301–310 of 387 posts
One of these days we're going to learn our lesson and just write our own damned code.
One of these days we're going to learn our lesson and just write our own damned code.
Then you get to write 10x the vulnerabilities yourself and not have nearly the same chance of any of them getting disclosed to you!
Earlier quoted context omitted.
Real solution? We’re in a complexity crisis and almost no one sees it. It’s not just software dependencies of course. It’s everything almost everywhere. No joke, the Amish have a point. They were just a few hundred years too early.
> Real solution? I don't think there's any. Too many luminaries are going to defend the fact that we can have things like "poo emojis" in domain names. They don't care about the myriad of homograph/homoglyph attacks made possible by such an idiotic decision. But they've got their shiny poo, so at least they're happy idiots. It's a lost cause.
There is nothing idiotic about the decision to allow billions of people with non-latin scripts to have domain names in their actual language.
What's idiotic is to consider visual inspection of domain names a neccessary security feature.
This needs to be mitigated client side, not rely on the good will of the administrators.
Earlier quoted context omitted.
If you have hundreds of millions of pageviews, go with a trusted party - someone you actually pay money to - like Cloudflare, Akamai, or any major hosting / cloud party. But not to increase cache hit rate (what CDNs were originally intended for), but to reduce latency and move resources to the edge.
> But not to increase cache hit rate (what CDNs were originally intended for) Was it really cache hit rate of the client or cache hit rate against the backend?
Meanwhile most libraries seem to have 80 trillion dependencies written by random github accounts called “xihonghua” or something with no other projects on their account.
One of these days we're going to learn our lesson and just write our own damned code.
yeah let me just write an entire operating system to create a to-do list app
I think JS (well, ES6) has a ton of positive qualities, and I think it's a great fit for many of its current applications. However, this is a pretty good example of what bothers me about the way many people use it. I see a lot of folks, in the name of pragmatism, adopt a ton of existing libraries and services so they don't have to think about more complex parts of the problem they're solving. Great! No need to reinve…
One of these days we're going to learn our lesson and just write our own damned code.