Make it clear how much their condition is inconvenient to their coworkers, and how much their projects are impacted by their absence. Assure them that all will be well once they can conclude their personal problems and commit to the team. Do not, however, offer them any specific help; if they express specific needs for accommodation, disregard them as idle and unrealistic wishes.

If DNS is transiently down, the most common mail domains are still in local resolver cache. And if you’re parsing live user requests, that means the IP network itself is not in transient failure at the moment. So it takes a pretty narrow kind of failure to trigger a problem… And the outcome is the app tells the user to recheck their email address, they do, and they retry and it works.

If DNS is having a worse problem, it’s probably down for your mail server too, which means an email would at least sit in the outbound mail spool for a bit until DNS comes back. Meanwhile the user is wondering where their confirmation email is, because people expect email delivery in seconds these days.

So yeah … yay, tradeoffs!

(Confirmation emails are still important for closed-loop opt-in, to make sure the user isn’t signing someone else up for your marketing department’s spam, though.)

The only way to correctly validate an email address is to send a message to it, and verify that it arrived.

If you’re accepting email addresses as user input (e.g. from a web form), it might be nice to check that what’s to the right of the rightmost @ sign is a domain name with an MX or A record. That way, if a user enters a typo’d address, you have some chance of telling them that instead of handing an email to user#example.net or user@gmailc.om to your MTA.

But the validity of the local-part (left of the rightmost @) is up to the receiving server.

If someone sells something to you and then takes it back later, that is theft.

Any time you’re turning a string of input into something else, what you are doing is parsing.

Even if the word “parser” never appears in your code, the act of interpreting a string as structured data is parsing, and the code that does parsing is a parser.

Programmers write parsers quite a lot, and many of the parsers they write are ad-hoc, ill-specified, bug-ridden, and can’t tell you why your input didn’t parse right.

Writing a parser without realizing you’re writing a parser, usually leads to writing a bad parser. Bad parsers do things like accepting malformed input that causes security holes. When bad parsers do reject malformed input, they rarely emit useful error messages about why it’s malformed. Bad parsers are often written using regex and duct tape.

Try not to write bad parsers. If you need to parse something, consider writing a grammar and using a parser library. (If you’re very ambitious, try a parser combinator library.) But at least try to recall something about parsers you learned once way back in a CS class, before throwing regex at the problem and calling it a day.

(And now the word “parser” no longer makes sense, because of semantic satiation.)

By the way, please don’t write regex to try to validate email addresses. Seriously. There are libraries for that; some of them are even good. When people write their own regex to match email addresses, they do things like forget that the hyphen is a valid character in domain names.