banthar · HackerTrans

Python context managers somewhat require it. You have to create an object on which you can call `__enter__`.

You can make globals thread safe by using thread locals. You can make methods using them reentrant by carefully saving and restoring state. What about exceptions? Any exception from `process()` is going to leave this global state in a total mess.

banthar

2 年前議論

100% agree with the AI on @cache decorator. It's a footgun and should never be recommended without a proper disclaimer. Unless it's a simple "single shoot" script, you really do not want the cache global like that.

banthar

3 年前議論

Zotero Flatpak comes with 4 year old Firefox binary and full access to your home directory.

The compromise currently being made here is your security.

banthar

3 年前議論

This is how all undefined behavior works. It seems to be working now but breaks with new CPU, GCC version or on wrong moon phase.

"-Wcast-align=strict" will work in this but not all cases - that's why we have UBSAN:

    $ gcc -fsanitize=undefined test.c
    $ ./a.out 
    test.c:6:6: runtime error: store to misaligned address 0x55e4007adeb1 for type 'int', which requires 4 byte alignment
    0x55e4007adeb1: note: pointer points here
     00 00 00  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  51 00 00 00 00

banthar

3 年前議論

You can pin your JVM process to a single core and will effectively get Python multithreading model.

banthar

5 年前議論

Defining string as a sequence of unicode codepoints is the mistake.

Nobody ever cares about unicode codepoints. You either want the number of bytes or the width of the string on screen.

UTF-32 codepoints waste space and give you neither.

banthar

5 年前議論

Object oriented programming is not about defining classes. It's about using objects. You don't have to define new classes to do OOP. Just use existing classes and objects polymorphically!

    url_layout.format()
    resp.raise_for_status()
    resp.json()
    session.add()

All those calls are dynamically dispatched - the essence of object oriented programming. This is what allows you to not worry about: * which string implementation `url_layout` uses * which HTTP protocol, encryption, authentication, chunking `resp` uses * what database is connected to `session`

You cannot avoid using objects - that's how all modern operating systems work.

Using classes without the need to call them polimorphically just as a nice namespace for methods is a separate issue.

banthar

6 年前議論

First issue mentioned: CVE-2019-6111 is an example of such attack.

banthar

6 年前議論

The problem with scp is that the trust also needs to go the other way. There is a lot of ways ssh server can trick the client into doing bad things on your local machine.

banthar

6 年前議論

Mocks have to be updated and fixed every time you do any meaningful changes in production code. Good fake can be reused in many tests and will keep behaving like a real thing with minimum maintenance. Much less complex than maintaining hundreds of mocks each implementing different parts of the interface.

banthar

6 年前議論

Extra bytes at end of file will be ignored by most formats. You generally don't want to depend on file length.

banthar

6 年前議論

There is nothing you can do with text file with unknown encoding but treat it as an array of bytes.

If you start guessing the encoding, at best it won't work in some cases, at worst you are introducing security vulnerabilities. You can try, but there is just no way to do it right.

http://michaelthelin.se/security/2014/06/08/web-security-cro...

banthar

7 年前議論

MPEG4 the video codec is https://en.wikipedia.org/wiki/MPEG-4_Part_2

mp4 the media container is https://en.wikipedia.org/wiki/MPEG-4_Part_14

MPEG-2 part 4 is some conformance testing specification.

banthar

7 年前議論

What kind of business is that? How are you funding it? 18000 euros is rather insignificant on business scale.

banthar

7 年前議論

> For example, under a proper UBI I’d quit my job and start a business. Under this time limited experiment I never would have.

What business would you start that takes more than 2 years to validate but takes basically no funding?

banthar

8 年前議論

Constant expressions are evaluated at compile time. Compilation would suffer any eventual performance penalties. This probably makes the compiler simpler - no need to implement different arithmetic for different types & no need to guess the types.

The dangerous bit is, that just extracting a variable from constant expressions might change the result slightly. That should not be a problem, unless you are depending on exact values.

banthar

8 年前議論

If you do SCTP in user space with UDP encapsulation, most of its benefits disappear (and you have to do that - also because of Windows).

It's standard only on paper. There is only one significant user space implementation (usrsctp). It's used both by Chrome and Firefox. I don't think it has much use outside of that. And, I don't think other browsers implement data channels (which require SCTP).

Browser implementations will probably never have to interact with kernel implementations (which are not really used outside of telecoms). There is really no reason to make them talk the same protocol. It's likely better to use two different protocols tuned to those specific uses:

https://tools.ietf.org/html/draft-joseph-quic-comparison-qui...

They will probably replace SCTP with QUIC also in WebRTC:

https://w3c.github.io/webrtc-quic/

banthar

9 年前議論

PEP-393 is a stupid compromise. They couldn't choose between UCS-2 and UCS-4, so they are using both. They are wasting tons of CPU cycles converting between them and single character outside of range doubles the size of string.

I don't fully understand the use case for extracting codepoints from strings, but they could have just added Java-like: codePoints and keep returning code units from old methods. This is CPU and memory efficient and 100% backwards compatible.

I think the problem is the same could have been done in Python 2 (with UTF-8) that would mean less reasons for Python 3.

banthar

9 年前議論

Even outside Web, you still have mostly-ASCII:

* filenames

* identifiers

* config files

* text protocols

* host names, email addresses

* embedded scripts (including SQL and OpenGL shaders)

* command line interfaces

* translations for languages using Latin alphabets

I don't think 2/3 size reduction for some languages will offset the cost in all the other places.

コメント