spookylukey

vor 3 Monatendiscuss

The project pyastgrep https://pyastgrep.readthedocs.io/en/latest/ can use CSS selectors as a query language for Python syntax (default is XPath).

e.g.:

pyastgrep --css 'Call > func > Name#main'

spookylukey

vor 6 Monatendiscuss

Please, please - just link to the actual "CUE" project. Not everyone has heard of your favourite thing. The first reference to `CUE` should be a hyperlink.

For other people: I'm pretty sure the author is talking about https://cuelang.org/

spookylukey

vor 3 Jahrendiscuss

https://lukeplant.me.uk/blog/

Over 200 posts, spanning nearly 20 years. Mostly on programming, Python, Web development, some personal and Christian stuff.

spookylukey

vor 3 Jahrendiscuss

I did a fairly detailed breakdown regarding the Python library Parsy: https://lukeplant.me.uk/blog/posts/python-type-hints-parsy-c...

This is not to make the general claim "Typing is a hindrance in parsing applications", or anything close. It's saying "the current static type system(s) available in Python would have made this Python library much worse".

spookylukey

vor 4 Jahrendiscuss

Just the other day I added a recent example to that page, from https://www.wsj.com/articles/internet-mangles-names-accents-... where it is obvious that databases are storing pre-escaped data.

This might be because of really old data and old code that saved it. But changing this decision is very hard, so I imagine many systems that adopted escape-on-input once are stuck with it.

spookylukey

vor 4 Jahrendiscuss

This is nice. With variable fonts, some of these fonts now are slightly under-represented - for example "Recursive" is really a large family, the website shows just one extreme point of a large multi-dimensional space.

I'm currently enjoying using the "Recursive Mono Semicasual" variant of Recursive - https://www.recursive.design/ . It adds just a little bit more fun that a typical mono font, especially at higher font sizes (e.g. for headings in Markdown in an editor).

spookylukey

vor 5 Jahrendiscuss

The default user model is fine, but I *always* start a project by extending it, for future-proofing. If you need to add to it, this is *so* much better than having to add a one-to-one, and at *some* point down the line you find you do want to add something. The problem is that doing it later when you need it is a pain, because of poor support by the migrations framework.

It's like 4 lines of code that saves you so much grief later on:

    from django.contrib.auth.models import AbstractUser
    class User(AbstractUser):
        pass

    AUTH_USER_MODEL = "myapp.User"

If you never need it, those 3 lines are not hurting you. In terms of a default, I think it probably would be nicer if Django pushed you to do this up front.

spookylukey

vor 5 Jahrendiscuss

I find it very strange to have claims about the database being tamper-evident etc without a clear description of the threat/trust model, and how/for whom it works. For example, what data does the client need to store to be sure no tampering has occurred?

spookylukey

vor 5 Jahrendiscuss

I think the case for server-side HTML rendering has never been stronger, and of all Django projects I work on, the ones I enjoy most are those that never got on the SPA bandwagon. From both a developer and user point of view I find them much faster and less painful. There are many cases where you really, really don't need the massive amount of extra complexity involved in designing APIs, adding JS frameworks etc.

When you need a bit of extra UI goodness, htmx https://htmx.org/ is a fantastic solution, and you can still use SPA-type approaches for things that need them.

You can also benefit from massively faster (and more reliable) functional testing when you are mostly standard HTML - see django-functest https://github.com/django-functest/django-functest/ for an example of this.

spookylukey

vor 6 Jahrendiscuss

I found Martin Fowler's "Technical Debt Quadrant" helpful on this - https://martinfowler.com/bliki/TechnicalDebtQuadrant.html . He argues you can have deliberate and inadvertent debt, both of which can be wise or unwise - the debt metaphor still works.

spookylukey

vor 7 Jahrendiscuss

Also, xmag, you already have it installed if you use the X Window System. It's 41kb, extremely lightweight (always starts instantly) and also magnifies a screen portion which is helpful for picking colours.

spookylukey

vor 7 Jahrendiscuss

Could you do the following in TypeScript?

Can you, for any button in your interface, at any point in time, reliably calculate at runtime what your page's data model would look like, and if there were going to be any side effects, if you were to click on that button - but without clicking on it or invoking its callbacks (which could potentially change all kinds of things)? You can do that with Elm (more info here - https://lukeplant.me.uk/blog/posts/two-experiences-with-elm/ ), due to The Elm Architecture and everything being immutable.

(In theory you could do this in TypeScript, but it would be a lot of work and its reliability would depend on everyone coding everything a certain, very unnatural way, with no help from the compiler).

I'm using Elm in production, version 0.18, it is an extremely robust way to make front end code. You just don't have runtime issues.

However, like IBM folks (mentioned in another reply) who said in the their post they didn't know how they would upgrade to 0.19, I also don't know how I will be able to upgrade. Specifically, 0.19 adds some cripple-ware restrictions (you can't use native modules unless you are contributing to certain projects). So, if you want to use something like Intl - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... - not only is there no wrapper provided, the restrictions in 0.19 attempt to stop you from writing your own wrapper. Only the core team can do it, which requires them having both the expertise and motivation to do so. Plus Elm has essentially a closed-source development process. In fact, there is no 'process' for contributing, and the fact that there is no process is deliberate, as far as I can tell.

So for me, if I can't find a way around the restrictions, they may kill my ability to being able to keep my code nicely architectured (i.e. using The Elm Architecture). I may be forced to switch to something like ReasonML with bucklescript-tea - https://github.com/OvermindDL1/bucklescript-tea

spookylukey

vor 8 Jahrendiscuss

"real money from real people's savings accounts" is not how it works. See this book - https://www.amazon.co.uk/Where-Does-Money-Come-Monetary/dp/1...

Banks do indeed make money "from nothing". If you get a loan of $1000 from a bank, they just add $1000 to your current account, and write down in another account that you owe them $1000. They don't have to "get" this money from somewhere.

This is all as it should be. Say I can make tables, and you want one, but don't have anything to give me in exchange. We can agree that you now owe me $100, say. You can write me an IOU and sign it. Suppose you are trustworthy enough that an IOU from you is considered acceptable as payment. I can now use your IOU as money - we have just "created" $100 money from nowhere (or, $100 debt, same thing).

spookylukey

vor 8 Jahrendiscuss

There is no value in it because it is a false promise. If you give someone access to data, you have lost control over it, especially if it is by email - because not everyone uses Gmail. Many of those who do do not use the web client, and email clients are ultimately controlled by end users, even web based ones.

Only if you have complete end-to-end control over all the devices that everyone uses, including their brain, can you stop people from copying data.

If I have a file that I want to limit access to, I would never dream of sending it via e-mail. Some hosted document service which only shows parts of the file would be far preferable.

spookylukey

vor 9 Jahrendiscuss

> There is some innate affinity for computer programming which you must be born with, and cannot be taught.

This being a falsehood is a matter of considerable debate, and it's impossible to prove (There are certainly some people with very low ability for computer programming, to the point of effectively useless. How would you prove this was entirely nurture and not nature?). This is a not a good candidate for a "list of falsehoods" article.

spookylukey

vor 9 Jahrendiscuss

This is not the case - with Django's ORM you are still susceptible to the N+1 problem. It can be largely mitigated through `select_related` and `prefetch_related`, but the fundamental issue is there - that simply by accessing an attribute for an object that wasn't already fetched, you can do another database query without it being at all clear in the code that this will happen.

spookylukey

vor 10 Jahrendiscuss

That's really helpful. Can you make an example which doesn't require making the my_handler function 'async'? For cases when you don't want to make an entire async stack, you just want to slot some async code into your existing code.

If the answer is "to get some async goodness, just use this easy code, plus rewrite your entire project to use a different framework and set of libraries", then we are only fooling ourselves.

spookylukey

vor 10 Jahrendiscuss

It's a bug: https://bugzilla.mozilla.org/show_bug.cgi?id=307089

Or, it's a memory saving feature. To implement "View source from cache" requires keeping around the raw page HTML, which you might not otherwise need after parsing - except you probably will for all the developer tools to work, so this probably should just be considered bug.

spookylukey

vor 10 Jahrendiscuss

Yeah, the video made me want to go outside and run, not take my mobile with me, and certainly not stay in and tap a screen.

spookylukey

vor 10 Jahrendiscuss

The current spec has a serious flaw for CSRF prevention - it doesn't include the protocol in the definition of site, only the domain. This allows a MITM'd http page to CSRF a https site. This same flaw is in cookies themselves - a cookie set over https is used for http requests.

spookylukey

Submissions

The very minimum you need to know about words

Facebook doing MITM attack on your email.

comments