Skalman

For me the hump was from the get-go.

Following the book, I installed Rust directly, but then i realized that I should've installed it via Rustup. Next, I want a good editing environment, so I install VS Code and Racer, but then I find out that I can't use Clippy unless I use Nightly... and I'm not interested in using Nightly, so I'll wait.

To people helping others on the internet who claim to be security professionals, remember to make sure that the person is actually trustworthy, so you're not helping criminals. Even though a_cherepanov is a new account with only this comment, I suppose their email domain makes them trustworthy enough: ESET is a Slovakian security company that's had a Wikipedia page for 5+ years.

It's an encoding that isn't good at anything: it's neither ASCII-compatible (like UTF-8), nor fixed-length (like UTF-32), but because most characters require only 2 bytes, developers frequently assume that none require more, leading to bugs when a character eventually is represented by 4 bytes.

If you don't need to dynamically evaluate the code, compiling ES.next code will be more performant, e.g. using Babel.

Perhaps you didn't catch that basically the difference between let and var is that let is block-scoped, while var is function-scoped?

  let result = 0;
  for (let i = 0; i < arr.length; i++) {
    result += arr[i];
  }

In general, it looks really good.

- I'd like some more focus on keyboard navigation. Make sure that everything looks good when tabbing, even if you've used arrow keys first.

- Anti-phishing: A long domain name will trim the end in the "More from ..." link. Instead it would make sense to trim the beginning.

- Needs better contrast.

I note that mozilla.org is on that list. Does anybody know if they're affected?

Was he ever that critical? From the article:

Mr. Obama was a sponsor of a bill in 2005 to raise the standard required for federal agents using ... national security letters ... He joined other Democrats fighting the renewal of the Patriot Act until it was amended to address civil liberties concerns, then voted for its extension in 2006 after a compromise, breaking with Mr. Wyden who voted no.

“The rhetoric was probably sharper than his votes.” By summer 2008, with the Democratic nomination secured and the White House now a real possibility, Mr. Obama voted for legislation essentially ratifying Mr. Bush’s surveillance programs.

It's a one-line fix to make it intuitive, but that's not what's needed here. Ultimately there should be some spec so that browser vendors can converge towards a single behavior.

That patch would not be welcome. The patch to make the behavior intuitive is literally to remove "!important" from one CSS file. They're not changing because they're afraid to break the web.

Well, it sure is an official guideline [1].

[1] https://en.wikipedia.org/wiki/Wikipedia:COI

Well, I always open a private window if that's the case.

Because that's not possible to style with CSS.

One thing that helps me is to imitate the expression and try to feel what I feel when I'm doing it. Not always right, but sometimes I go from not having a clue to being sure.

Hollywood is pushing DRM and requiring its use. Netflix wants DRM (via Hollywood), but Youtube doesn't currently seem to mind being DRM free.

If DRM capability becomes ubiquitous, Youtube might become DRMed, but that's on a longer time horizon.

I frequently use it for settings.

You can actually partially detect it with Firefox.

https://developer.mozilla.org/en-US/docs/Web/CSS/:-moz-syste... https://developer.mozilla.org/en-US/docs/Web/CSS/:-moz-syste...

Oh, didn't know. You could even force highlight colors, by explicitly setting border or outline colors.

Such a simple idea - but it does make it easier to follow. The only problem I have is that it's very mac-centric. On my system the focus color is orange and it looks a bit off.

I'd suggest to use the highlight color:

  box-shadow: 0px 0px 2px 3px highlight, 0px 0px 2px highlight inset

Somehow, despite not understanding why exactly we exist, what our purpose is, and that at any given moment we could die and cease to exist, we don't go insane. Do you have any idea how crazy that is?

I don't get why people need a reason to exist. To me it's clear that there isn't a reason and we don't have any predefined purpose, yet most people create their reason. Maybe they live for their loved ones, maybe they enjoy life. And regarding death: it's scary and doesn't happen very often, so it makes sense not to think about it too much.

But I thought the point was that they didn't consider this to be a security vulnerability.

I can't get that to work in Firefox 25.

If you can get a user to click a link which exposes CSS injection, it can be a security issue. For instance, you could change the text of links and buttons, and otherwise trick the user into doing something that s/he wouldn't otherwise.

It adds a great amount of fingerprintability.

At least in Firefox Aurora 25 there's a small search icon to the right in the inspector. But its search functionality seems buggy...

Edit: It only shows searches as a CSS expression, and it doesn't show the results in the DOM view, only by highlighting individual results on the page (like inspecting that element)

I feel that CSS is pretty well designed. The problem is that it has so many ways to do the same thing, and the fact that vertical and horizontal layout don't work the same way.

I agree that it's a disaster, but: Is there any better language? I feel that very few of the "native" variants have APIs that are simpler to deal with. (Of course Sass is much better than vanilla CSS, but it's basically the same if you strip away the sugar)

Yes, it has. I think that's why it was posted - someone at Opera predicted/suggested/wanted this to happen.

Oh yeah - I use about 5 different profiles with one main profile. It's not a solution, though: I want to be logged into main@gmail.com and log into other sites with randomstring@gmail.com and I'd prefer to not have to be logged in there at all.

Yet another use case that's more difficult now: I use randomstring@gmail.com for some sites where I expect to get lots of spam, and then forward email based on some filters.