jjnoakes

Last writer wins may be sufficient for some folks but for me, any potential data loss in an app like this is a deal breaker. I hope you'll consider some kind of merge conflict detection and surfacing that to the user. Even keeping a list of deleted items and showing that can be a good start.

The same way you know that your browser session secrets, bank account information, crypto private keys, and other sensitive information is never uploaded. That is to say, you don't, really - you have to partially trust Microsoft and partially rely on folks that do black-box testing, network analysis, decompilation, and other investigative techniques on closed-source software.

I view code in many contexts though - diffs in emails, code snippets on web pages, in github's web UI, there are countless ways in which I need to read a piece of code outside of my preferred editor. And it is nicer, in my opinion, to read languages that have visually distinct parts to them. I'm sure it is because I'm used to it, but it really makes it hard to switch to a language that looks so uniform and requires additional tools outside of my brain to take a look at it.

Safe pockets in ambient unsafety does have benefits though. For example, some code has a higher likelihood of containing undefined behavior (code that manipulates pointers and offsets directly, parsing code, code that deals with complex lifetimes and interconnected graphs, etc), so converting just that code to safe code would have a high ROI.

And once you get to the point where a large chunk of code is in safe pockets, any bugs that smell of undefined behavior only require you to look at the code outside of the safe pockets, which hopefully decreases over time.

There are also studies that show that newly written code tends to have more undefined behavior due to its age, so writing new code in safe pockets has a lot of benefit there too.

An article like this would be better if it didn't gloss over the different bash startup files and when they get loaded.

Many times when I help someone debug their shell, the root cause is not understanding what each of those files is for.

Adding an echo to the wrong one and not having it check if the shell is interactive can break all sorts of things like scp for example. And in weird and non-obvious ways.

I like digital board games for quick setup and cleanup too. It lets us play more games in a session.

If someone is locked out of their password vault, they are likely also locked out of their email...

Fill-in-the-middle. If your cursor is in the middle of a file instead of at the end, then the LLM will consider text after the cursor in addition to the text before the cursor. Some LLMs can only look before the cursor; for coding,.ones that can FIM work better (for me at least).

I use fly.io. I pre-paid for credits and if they run out, things shut down.

No affiliation, just happy to use a provider with actual caps.

I take a slightly different approach - I usually have AI assist in writing a script that does the task I want to do, instead of AI doing the task directly. I find it is much easier for me to verify the script does what I want and then run it myself to get guaranteed good output, vs verifying the AI output if it did the task directly.

I mean if I'm going to proof-read the full task output from the AI, I might as well do the task by hand... but proof-reading a script is much quicker and easier.

I'm pretty sure all of the common areas in HOAs that I used to live in were equally owned by all members.

Security: Compiler binaries can contain malware and backdoors that insert viruses into programs they compile. Malicious code in a compiler can even recognize its own source code and propagate itself. Recompiling a compiler with itself therefore does not eliminate the threat. The only compiler that can truly be trusted is one that you've bootstrapped from scratch.

It is a laudable goal, but without using from-scratch hardware and either running the bootstrap on bare metal or on a from-scratch OS, I think "truly be trusted" isn't quite reachable with an approach that only handles user-space program execution.

Memory safety and the borrow checker are useful even in the absence of dynamic memory allocation. This still doesn't bring rust and ada to the same place, but it is important to clarify that piece.

I have a self-imposed goal of not using third-party libraries for any of the solve logic. It feels more satisfying to do it myself, even if it takes longer.

The application menus (like File, Edit, etc) had a built-in way of detaching them when they were expanded so that you could keep them open and place them somewhere convenient on your screen. This was useful if you had to select different menu options frequently.

The number of times you shot yourself in the foot that you know about. Some of those bullets just haven't landed yet. C and C++ give you very interesting foot-guns: sometimes they go off even when you don't touch them (compiler upgrade, dependencies changing, building on a new architecture, ...)

If you suggest a language here where nothing weird can be done, I bet someone will reply with something weird done in that language.

That feature doesn't train the model on customer's data though, unless I'm missing something.

I agree it's annoying it was enabled by default in places, but I'm trying to either correct the incorrect "for AI training" part, or find a citation that shows they are actually doing AI training with it.

Citation please, about Dropbox training models with customer data?

You could generate a spec for the service and then diff to the expected perhaps.

The macro X turns its argument into a string, but using it on its own means you can't turn other macro values into strings, only macro names.

    #define F 42
    #define X(s) #s
    X(5)  //  Expands to "5" (as a string literal)
    X(F)  //  Expands to "F" not "42"

    #define F 42
    #define X(s) #s
    #define S(s) X(s)
    S(5) // "5" as expected
    S(F) // "42" because S(F) expands to X(42) expands to "42"

According to my understanding, RFC 6265, and MDN, removing the leading dot from the cookie's domain shouldn't have changed whether or not it was sent to subdomains (it should have been sent in either case). What am I missing?

Edit: Maybe I'm misreading. I thought the domain was changed from "breakthroughjuniorchallenge.org" to ".breakthroughjuniorchallenge.org" but maybe it was changed from nothing (which might display as "breakthroughjuniorchallenge.org" in browser debug tools but really is a host-without-subdomains cookie) to ".breakthroughjuniorchallenge.org", which should be the same as changing it from nothing to "breakthroughjuniorchallenge.org" too, I think.

It is not just a technical limitation, it is a license limitation too, for what it is worth.

I strive for the latter approach as much as possible. I'm happy doing more work as a developer (like using a slightly older version of libraries or languages) to ensure that I build on a stable base that gets security updates without tons of major version api churn.

Even with custom error documents configured in the web server, you still lose the application-specific (and probably request- and error-specific) message generated by the application itself.

In general, I really love the idea of running all your stuff on a server you own as opposed to e.g. Heroku or AWS. Simple predictable monthly bill really gives you peace of mind.

Have you found hosting you like with bandwidth expense caps? I'm looking for something like this but I don't want surprise network bills if I misconfigure something.

For human-readable purposes I usually just stick in the timezone. 1:59am EDT plus 1 minute is 1:00am EST.

I have no idea how you can actually test everything.

While a worthy goal (if unattainable sometimes), in this case, folks would settle for "test anything", which would have caught the regression.

It gets even worse when platforms blindly render img tags or the equivalent. Then no user interaction is required to exfil - just showing the image in the UI is enough.

The underqualified non-diversity hire is also a thing. There is no reason to bring identity into it. Just discuss underqualified workers in general.