HN user

tmpfile

190 karma

tmpfile at protonmail

Posts4
Comments34
View on HN

I should have been more clear, I meant a sqlite.conf can configure a program rather than have it apply globally. For example, a config file placed in same directory as its .wal file to tune it for specific instances. That way you don’t need to lookup what “editions” apply which pragmas or settings. With sqlite.conf you can tune your specific database connections by uncommenting the default settings to enable current features/best practices

Joins 13 Ways 3 years ago

Great article. Side note: his normalization example reminded me how I used to design tables using a numeric primary key thinking they were more performant than strings. But then I’d have a meaningless id which required a join to get the unique value I actually wanted. One day I realized I could use the same unique key in both tables and save a join.

Simple realization. Big payoff

You:

You may be surprised to know that, when doing a "conventional" CC transaction, you are most certainly not giving any stranger information that would allow them to perform a transaction in your name on another merchant.

How do you know as a client the merchant doesn’t have a skimmer embedded in their payment page? Or that they don’t post directly to their servers (whether accidentally or not)? Are the PCI police going to catch them? Maybe they want to store cards to process later and don’t know or care about pci.

The problem is using the same details for every transaction in a loosely authorized way.

In a perfect world the merchant won’t have access to the card details (like with one-time payments) and everything would go thru a provider with a preauthorized payment. But we don’t live in that world right now.

I’m not sure what you’re replying to?

He says:

You shouldn't share a secret that someone else could use to generate payments. You should share some type of payload that is only valid for the payment you're making.

He’s advocating for a more secure one-time way of making a payment.

It would be more secure since it’s one-time and could not be reused even if the merchant didn’t use a pci compliant design

You’re arguing that using a PCI compliant PSP solves the problem of credit card number harvesting, but that’s not correct unless the entire transaction takes place on the psp (like PayPal). Once the payment details are collected in environments outside the psp’s control, it’s not protected. For example, payment info could be skimmed by devs with access to payment pages using js like in the NewEgg Magecart attack

You may be surprised to know that, when doing a "conventional" CC transaction, you are most certainly not giving any stranger information that would allow them to perform a transaction in your name on another merchant.

No. In best case, you’re giving your payment details to a PSP. A couple years ago NewEgg had a javascript skimmer on their checkout page that harvested all their customers payment details for months. Obviously anyone with access and intent could do the same for any payment page.

The output is apples and oranges tho. Since I was downvoted by someone I'll added a simple example to show the difference between the two interfaces. I shouldn't have assumed anyone here was familiar with the respective representations.

Sample data:

    CREATE TABLE users (user_id serial, name text);
    CREATE TABLE comments (comment_id serial, user_id int, comment text unique);
    CREATE VIEW user_comment_view as select u.user_id, u.name, c.comment from users u, comments c where u.user_id = c.user_id;
    INSERT INTO users VALUES (1, 'Bob');
    INSERT INTO users VALUES (2, 'Sally');
SQLITE3 OUTPUT
    sqlite> .schema
    CREATE TABLE users (user_id serial, name text);
    CREATE TABLE comments (comment_id serial, user_id int, comment text unique);
    CREATE VIEW user_comment_view as select u.user_id, u.name, c.comment from users u, comments c where u.user_id = c.user_id
    /* user_comment_view(user_id,comment) */;


    sqlite> .schema users
    CREATE TABLE users (user_id serial, name text);


    sqlite> select * from users;
    1|Bob
    2|Sally

POSTGRESQL OUTPUT
    test=# \d
                    List of relations
     Schema |          Name           |   Type   |  Owner   
    --------+-------------------------+----------+----------
     public | comments                | table    | postgres
     public | comments_comment_id_seq | sequence | postgres
     public | user_comment_view       | view     | postgres
     public | users                   | table    | postgres
     public | users_user_id_seq       | sequence | postgres
    (5 rows)


    test=# \d users
                                Table "public.users"
     Column  |  Type   | Collation | Nullable |                Default                 
    ---------+---------+-----------+----------+----------------------------------------
     user_id | integer |           | not null | nextval('users_user_id_seq'::regclass)
     name    | text    |           |          | 


    test=# select * from users;
     user_id | name  
    ---------+-------
           1 | Bob
           2 | Sally
    (2 rows)

Postgres also supports adding + to commands to get additional extended information, eg, \d+. You can also filter by tables (\dt), filter by views (\dv), filter by functions (\df), etc. It's allows much more natural enumeration of the DB which I wish sqlite had as well.

That's fair. It appears his issue is more related to libraries with broken, undocumented types and typescript's opaque errors when an error occurs in said library. Unfortunately I think he's conflating typescript's role and a library with broken type definitions (I have no idea whether the type definitions he's had problems with are provided by the library or a community effort that may not keep pace with the official library). When the type definitions don't match the official library it can definitely cause a tremendous amount of frustration and make one doubt the usefulness of types.

Is Typescript worth it? I want to skip over the static typing benefits argument…

Typescript, as the name implies, adds types to your script. If you don’t see the benefits of types then typescript may not be for you.

My issue is with the amount of extra work it places on developers… and doesn't deliver all that much value.

If you think adding types doesn't add much value then typescript may not be for you. In my experience, types are defined once then provide a lifetime of value.

you are at the whim of TypeScript developers and how they decide to progress with the language.

This is true of any library, programming language, operating system, hardware, etc. But adding types isn’t somewhere I’d worry about backward compatibility being broken. All the newer versions of typescript are backward compatible. If you have a library that requires a newer version of ts then upgrading ts won’t break anything dependent on earlier versions.

Couldn't SimulaVR request all the same documents from Meta in response? Or is it a one-way process?

I'm sure Meta's legal team would find reasons why they wouldn't have to be responsive or other ways narrow the scope. SimulaVR in turn could use the same arguments against Meta.

Wanted to add a little more detail and make the link accessible [0] which also shows the output from --extendedDiagnostics. The Panel is the window where the output from a build is shown [1]. It is displayed automatically on build. It's visibility can be toggled with CTRL+J (I'm on Linux) or from View > Appearance > Panel. When it's hidden the build is x5 faster with no other changes.

Wondering if anyone else can confirm faster builds with it hidden?

[0] https://github.com/microsoft/vscode/issues/160118

[1] https://code.visualstudio.com/docs/editor/tasks

make it clear and easy to disable for those who care

Exactly. Telemetry can be a useful like you said and should be clear to users when they are being opted into it. Especially if someone has disabled all telemetry, they should be prompted to enable it or configure it with the new settings. If you silently re-enable it on their device when they already went thru the trouble of disabling it (and not expecting the settings to change day-to-day), you'll get some knee-jerk assumptions and reactions, whether your intentions where noble or not.

It seems the demo is focused on "How to Export Trevor.io Results to Google Docs" on first pass. It breezes past the whole Build Query part, probably since the example query was so trivial. I would've expected a demo more representative of the Query Builder image.

Couple thoughts:

- You should let the user know the goal of the demo before they start it, for example, "Let's build a query of Users by Country and Export it to Google Docs" and indicate their progress through the demo (eg, Step 1 of 5) with a caption of the action they are taking at the bottom of the screen that reinforces the previous bubble. Like:

  - Step 1: Let's build a query of Users by Country
  - Step 2: Here our Users by Country is shown as a bar graph. Let's change it to a Table View 
  - Step 3: We have 14 users in the UK. Let's check the underlying results
  - Step 4: Let's export the results to Google Docs 
  - Step 5: Here's our result exported to Google Docs
- The flying/pulsing circle is fast and distracting - and it shouldn't move the label attached to it

You're right, my implementation was not a drop-in replacement for replace. How about this?

    String.prototype.replaceAll = function (n, sub) {
      let t, f = "g";
      if (n instanceof RegExp) {
        t = n.source;
        f = n.flags;
        if (!f.includes("g"))
          f += "g";
      } else {
        t = RegExp.escape(n);
      }
      let r = new RegExp(t, f);
      return this.replace(r, sub || "");
    }