zeveb

If a security vulnerability is reported by someone who is also violating the CoC, what do you do? Do you ignore it? Fix it silently?

Is this even a question? You triage and fix the vulnerability just like any other one. Are truths spoken by folks one dislikes — even for perfectly valid reasons — any less true?

The only way I can imagine this somehow applying is if someone has a habit of reporting vulnerabilities which do not exist, or of exaggerating their severity. Is crying wolf a CoC violation? If so, then I can imagine that particular sort of bad behaviour justifying some consideration before acting on a report.

… and regulation, too (as the article details).

It was easier to have non-threatening debates because everyone felt more secure. When people are stressed and afraid, the debates aren’t just intellectual exercises but things that could mean the loss of real opportunities in their lives.

You’re right that people feel less secure, but that doesn’t mean that they are correct when they feel that.

By pretty much any measure, I believe that people in 2025 are far more secure than they were in 1975, 1985 or 1995.

Mississippi, the poorest state in the United States, is close to surpassing Europe's largest economy Germany's GDP per capita.

Snopes in 2018 and Snopes in 2008 were sadly two very different things. They used to be such a great resource!

I think that this is correct. Also, we really shouldn’t forget that Markdown is meant to generate HTML, and that HTML blocks are valid Markdown: a system which does not permit it isn’t really using Markdown.

If you run more than one monitor with different DPI, Wayland is the only choice.

I run multiple monitors with differing physical DPIs on X11. Yeah, that means they have differing resolutions. It doesn’t bother me, and I can do all the things that I want, unlike if I were using Wayland.

Maybe someday Wayland will be a replacement for X11, but that day is not today.

Quoting is insane and hard to get right.

This really makes me wonder if you’ve used Tcl. Quoting in Tcl is so much simpler than in e.g. bash or cmake. It’s all about know when a string will be evaluated or not.

Type errors are very common.

In my experience, no more so than in any other dynamic language, e.g. Python or Lua.

Again in my experience, if one wants a scripting language — i.e., one used to orchestrate a number of commands — then Tcl is exactly what the doctor ordered.

The last notable ban was Paul Graham for simply sharing their Mastodon handle.

Paul Graham is a man, not a plural entity.

I'll take Java over JavaScript any day

Well sure, and I would choose to be hanged rather than broken on the wheel, but I’d rather neither.

Fortunately, Armed Bear Common Lisp runs fine on the JVM.

I think it’s more like how some people still wear wool and linen despite the fact that polyester and rayon exist. Popularity does not equal quality.

Having a unified tool set works wonders for group productivity, no more messing around with some employees not having a certain package and others needing to customize their vim configs.

Completely agree: the entire company should be on a common, future-proof, extensible, free platform: Emacs!

I honestly don’t understand why anyone bothers wasting effort on any other editor.

Well, forbidding adults from smoking is one of the negative consequences.

I know, it’s strange… since 1972 everyone was thinking that we were manipulating versions, but, it turned out, surprisingly, that thinking about the changes themselves as first class solved a very important problem: the problem of merging branched code.

This is a very good point, and it really was revolutionary.

These are hilarious. Is it a meta-joke that a series of videos about over-complicated technology are only visible if one allows JavaScript and embedded Twitter posts?

It’s so much easier to destroy than to build. That applies to buildings, but it also applies to cultures and civilisations. The work of centuries — even of millennia — can be broken in decades or even years.

And what’s worse is that there’s not much one can do about it. One can preserve what one has inherited, and try to increase it, but others can knock it down much more easily.

Imagine a Gandalfina origin story where she’s running, jumping, punching and kicking orcs!

you should not assume the format of a non-200 status code

You should never assume format based on status code at all! You should detect it based on the Content-Type header.

You'll get a 500 with a plaintext body. Don't parse that as JSON.

Any intermediary which returns plain text with an application/json Content-Type is badly, badly broken.

I don't think there's a correct answer

I think there is a correct answer: use the 404 to indicate that a requested resource does not exist, and use a 200 to return a requested resource that does exist; and use URLs to represent resources.

In other words, follow the HTTP RFCs.

And never, ever, ever EVER use a 200-series status code to return an error.

It's the difference between "There is nothing handling this route at all" and "there is something handling this route but the object isn't found."

'Nothing handling this route' has no meaning, because routes have no meaning in a hypertext application. Clients should not generally be constructing URLs by hand; they should be receiving them from the servers they communicate with.

In the example in the article, an application dealing with employees should not be constructing URLs by appending employee IDs to strings; rather, every reference to an employee in the application should be to a URL rather than an ID. So when it requests a list of employees, it receives the equivalent of {/api/v1/employees/1, /api/v1/employees/2 … /api/v1/employees/N} rather than {1, 2 … N}.

I also very much don't like playing the "if you expose your app over HTTP you should assimilate HTTP semantics and do a fuzzy lossy map of your application to HTTP verbs and HTTP status codes."

If you are building a hypertext application, then you should build a hypertext application. It's completely possible. Off the top of my head, protocols such as ACME (used by Let's Encrypt) are good examples to follow.

Standard week starts on Monday.

No thanks! IMNSHO the week starts on Sunday.

'Whitelist' and 'blacklist' have nothing to do with race, they never had anything to do with race, and anyone who thinks they do is, quite simply, wrong. Knowing these facts, this is nothing like calling a black man 'boy' or using the n-word — so bringing them up is irrelevant.

If using a regular modern browser is a superset of the experience of w3m, why do I want to add the extra level of inconvenient indirection?

Because using a 'regular modern browser' is not a superset; it also lacks certain things, such as freedom from JavaScript, freedom from some forms of tracking and it is incompatible with the terminal or other text-based environments. Some folks find those things to be worthwhile.

These aren't really egg whites, since they don't come from … eggs.

They could be called 'chicken-free egg white substitutes,' though.

the system language is awkward (no namespaces, dynamic scoping by default, ...)

RMS's dislike of Common Lisp really caused a colossal amount of damage. Imagine an Emacs written in Common Lisp instead of Emacs Lisp, with decades and decades of improvements. Having written a reasonable amount of software in both, Common Lisp Emacs would be very, very preferable, in part for the reasons you list and in part for others (e.g. a full-fledged, built in object system and improved extensibility).

The best place for the control key is determined by two things: finger strength and relative frequency of use. The control key is typically used far more often than alt/meta, super or (for those lucky enough to have one) hyper; as such, it should be positioned so that it may be struck with a strong finger: an index or middle finger would be great, or perhaps a thumb (as we learnt to do with Macs back in the 80s).

As such, it seems remarkable that most keyboards place it far outboard, where all one can do is strike it with the weakest finger of all. Even the superior alternative of caps lock as control is not as good as alt as control.

All of which is to say that the control key placement on the ThinkPads, while imperfect, is better than on most laptops.

Whose fault is that? The one who disables the JavaScript not actually needed to submit a POST request, or the one who implements a web service which requires client code execution to receive a POST request (or worse, who uses GET for POST)?

Very few people still code with the legacies of the 1970s: ML, Pascal, Scheme, Smalltalk.

Arguably, the software world would be better off if more people did code with those 1970s languages, than with the ones we are stuck with now.

And that applies to Awk, too. As the author quotes Neil Ormos stating, Awk is well suited for personal computing, something which we have gotten further and further from at the same time as computers have become more distributed. At what point in history have such a large fraction of the human race had the ability to calculate to such an amazing order of magnitude, and at what point in history have such a large fraction of the same human race not bothered with calculation?

Awk is a great tool precisely because it puts quite a lot of expressive power in the hands of an average user on a Unix system. Sure, on a Lisp machine or Smalltalk machine there really isn't the same need for Awk: the systems languages on such machines are safe enough and expressive enough to do what Awk does. But in the Unix context — which is basically what we're all living in, with even the VMS-derived Windows more-or-less adhering to the Unix model — Awk is a godsend.

edit: correct typo

I can almost guarantee this is due to licensing issues with the camera firmware.

I think that a good pro-market regulation would be to require that all hardware be sold with the firmware required to operate it under some sort of open source license.

Once one has bought a device, one should be able to continue operating it.

I honestly didn't think anyone browsed the web without javascript enabled.

I know a bunch of folks have replied, but I'm another one. I remember back before JavaScript; I remember when Flash was the bane of those who cared about privacy or security; I remember when 'DHTML' was the buzzword of the day.

I actually have a lot more appreciation for what JavaScript enables now than I used to. It really is neat that we have this platform-independent mostly-not-completely-insecure app runtime. Pity that it is built atop what should have been a hypertext system, though.