sapphirecat

> I would like to know if PHP's object implementation, which was introduced after their associative arrays, suffers from the same hash collision issues.

I was curious myself, so I went digging. Most of this stuff appears in `Zend/zend_object_handlers.c`. For objects with std_object_handlers set up on them (which I assume is most of them), zend_std_read_property can do quite a bit of work: it tries a search of the property info hash zobj->ce, then the zobj->properties hash, and then calling `__get()` with protection against __get loops, then giving up and returning null. zend_hash_quick_find(), as used for these lookups, takes a HashTable* as its first argument, which is also the type of a hash table in zvalue_value.

Thus, object properties are associative arrays, though I don't think there's an equivalent severity of attack compared to causing collisions with crafted GET/POST data, as the latter is automatically parsed. You'd have to be able to upload code to make evil objects.

Going through this exercise was fun, though:

    <?php $x=new stdClass();
    $x->{"b\0ar"} = 12;
    $x->{"b\0"} = 14;
    $x->{"\0bar"} = 18; // fatal error ?>

Not sure if serious, but consider English "to", "too", and "two".

Disclaimer/explanation: I actually studied Japanese, but I'm assuming the same principle applies. If so, the symbols would be different because of the differing meanings, and the pronunciation is coincidental.

The technical quality of the photos is quite poor. They're way too bright if we're looking for subpixels, since all we see are full pixels, smeared together into blooming white. Also, looking at the HTC Rezound's standard color test, the Verizon logo on the phone is blurred just like the display itself.

It would help if the photos were re-done to actually show subpixels, sharply. (Edit: unless I missed the point, in which case the Settings menu shot should suffice: "It's PenTile but it looks pretty nice in actual usage!")

I was going to attempt this, but the solution was posted inline in the blog entry, and I read it by accident. My window was just big enough that it was the last line displayed. =(

> And then they brought it back in 7.

Mea culpa. I haven't used 7 very much =)

Speaking of context, though, I've also heard "don't use My" as a recommendation for mobile UIs, because they don't have that much space to spend on the word to begin with...

Agreed. Users will be reading "My" every time they see it, so unless it's vital, leave it out.

For example, Microsoft abandoned the "My" prefix in Vista for Documents, Pictures, etc. in the UI.

When an article about the problem is published on a gaming site, after it makes the point, it's got a couple of gratuitous chick images stuffed in it, with captions like "Bet you're paying attention to what I have to say now!"... Hmm.

I have always hated "You are male, YOU WILL LIKE THIS CHICK" flavored messages, and this still bothers me. Especially in an article like this.

There's another mistake in that command (also present in the article): with that "t" in there, `yt$` will yank up to, but not including, a '$' character on the current line. Unless there is no '$', which is an error and no yanking. Yank from cursor, not including newline, is `y$` without a "t".

+= does union-by-key: any keys present in the right array, and not in the left, are appended to the left.

`array_merge` will append all numeric keys from the right array to the left, under new key values, as if you used [] one-by-one; for string keys, all keys from the right are copied into the left, possibly overwriting what was there.

In real code, I either have all-numeric or all-string keys, and `array_merge` does what I want in bulk operations: it's essentially equal to Python list.extend and dict.update, respectively. `+` on arrays is basically useless for me.

> Is the theory that true "hackers" care more about the programming language syntax and semantics than whether it has the right libraries for the subject domain of the startup? Is the theory that true "hackers" care more about whether the startup uses a new and un-tested programming language than traction, likelihood of success, money, or the actual problems being solved?

As a basically useless anecdote... for random mucking around, I use whatever language sounds interesting. This has been Perl, Python, Forth, CL, Clojure, Ruby, and many others by now. (I used to consider myself a hacker, until I realized I wasn't working on any hard problems.)

But for real business, I'd choose something I know I can deliver with, which is pretty much Perl, C, or PHP for me. I've tried to extend this set by playing in Java and C# a few times, but the interest just isn't there. (Edit: I don't seem to have any problem delivering on boring problems in php, though.)

Contrary to what he wrote here, Steve actually has ragged on Amazon in the past, in particular in "Have You Ever Legalized Marijuana?" -- the imagery of Amazon doing things by burning through people like little tea-lights really stuck in my mind.

http://steve-yegge.blogspot.com/2009/04/have-you-ever-legali...

Don't forget the long-term contracts, where an enterprise signs onto the software for five years in exchange for a discount. That's probably the most common justification for "Why can't we have better service?" that I've seen IRL.

> apt-get (did you mean aptitude? What's the difference?)

aptitude is a TUI front-end for apt-get (which is to yum as dpkg is to rpm). synaptic and the Ubuntu Store are GUIs into the same system, though I think the store is further layered over aptdaemon and/or PackageKit. (I don't use the store much, since I'm used to synaptic, so I'm foggy on the details there. At any rate, the store UI isn't blocked while installs progress.)

I burned myself in that time frame, trying to implement SPs, because some people advocated for them.

Like Etsy, I discovered you needed a lot of them, and worse, they weren't very easy to debug or version control. I think I decided to pull them back into the application layer in the face of those problems, and I probably would have avoided the SP path entirely if I'd known about sharding back then.

Your experience isn't universal. I have people using my computer sometimes that I have to change the keyboard back to QWERTY for them, because they can't find the keyboard icon to do it themselves, even when they have directions. It really is a pain, in my experience.

Looks pretty nice. Some pictures are worth quite a few words.

Is this problem made worse by the ephemeral ports remaining unavailable after disconnect, because they're stuck in TIME_WAIT? Or does a modern TCP stack note a low RTT and release the port much sooner?

The "speed limit" is on the outbound connections from Node to the service. Node calls connect(), and receives a new port exclusively for that one connection.

A server facing the Internet can serve lots of clients because those clients have plenty of IP+port combinations to go around on their end, to allow the server to tell the difference among them even though it only has the one IP+port on its end. But 60K node.js connections from one machine, the frontend server with a single IP address, to a single IP+port on the backend server, do not have that luxury. All that identifies the connection now is the port number on the Node server, so it must be unique per connection.

Connection pools attempt to mitigate the problem by inserting a manager (the pool) in the middle, to accept larger numbers of requests from Node and try to schedule them on a lower, sustainable number of connections to the backend. At least on an RDBMS, transactions require the app to have exclusive use of the connection for its request, so when all the real connections are scheduled out, new requests have to wait for an old connection to be relinquished.

EDIT: Going back to the blog post, it said, "You really need your back-end services to scale out with node.js." Which I think means, your back end service should have multiple IP addresses, to alleviate the bottleneck described above.

> And before anybody brings up the usual objection that your customizations travel to other people's machines poorly...

I'd say that's unimportant compared to other people traveling to your machine's configuration poorly, when the displayed UI does not reflect the actual result. Imagine, if you will, someone sitting down at a keyboard configured as anything not QWERTY, but still labeled in QWERTY. They're going to ask how to fix it. In contrast, an accurately labeled keyboard will at least allow them to hunt-n-peck.

Even Apple's customizations of the trackpad travel poorly to other users. A familiar scene: a user taps it several times, then has to ask the owner how to click.

Even accurate UI needs careful design. The standard bad example is Microsoft's menus that automatically "simplified" themselves by hiding infrequently used items, making life more complex for everyone.

> You can minimise the Windows 8 dialog.

IIRC, if you "closed" the gnome one, it went to the systray, which is a UI problem all its own.

Also, you can pause the win8 operations, not just cancel them.

As for ugliness, this seems to be a shot of Hardy, give or take, so 2008-ish. I would say that the Ambiance theme that debuted to much controversy in 2010 is improved over the screenshot. (And neither of these are Gnome's default.)

Likewise with lurking-until-valuable. If karma were converted to an incentive for daily engagement, that would be a strong disincentive for me to even log in. It changes the relationship from a friendly "it's okay if you contribute, however often you feel like" to "be here and be loud, or be screwed".

(If I were changing HN, I'd love an option to replace the karma score with a reply inbox, so I don't have to poll my threads page. I'm trying to break myself of my post-and-run habits, of my general fear of defending my ideas, and of my overvaluation of karma.)

> it can be readily and universally exchanged for goods or services

I'm pretty sure all of the retailers in my area only accept USD. Nobody even bothers with the Canadian exchange rate on this side of the border, although some (and any vending machine) will refuse Canadian coins instead of accepting them at a 1:1 value with American ones.

So you claim to have "significant data" but the first thing you do is throw out huge swaths of it because it's not actually significant?

Also regarding graph 2's commentary, 0.51 is not "almost" double 0.34. It turns out to be only 1.5x, so calling it "almost double" is about as meaningful as calling it "almost the same".

> I assume everyone will agree with this statement, but I'll state it anyway: You can't cancel valid accounts! If the account is paid in full, and assuming the account isn't being used for nefarious purposes, you cannot cancel valid accounts for any reason.

I'd agree on ethical grounds, but legally, just about every TOS I have read states that they can cancel an account at any time, for any reason. I don't know if this would hold up in court, though.

I'v been eagerly awaiting this, since my major annoyances all have to do with the floating dialogs:

Not hiding the palettes when the last gimp window was minimized. Minimize -> d'oh! -> unminimize -> secret key shortcut[1] -> minimize again. Older versions used to hide them with any image window being minimized, so it was minimize#1 -> sigh -> minimize#2 -> unminimize#2 back then.

Placing the toolboxes at x,0 by default so they were underneath the taskbar/menubar. I keep my taskbar on top on Windows, and I'm glad I know about Alt+Space there.

Not having the image window's keyboard shortcuts work when a tool window is focused, for which I know no workaround.

Having the tool windows appear in the Alt+Tab list.

Actually, I can think of one more that was remedied with 2.0: the menu used to be hidden. You could right-click the image or hit the ">" button at the corner of the rulers, but it took me a long time to figure out how to save my first image.

[1] TAB. I think its action is finally available in the menus, and the shortcut displayed with it, in 2.7.x.

> Have you thought about what happens when their IP changes?

++. When I was walking this road, I answered that question with "I'll use the user-agent instead!" Then I checked that assumption, and the Internet told me that could vary between requests as well. That was the key insight (you can't trust anything) that put me on the road to a much more standard system. (But probably still insecure, since I was younger and working for someone with NIH syndrome.)

You might find your answer in the history of municipal network projects. But I'm strongly biased against the incumbents, so I'll avoid leaving any details here.

Also, the Senate was once elected by the States, which may have been intended by the founding fathers as an important check on the expansion of Federal power. State-elected senators would serve their state governments, who would probably not want to see the massive appropriation of state power to the federal government.

I think HN still tends to reward quick posts over more thoughtful ones. As humor is quicker to post, it will come to dominate (i.e. HN will become Reddit) without this important check/balance in the culture.

My ISP (Windstream DSL) started redirecting nxdomain responses years ago. I noticed when I mistyped a host alias I had set up for ssh and got back `connection refused` when it was not even a fully-qualified name.

Thankfully VeriSign did this to .com once with their SiteFinder service, so FOSS DNS servers generally have good support for assigning a particular IP address as "this is really NXDOMAIN". (Nowadays, I'm running Unbound locally anyway for DNSSEC.)

EDIT: the opening paragraph used to read "My ISP started doing this," but a closer look at TFA indicates this issue is about intercepting DNS queries to existing, legitimate search providers in order to substitute paid results.

One more fact for your collection: Verizon even subsidizes its prepaid phones. One option I was given to replace a prepaid out-of-warranty feature phone was paying $200 for a new one--though they sell the exact same model with new service for $40. (Ultimately I took a prior-generation refurbished phone for $50.)