13 ms·

Cursed Knowledge

518 points by bqmjjx0kac 1y ago

treve 1y ago
The '50 extra packages' one is wild. The author of those packages has racked up a fuckload of downloads. What a waste of total bandwidth and disk space everywhere. I wonder if it's for clout.
- deleted 1y ago
  [deleted]
- Centigonal 1y ago
  It's probably a clout thing, or just a weird guy (Hanlon's Razor), but a particularly paranoid interpretation is that this person is setting up for a massive, multi-pronged software supplychain attack.
  - deleted 1y ago
    [deleted]
  - godelski 1y ago
    Those don't have to be mutually exclusive. Often those with clout are targeted for supplychain attacks. Take xz as an example. Doesn't seem unreasonable that a solo dev or small team looks to either sell their projects or transfer them to someone else (often not even with money exchanging hands). Or even how old social media accounts are hacked so that they can appear as legitimate accounts. I'm big on Hanlon's Razor too, but that doesn't mean the end result can't be the same.
  - motorest 1y ago
    > (...) but a particularly paranoid interpretation is that this person is setting up for a massive, multi-pronged software supplychain attack. That person might not be doing it knowingly or on purpose, but regardless of motivations that is definitely what is being done.
    - whilenot-dev 1y ago
      A package "for-each"[0] that depends on a package "is-callable"[1], just to make forEach work on objects? Nope, not buying the goodwill here. [0]: https://www.npmjs.com/package/for-each https://www.npmjs.com/package/for-each [1]: https://www.npmjs.com/package/is-callable https://www.npmjs.com/package/is-callable
      - whilenot-dev 1y ago
        To be fair, he himself removed his unnecessary dependency that caused the explosion of dependencies: https://github.com/A11yance/aria-query/commit/ee003d2af54b6bc49a7aba231fedfd0f8b2c8610 https://github.com/A11yance/aria-query/commit/ee003d2af54b6b... EDIT: Oops, he just did the changelog entry. The actual fix was done by someone else: https://github.com/A11yance/aria-query/commit/f5b8f4c9001ba7c7efd20fe6d76bb578c2723de3 https://github.com/A11yance/aria-query/commit/f5b8f4c9001ba7...
      - motorest 1y ago
        Older browsers don't support foreach, so it's not like a polyfill is unheard of https://caniuse.com/?search=foreach https://caniuse.com/?search=foreach
        whilenot-dev 1y ago
        Are you serious here? It isn't a polyfill, it's supposed to work on plain objects which isn't part of the spec at all. Besides that, Array.prototype.forEach is only unsupported in Android Browser 4.3 (from July 2013) and IE8 (from May 2008). Seems like a weird reasoning to add it to packages in 2025.
        motorest 1y ago
        > Are you serious here? I am. If you check the definition of polyfill, you'll eventually arrive at something like the following: > A polyfill is a piece of code (usually JavaScript on the Web) used to provide modern functionality on older browsers that do not natively support it. https://developer.mozilla.org/en-US/docs/Glossary/Polyfill https://developer.mozilla.org/en-US/docs/Glossary/Polyfill I think we would agree that foreach fits the definition, happy path, and whole purpose of a polyfill. if you read up on forEach, you will notice that Array.prototype.forEach requires objects to be callable. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/forEach https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
  - nullc 1y ago
    > is setting up for a massive, multi-pronged software supplychain attack The problem with this view is that the JS ecosystem is already doing that all on its own without that particular contributor. (as has the rust ecosystem, which slavishly copied JS' bad practices). Eliminate the one guy and JS is still pervasively vulnerable to these attacks. The polyfills are the least of it, because at least they should be completely stable and could just be copied into projects. Other dependencies not so much.
- smitty1e 1y ago
  It does raise the idea of managed backward compatibility. Especially if you could control at install time just how far back to go, that might be interesting. Also an immediately ridiculous graph problem for all but trivial cases.
- fastball 1y ago
  The author is almost certainly ljharb.
  - 0x696C6961 1y ago
    I'm convinced he's a rage baiting account. No-one can consistently have such bad takes.
    - antonvs 1y ago
      Your faith in humanity exceeds mine.
- bikeshaving 1y ago
  The maintainer who this piece of “cursed knowledge” is referencing is a member of TC39, and has fought and died on many hills in many popular JavaScript projects, consistently providing some of the worst takes on JavaScript and software development imaginable. For this specific polyfill controversy, some people alleged a pecuniary motivation, I think maybe related to GitHub sponsors or Tidelift, but I never verified that claim, and given how little these sources pay I’m more inclined to believe he just really believes in backwards compatibility. I dare not speak his name, lest I incur the wrath of various influential JavaScript figures who are friends with him, and possibly keep him around like that guy who was trained wrong as a joke in Kung Pow: Enter the Fist. In 2025, I’ve moderated my opinion of him; he does do important maintenance work, and it’s nice to have someone who seems to be consistently wrong in the community, I guess.
  - titanomachy 1y ago
    This is Wimp Lo! We trained him wrong on purpose, as a joke. Long time since I thought of that movie.
    - deleted 1y ago
      [deleted]
  - jddj 1y ago
    Looking forward to this Jia Tan sequel in a few years' time.
  - karel-3d 1y ago
    to save everyone else a search, it's probably ljharb. (I am not a member of JS community, so, come and attack me.)
    - sunaookami 1y ago
      Wow that's some deep rabbit hole. This guy gets paid per XY npm downloads and games the system through this. Awful.
- deleted 1y ago
  [deleted]
bigyabai 1y ago
> Some phones will silently strip GPS data from images when apps without location permission try to access them. That's no curse, it's a protection hex!
- Muromec 1y ago
  A ward even
- mynegation 1y ago
  I have no idea what that means but to me it looks like it works as designed.
- nulld3v 1y ago
  On the other hand, one particular app completely refuses to allow users to remove location information from their photos: https://support.google.com/photos/answer/6153599?hl=en&co=GENIE.Platform%3DAndroid#edit_or_delete_estimated_location https://support.google.com/photos/answer/6153599?hl=en&co=GE...
- 8organicbits 1y ago
  I think this is written unclearly. Looking at the linked issues, the root cause seems to be related to a "all file access" permission, not just fine grained location access. It seems great that an app without location access cannot check location via EXIF, but I'm surprised that "all file access" also gates access to the metadata, perhaps one selected using the picker. https://gitlab.com/CalyxOS/platform_packages_providers_MediaProvider/-/commit/9afa21808923ac04b5edc58853fb16329d986c02 https://gitlab.com/CalyxOS/platform_packages_providers_Media...
g8oz 1y ago
This is awesome. Disappointing to hear about the Cloudflare fetch issue.
- doctorpangloss 1y ago
  The infallibility of Cloudflare is sacrosanct!
- motorest 1y ago
  > Disappointing to hear about the Cloudflare fetch issue. You mean the one where explicitly configuring Cloudflare to forward requests to origin servers as HTTP will actually send requests as HTTP? That is not what I would describe as disappointing.
  - g8oz 1y ago
    The behavior seems likely to mislead a lot of people even if it doesn't confuse you.
    - motorest 1y ago
      > The behavior seems likely to mislead a lot of people even if it doesn't confuse you. You need to go way out of your way to toggle a switch to enable this feature. The toggle says very prominently "Cloudflare allows HTTPS connections between your visitor and Cloudflare, but all connections between Cloudflare and your origin are made through HTTP." You proceed to enable this feature. Does it confuse you that Cloudflare's requests to your origin servers are HTTP?
worik 1y ago
dd/mm/yyyy date formats are cursed.... Perhaps it is mm/dd/yyyy (really?!?) that is cursed....
- hollerith 1y ago
  mm.dd.yyyy is cursed, too. The not-cursed options are dd.mm.yyyy and mm/dd/yyyy
  - dmd 1y ago
    in what world could mm/dd/yyyy not be cursed!? that makes no sense whatsoever.
    - Izkata 1y ago
      It's the US short form, matching the word-month order we always use for regular dates: "August 7, 2025". Note the slashes are important, we don't use dots or dashes with this order. That's what GP was getting at.
      - dmd 1y ago
        And it makes absolutely no sense. I've lived with it all my life (I'm an American!) and it has never made any sense to me.
        kstrauser 1y ago
        First, I use ISO8601 for everything. This is not me arguing against it. But, I think the American-style formatting is logical for everyday use. When you're discussing a date, and you're not a historian, the most common reason is that you're making plans with someone else or talking about an upcoming event. That means most dates you discuss on a daily basis will be in the next 12 months. So starting with the month says approximately when in the next year you're talking about, giving the day next says when in that month, and then tacking on the year confirms the common case that you mean the next occurrence of it. When's Thanksgiving? November (what part of the year?) 27 (toward the end of that November), 2025 (this year). It's like answering how many minutes are in a day: 1 thousand, 4 hundred, and 40. You could say 40, 400, and 1000, which is still correct, but everyone's going to look at you weirdly. Answer "2025 (yeah, obviously), the 27th (of this month?) of November (why didn't you start with that?)" is also correct, but it sounds odd. So 11/27/2025 starts with the most useful information and works its way to the least, for the most common ways people discuss dates with others. I get it. It makes since. But I'll still use ISO8601.
LeoPanthera 1y ago
"Some phones will silently strip GPS data from images when apps without location permission try to access them." Uh... good?
- steve_adams_86 1y ago
  I'm torn. Maybe a better approach would be a prompt saying "you're giving access to images with embedded location data. Do you want to keep the location data in the images, or strip the location data in this application?" I might not want an application to know my current, active location. But it might be useful for it to get location data from images I give it access to. I do think if we have to choose between stripping nothing or always stripping if there's no location access, this is the correct and safe solution.
  - Aurornis 1y ago
    > saying "you're giving access to images with embedded location data. Do you want to keep the location data in the images, or strip the location data in this application?" This is a good example of a complex setting that makes sense to the 1% of users who understand the nuances of EXIF embedded location data but confuses the 99% of users who use a product. It would also become a nightmare to manage settings a per-image basis.
    - fc417fc802 1y ago
      Not per-image, it would be per-app. The first time it happened it would ask you. There are already quite a few per-app toggles for things like this so it wouldn't be anything new or particularly surprising. That said, an alternative to bugging the user might be that when the app makes the call to open the file that call should fail unless the app explicitly passes a flag to strip the location data. That way you protect users without causing needless confusion for developers when things that ought to "just work" go inexplicably wrong for them.
- a96 1y ago
  Kind of. But that means any file that goes through that mechanism may be silently modified. Which is evil.
simpaticoder 1y ago
I loved this the moment I saw it. After looking at an example commit[1], I love it even more. The cursed knowledge entry is committed alongside the fix needed to address it. My first instinct is that every project should have a similar facility. The log is not just cathartic, but turns each frustrating speedbump into a positive learning experience. By making it public, it becomes both a tool for both commiseration and prevention. 1 - https://github.com/savely-krasovsky/immich/commit/aeb5368602db30a8fccc5d804625f9d445f2b89b https://github.com/savely-krasovsky/immich/commit/aeb5368602...
- delusional 1y ago
  I agree, I usually put this sort of information in the commit message itself. That way it's right there if anybody ever comes across the line and wonders "why did he write this terrible code, can't you just ___".
  - motorest 1y ago
    As a side note, it's becoming increasingly important to write down this info in places where LLMs can access it with the right context. Unfortunately commit history is not one of those spots.
    - rf15 1y ago
      You are sadly completely missing the point of ever-self-improving automation. Just also use the commit history. Better yet: don't be a bot slave that is controlled and limited by their tools.
      - motorest 1y ago
        > You are sadly completely missing the point of ever-self-improving automation. Just also use the commit history. I don't think you understand the issue you're commenting on. It's irrelevant whether you can inject commit history in a prompt. The whole point is that today's support for coding assistants does not support this source of data, whereas comments in source files and even README.md and markdown files in ./docs are supported out of the box. If you rely on commit history to provide context to your team members, once they start using LLMs this context is completely ignored and omitted from any output. This means you've been providing context that's useles and doesn't have any impact on future changes. If you actually want to help the project, you need to pay attention on whether your contributions are impactful. Dumping comments into what amounts to /dev/null has no impact whatsoever. Requiring your team to go way out of their way to include in each prompt extra context from a weird source that may or may not be relevant is a sure way to ensure no one uses it.
thorum 1y ago
> npm scripts make a http call to the npm registry each time they run, which means they are a terrible way to execute a health check. Is this true? I couldn’t find another source discussing it. That would be insane behavior for a package manager.
- deleted 1y ago
  [deleted]
- dgoldstein0 1y ago
  It might be referring to the check if whether npm is up to date so it can prompt you to update if it isn't?
- skacekamen 1y ago
  probably an update check? It definitely sometimes shows an update banner
- jrasm91 1y ago
  https://docs.npmjs.com/cli/v6/using-npm/config#update-notifier https://docs.npmjs.com/cli/v6/using-npm/config#update-notifi... https://github.com/npm/cli/blob/5d82d0b4a4bd1424031fb68b4df740c1bbe5b172/lib/cli/update-notifier.js https://github.com/npm/cli/blob/5d82d0b4a4bd1424031fb68b4df7...
burnt-resistor 1y ago
- Windows' NTFS Alternate Data Streams (ADS) allows hiding an unlimited number of files in already existing files - macOS data forks, xattrs, and Spotlight (md) indexing every single removable volume by default adds tons of hidden files and junk to files on said removable volumes. Solution: mdutil -X /Volumes/path/to/vol - Everything with opt-out telemetry: go, yarn, meilisearch, homebrew, vcpkg, dotnet, Windows, VS Code, Claude Code, macOS, Docker, Splunk, OpenShift, Firefox, Chrome, flutter, and zillions of other corporate abominations
- kirici 1y ago
  >opt-out telemetry: go By default, telemetry data is kept only on the local computer, but users may opt in to uploading an approved subset of telemetry data to https://telemetry.go.dev https://telemetry.go.dev. To opt in to uploading telemetry data to the Go team, run: go telemetry on To completely disable telemetry, including local collection, run: go telemetry off https://go.dev/doc/telemetry https://go.dev/doc/telemetry
  - burnt-resistor 1y ago
    Yep, but you're techsplaining to someone who already know this. But still, it's not opt-in. It's always on by default and litters stuff without asking. All that does is create a file but that doesn't remove the traces of all the tracking it leaves behind without asking. This fixes it in a oneliner: # mac, bsd, linux, and wsl only (d="${XDG_CONFIG_HOME:-$HOME/.config}/go/telemetry";rm -rf "$d";mkdir -p "$d"&&echo off>"$d/mode")
    - kirici 1y ago
      Like television and telephone, the "tele" (remote) part is the crucial and defining one. Without it, it's just metry.
- TheBicPen 1y ago
  Opt-out telemetry is the only useful kind of telemetry
godelski 1y ago
Looks like they're missing one. I'm pretty sure the discussion goes further back[0,1] but this one has been on going for years and seems to be the main one[2] 05/26/23(?) Datetimes in EXIF metadata are cursed [0] https://github.com/immich-app/immich/discussions/2581 https://github.com/immich-app/immich/discussions/2581 [1] https://github.com/immich-app/immich/issues/6623 https://github.com/immich-app/immich/issues/6623 [2] https://github.com/immich-app/immich/discussions/12292 https://github.com/immich-app/immich/discussions/12292
- a96 1y ago
  Datetimes in general have have a tendency to be cursed. Even when they work, something adjacent is going to blow up sooner or later. Especially if it relies on timezones or DST being in the value.
qdw 1y ago
One of their line items complains about being unable to bind 65k PostgreSQL placeholders (the linked post calls them "parameters") in a single query. This is a cursed idea to begin with, so I can't fully blame PostgreSQL. From the linked GitHub issue comments, it looks like they adopted the sensible approach of refactoring their ORM so that it splits the big query into several smaller queries. Anecdotally, I've found 3,000 to 5,000 rows per write query to be a good ratio. Someone else suggested first loading the data into a temp table and then joining against that, which would have further improved performance, especially if they wrote it as a COPY … FROM. But the idea was scrapped (also sensibly) for requiring too many app code changes. Overall, this was quite an illuminating tome of cursed knowledge, all good warnings to have. Nicely done!
- e1g 1y ago
  Another strategy is to pass your values as an array param (e.g., text[] or int[] etc) - PG is perfectly happy to handle those. Using ANY() is marginally slower than IN(), but you have a single param with many IDs inside it. Maybe their ORM didn’t support that.
- fdr 1y ago
  that also popped out at me: binding that many parameters is cursed. You really gotta use COPY (in most cases). I'll give you a real cursed Postgres one: prepared statement names are silently truncated to NAMEDATALEN-1. NAMEDATALEN is 64. This goes back to 2001...or rather, that's when NAMEDATALEN was increased in size from 32. The truncation behavior itself is older still. It's something ORMs need to know about it -- few humans are preparing statement names of sixty-plus characters.
  - antonvs 1y ago
    > few humans are preparing statement names of sixty-plus characters. Java developers: hold my beer
    - eadmund 1y ago
      Hey, if I don’t name this class AbstractBeanFactoryVisitorCommandPatternImplementorFactoryFactoryFactorySlapObserver how would you know what it does?
joshdavham 1y ago
This is awesome! Does anyone else wanna share some of the cursed knowledge they've picked up? For me, MacOS file names are cursed: 1. Filenames in MacOS are case-INsensitive, meaning file.txt and FILE.txt are equivalent 2. Filenames in MacOS, when saved in NFC, may be converted to NFD
- mdaniel 1y ago
  1 is only true by default, both HFS and APFS have case sensitive options . NTFS also behaves like you described, and I believe the distinction is that the filesystems are case-retentive, so this will work fine: $ echo yup > README.txt $ cat ReAdMe.TXT yup $ ls README.txt Maybe the cursed version of the filesystem story is that goddamn Steam refuses to install on the case sensitive version of the filesystem, although Steam has a Linux version. Asshats
- qingcharles 1y ago
  I created one of the first CDDBs in 1995 when Windows 95 was in beta. It came with a file, IIRC, cdplayer.ini, that contained all the track names you'd typed in from your CDs. I put out requests across the Net, mostly Usenet at the time, and people sent me their track listings and I would put out a new file every day with the new additions. Until I hit 64KB which is the max size of an .ini file under Windows, I guess. And that was the end of that project.
- burnt-resistor 1y ago
  Yep. Create a case-sensitive APFS or HFS+ volume for system or data, and it guarantees problems.
  - nothrabannosir 1y ago
    I’ve done this with my main drive for the last ten or so years and run into not a single problem. I recommend it.
    - burnt-resistor 1y ago
      Then you don't use Time Machine, Migration Assistant, cmake, or a host of other development and systems tools that don't work correctly on case-sense APFS volumes. Sorry, but this is terrible advice unsuitable for all audiences. It might seem to work for now but it's walking in a minefield of nonstandard configuration that could bite anytime in the future. https://forums.macrumors.com/threads/does-anyone-else-use-a-case-sensitive-apfs-drive-format-if-yes-why.2443749/ https://forums.macrumors.com/threads/does-anyone-else-use-a-... https://forums.macrumors.com/threads/heads-up-currently-impossible-to-use-migration-assistant-to-migrate-a-2019-mbp-case-sensitive-apfs-formatted-hard-drive-to-m3-mba.2443495/?post=33583322#post-33583322 https://forums.macrumors.com/threads/heads-up-currently-impo... https://apple.stackexchange.com/questions/474537/time-machine-transfer-case-sensitive-file-systems https://apple.stackexchange.com/questions/474537/time-machin... https://gitlab.kitware.com/cmake/cmake/-/issues/26333 https://gitlab.kitware.com/cmake/cmake/-/issues/26333
binary132 1y ago
This would be a fun github repo. Kind of like Awesome X, but Cursed.
csours 1y ago
You can load Java Classes into Oracle DB and run them natively inside the server. Those classes can call stored procedures or functions. Those classes can be called BY stored procedures or functions. You can call stored procedures and functions from server-side Java code. So you can have a java app call a stored proc call a java class call a stored proc ... Yes. Yes, this is why they call it Legacy.
- mdaniel 1y ago
  That's ok, modern nodejs apps are represented, too, so everyone can get in on the legacy train: https://docs.oracle.com/en/database/oracle/oracle-database/23/mlejs/using-javascript-modules-mle.html#GUID-0E40C6C1-3458-40EB-A81C-DC11885C2D24 https://docs.oracle.com/en/database/oracle/oracle-database/2... and https://docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Extensions.html#AuroraPostgreSQL.Extensions.17:~:text=plv8 https://docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQ... or, if the modern job postings are indicative, FastAPI to PG to PY https://www.postgresql.org/docs/17/plpython-funcs.html https://www.postgresql.org/docs/17/plpython-funcs.html
tonyhart7 1y ago
ok but this one is not cursed tho (https://github.com/immich-app/immich/discussions/11268 https://github.com/immich-app/immich/discussions/11268) its valid privacy and security on how mobile OS handle permission
- account42 1y ago
  It is cursed because now the photo management app needs to ask for the permission to constantly track you instead of only getting location of a limited set of past points where you specifically chose to take a photo. Besides giving malicious photo app developers an excuse for these permissions, it also contributes to permission fatigue by training to give random applications wide permissions.
maxbond 1y ago
> Fetch requests in Cloudflare Workers use http by default, even if you explicitly specify https, which can often cause redirect loops. This is whack as hell but doesn't seem to be the default? This issue was caused by the "Flexible" mode, but the docs say "Automatic" is the default? (Maybe it was the default at the time?) > Automatic SSL/TLS (default) https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ https://developers.cloudflare.com/ssl/origin-configuration/s...
- motorest 1y ago
  > This is whack as hell but doesn't seem to be the default? I don't think so. If you read about what Flexible SSL means, you are getting exactly what you are asking for. https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/flexible/ https://developers.cloudflare.com/ssl/origin-configuration/s... Here is a direct quote of the recommendation on how this feature was designed to be used: > Choose this option when you cannot set up an SSL certificate on your origin or your origin does not support SSL/TLS. Furthermore, Cloudflare's page on encryption modes provides this description of their flexible mode. > Flexible : Traffic from browsers to Cloudflare can be encrypted via HTTPS, but traffic from Cloudflare to the origin server is not. This mode is common for origins that do not support TLS, though upgrading the origin configuration is recommended whenever possible. So, people go out of their way to set an encryption mode that was designed to forward requests to origin servers that do not or cannot support HTTPS connections, and then are surprised those outbound connections to their origin servers are not HTTPS.
  - maxbond 1y ago
    I get that it's a compatibility workaround (I did look at the docs before posting) but it's a.) super dangerous and b.) apparently was surprising to the authors of this post. I'm gunnuh keep describing "communicate with your backend in plain text and get caught in infinite redirect loops mode" whack but reasonable people may disagree. I would like to know how this setting got enabled, however. And I don't think the document should describe it as a "default" if it isn't one.
    - 1y ago
egruy 1y ago
Reminds me a lot of phenomenal Hadoop and Kerberos: Madness beyond the gates[1], which coincidentally saved me many times from madness. Thanks Steve, I can't fathom what you had to go through to get the cursed knowledge! 1 - https://steveloughran.gitbooks.io/kerberos_and_hadoop/content/ https://steveloughran.gitbooks.io/kerberos_and_hadoop/conten...
qbane 1y ago
Love to see this concept condensed! This kind of knowledge will only emerge only after you dive in your project and surprisingly find things do not work as thought (inevitable if the project is niche enough). Will keep a list like that for every future project.
Ygg2 1y ago
Why is the YAML part cursed? They serialize to same string, no? Both [1] and [2] serialize to identical strings. This seems like the ancient YAML 1.1 parser curse strikes again. [1] https://play.yaml.io/main/parser?input=ICAgICAgdGVzdDogPi0KICAgICAgICBwZ19pc3JlYWR5IC0tZGJuYW1lPSIkJHtQT1NUR1JFU19EQn0iIC0tdXNlcm5hbWU9IiQke1BPU1RHUkVTX1VTRVJ9IiB8fCBleGl0IDE7CiAgICAgICAgQ2hrc3VtPSIkJChwc3FsIC0tZGJuYW1lPSIkJHtQT1NUR1JFU19EQn0iIC0tdXNlcm5hbWU9IiQke1BPU1RHUkVTX1VTRVJ9IiAtLXR1cGxlcy1vbmx5IC0tbm8tYWxpZ24KICAgICAgICAtLWNvbW1hbmQ9J1NFTEVDVCBDT0FMRVNDRShTVU0oY2hlY2tzdW1fZmFpbHVyZXMpLCAwKSBGUk9NIHBnX3N0YXRfZGF0YWJhc2UnKSI7CiAgICAgICAgZWNobyAiY2hlY2tzdW0gZmFpbHVyZSBjb3VudCBpcyAkJENoa3N1bSI7CiAgICAgICAgWyAiJCRDaGtzdW0iID0gJzAnIF0gfHwgZXhpdCAx https://play.yaml.io/main/parser?input=ICAgICAgdGVzdDogPi0KI... [2]https://play.yaml.io/main/parser?input=ICAgICAgdGVzdDogPi0KICAgICAgICBwZ19pc3JlYWR5IC0tZGJuYW1lPSIkJHtQT1NUR1JFU19EQn0iIC0tdXNlcm5hbWU9IiQke1BPU1RHUkVTX1VTRVJ9IiB8fCBleGl0IDE7IENoa3N1bT0iJCQocHNxbCAtLWRibmFtZT0iJCR7UE9TVEdSRVNfREJ9IiAtLXVzZXJuYW1lPSIkJHtQT1NUR1JFU19VU0VSfSIgLS10dXBsZXMtb25seSAtLW5vLWFsaWduIC0tY29tbWFuZD0nU0VMRUNUIENPQUxFU0NFKFNVTShjaGVja3N1bV9mYWlsdXJlcyksIDApIEZST00gcGdfc3RhdF9kYXRhYmFzZScpIjsgZWNobyAiY2hlY2tzdW0gZmFpbHVyZSBjb3VudCBpcyAkJENoa3N1bSI7IFsgIiQkQ2hrc3VtIiA9ICcwJyBdIHx8IGV4aXQgMQ== https://play.yaml.io/main/parser?input=ICAgICAgdGVzdDogPi0KI...
Havoc 1y ago
One can really sense the pain just reading the headings Also a crypto library that limits passwords to 72 bytes? That’s wild
- AstralStorm 1y ago
  It's written with constant memory allocation in mind. Silly of them to use such a small buffer though, make it a configuration option.
  - nothrabannosir 1y ago
    I assumed all hashes are in O(1) space? Is there any that’s not?
  - mras0 1y ago
    No, it's due to the construction of bcrypt - it ends up using the password more or less directly as the key for blowfish (the underlying cipher) which is why the limit is there. Check wikipedia for details.
burnt-resistor 1y ago
Install an SP3 or TR4 socketed CPU in a dusty, dirty room without ESD precautions and crank the torque on the top plate and heat sink like truck lug nuts until creaking and cracking noises of the PCB delaminating are noticeable. Also be sure to sneeze on the socket's chip contacts and clean it violently with an oily and dusty microfiber cloth to bend every pin. c. 2004 and random crap on eBay: DL380 G3 standard NICs plus Cisco switches with auto speed negotiation on both sides have built-in chaos monkey duplex flapping. Google's/Nest mesh Wi-Fi gear really, really enjoys being close together so much that it offers slower speeds than simply 1 device. Not even half speed, like dial-up before 56K on random devices randomly.
stogot 1y ago
This is the best thing I’ve read on hacker news all year
hiAndrewQuinn 1y ago
>The bcrypt implementation only uses the first 72 bytes of a string. Any characters after that are ignored. Is there any good reason for this one in particular?
- mras0 1y ago
  bcrypt is based on the blowfish cipher which "only" support keys up to 576 bits (72 bytes) in length (actually only 448 bits as spec'ed). Wikipedia has all the details.
physicles 1y ago
Back in 2011, I wasted an entire afternoon on some string handling code that was behaving very strangely (I don’t remember exactly what the code was). It wasn’t until I loaded the content into a hex editor that I learned about U+00A0, the non-breaking space. Looks like a space, but isn’t.
- mdaniel 1y ago
  Ah, yes, the 90s html was jam packed with   (aka ) to make things not wrap, and that was stellar good fun for copy-pasting The other "2020s" problem is some leading unicode marks which are also invisible. I thought it was BOM but those do seem to show up to cat but just a few weeks ago I had a file from a vendor's site that wouldn't parse but that both cat and vim said was fine, only to find the wtf? via the almighty xxd
phreack 1y ago
Love this. I seem to find a new one every day maintaining an Android app with millions of users. We like to call them "what will we tell the kids" moments. It's a great idea to write them down, I'll probably start doing it!
zzo38computer 1y ago
> Zitadel is cursed because its custom scripting feature is executed with a JS engine that doesn't support regex named capture groups. I think sufficiently old version of JavaScript will not have it. It does not work on my computer either. (You should (if you had not already) report this to whoever maintains that program, in order to fix this, if you require that feature.) > Git can be configured to automatically convert LF to CRLF on checkout and CRLF breaks bash scripts. Can you tell git that the bash script is a binary file and therefore should not automatically convert the contents of the file? > Fetch requests in Cloudflare Workers use http by default, even if you explicitly specify https, which can often cause redirect loops. Is that a bug in Cloudflare? That way of working does not make sense; it should use the protocol you specify. (I also think that HTTP servers should not generally automatically redirect to HTTPS, but that is a different problem. Still, since it does that it means that this bug is more easily found.) (Also, X.509 should be used for authentication, which avoids the problem of accidentally authenticating with an insecure service (or with the wrong service), since that would make it impossible to do.) > There is a user in the JavaScript community who goes around adding "backwards compatibility" to projects. They do this by adding 50 extra package dependencies to your project, which are maintained by them. It is a bad idea to add too many dependencies to your project, regardless of that specific case. > The bcrypt implementation only uses the first 72 bytes of a string. Any characters after that are ignored. There is a good reason to have a maximum password length (to avoid excessive processing due to a too long password), although the maximum length should still be sufficiently long (maybe 127 bytes is good?), and it should be documented and would be better if it should be known when you try to set the password. > Some web features like the clipboard API only work in "secure contexts" (ie. https or localhost) I think that "secure contexts" is a bad idea. I also think that these features should be controlled by user settings instead, to be able to disable and otherwise configure them.
- mdaniel 1y ago
  > Can you tell git that the bash script is a binary file and therefore should not automatically convert the contents of the file? That'd be swatting a fly with a sledgehammer; if you do that, $(git diff) will no longer work which smells important for shell scripts that evolve over time. But I think you were in the right ballpark in that .gitattributes is designed for helping it understand the behavior you wish with eol=lf just for either that file or *.sh *.bash etc https://git-scm.com/docs/gitattributes#Documentation/gitattributes.txt-Settostringvaluelf https://git-scm.com/docs/gitattributes#Documentation/gitattr...
mitioshi 1y ago
What a cool idea to have such page for a project. I wish more open source projects adopted this. It's always interesting to read how people resolved complex problems

518 points by bqmjjx0kac 1y ago

The '50 extra packages' one is wild. The author of those packages has racked up a fuckload of downloads. What a waste of total bandwidth and disk space everywhere. I wonder if it's for clout.

deleted 1y ago
[deleted]
Centigonal 1y ago
It's probably a clout thing, or just a weird guy (Hanlon's Razor), but a particularly paranoid interpretation is that this person is setting up for a massive, multi-pronged software supplychain attack.
- deleted 1y ago
  [deleted]
- godelski 1y ago
  Those don't have to be mutually exclusive. Often those with clout are targeted for supplychain attacks. Take xz as an example. Doesn't seem unreasonable that a solo dev or small team looks to either sell their projects or transfer them to someone else (often not even with money exchanging hands). Or even how old social media accounts are hacked so that they can appear as legitimate accounts. I'm big on Hanlon's Razor too, but that doesn't mean the end result can't be the same.
- motorest 1y ago
  > (...) but a particularly paranoid interpretation is that this person is setting up for a massive, multi-pronged software supplychain attack. That person might not be doing it knowingly or on purpose, but regardless of motivations that is definitely what is being done.
  - whilenot-dev 1y ago
    A package "for-each"[0] that depends on a package "is-callable"[1], just to make forEach work on objects? Nope, not buying the goodwill here. [0]: https://www.npmjs.com/package/for-each https://www.npmjs.com/package/for-each [1]: https://www.npmjs.com/package/is-callable https://www.npmjs.com/package/is-callable
    - whilenot-dev 1y ago
      To be fair, he himself removed his unnecessary dependency that caused the explosion of dependencies: https://github.com/A11yance/aria-query/commit/ee003d2af54b6bc49a7aba231fedfd0f8b2c8610 https://github.com/A11yance/aria-query/commit/ee003d2af54b6b... EDIT: Oops, he just did the changelog entry. The actual fix was done by someone else: https://github.com/A11yance/aria-query/commit/f5b8f4c9001ba7c7efd20fe6d76bb578c2723de3 https://github.com/A11yance/aria-query/commit/f5b8f4c9001ba7...
    - motorest 1y ago
      Older browsers don't support foreach, so it's not like a polyfill is unheard of https://caniuse.com/?search=foreach https://caniuse.com/?search=foreach
      - whilenot-dev 1y ago
        Are you serious here? It isn't a polyfill, it's supposed to work on plain objects which isn't part of the spec at all. Besides that, Array.prototype.forEach is only unsupported in Android Browser 4.3 (from July 2013) and IE8 (from May 2008). Seems like a weird reasoning to add it to packages in 2025.
        motorest 1y ago
        > Are you serious here? I am. If you check the definition of polyfill, you'll eventually arrive at something like the following: > A polyfill is a piece of code (usually JavaScript on the Web) used to provide modern functionality on older browsers that do not natively support it. https://developer.mozilla.org/en-US/docs/Glossary/Polyfill https://developer.mozilla.org/en-US/docs/Glossary/Polyfill I think we would agree that foreach fits the definition, happy path, and whole purpose of a polyfill. if you read up on forEach, you will notice that Array.prototype.forEach requires objects to be callable. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/forEach https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- nullc 1y ago
  > is setting up for a massive, multi-pronged software supplychain attack The problem with this view is that the JS ecosystem is already doing that all on its own without that particular contributor. (as has the rust ecosystem, which slavishly copied JS' bad practices). Eliminate the one guy and JS is still pervasively vulnerable to these attacks. The polyfills are the least of it, because at least they should be completely stable and could just be copied into projects. Other dependencies not so much.
smitty1e 1y ago
It does raise the idea of managed backward compatibility. Especially if you could control at install time just how far back to go, that might be interesting. Also an immediately ridiculous graph problem for all but trivial cases.
fastball 1y ago
The author is almost certainly ljharb.
- 0x696C6961 1y ago
  I'm convinced he's a rage baiting account. No-one can consistently have such bad takes.
  - antonvs 1y ago
    Your faith in humanity exceeds mine.
bikeshaving 1y ago
The maintainer who this piece of “cursed knowledge” is referencing is a member of TC39, and has fought and died on many hills in many popular JavaScript projects, consistently providing some of the worst takes on JavaScript and software development imaginable. For this specific polyfill controversy, some people alleged a pecuniary motivation, I think maybe related to GitHub sponsors or Tidelift, but I never verified that claim, and given how little these sources pay I’m more inclined to believe he just really believes in backwards compatibility. I dare not speak his name, lest I incur the wrath of various influential JavaScript figures who are friends with him, and possibly keep him around like that guy who was trained wrong as a joke in Kung Pow: Enter the Fist. In 2025, I’ve moderated my opinion of him; he does do important maintenance work, and it’s nice to have someone who seems to be consistently wrong in the community, I guess.
- titanomachy 1y ago
  This is Wimp Lo! We trained him wrong on purpose, as a joke. Long time since I thought of that movie.
  - deleted 1y ago
    [deleted]
- jddj 1y ago
  Looking forward to this Jia Tan sequel in a few years' time.
- karel-3d 1y ago
  to save everyone else a search, it's probably ljharb. (I am not a member of JS community, so, come and attack me.)
  - sunaookami 1y ago
    Wow that's some deep rabbit hole. This guy gets paid per XY npm downloads and games the system through this. Awful.
deleted 1y ago
[deleted]

bigyabai 1y ago

> Some phones will silently strip GPS data from images when apps without location permission try to access them. That's no curse, it's a protection hex!

Muromec 1y ago
A ward even
mynegation 1y ago
I have no idea what that means but to me it looks like it works as designed.
nulld3v 1y ago
On the other hand, one particular app completely refuses to allow users to remove location information from their photos: https://support.google.com/photos/answer/6153599?hl=en&co=GENIE.Platform%3DAndroid#edit_or_delete_estimated_location https://support.google.com/photos/answer/6153599?hl=en&co=GE...
8organicbits 1y ago
I think this is written unclearly. Looking at the linked issues, the root cause seems to be related to a "all file access" permission, not just fine grained location access. It seems great that an app without location access cannot check location via EXIF, but I'm surprised that "all file access" also gates access to the metadata, perhaps one selected using the picker. https://gitlab.com/CalyxOS/platform_packages_providers_MediaProvider/-/commit/9afa21808923ac04b5edc58853fb16329d986c02 https://gitlab.com/CalyxOS/platform_packages_providers_Media...

g8oz 1y ago

This is awesome. Disappointing to hear about the Cloudflare fetch issue.

doctorpangloss 1y ago
The infallibility of Cloudflare is sacrosanct!
motorest 1y ago
> Disappointing to hear about the Cloudflare fetch issue. You mean the one where explicitly configuring Cloudflare to forward requests to origin servers as HTTP will actually send requests as HTTP? That is not what I would describe as disappointing.
- g8oz 1y ago
  The behavior seems likely to mislead a lot of people even if it doesn't confuse you.
  - motorest 1y ago
    > The behavior seems likely to mislead a lot of people even if it doesn't confuse you. You need to go way out of your way to toggle a switch to enable this feature. The toggle says very prominently "Cloudflare allows HTTPS connections between your visitor and Cloudflare, but all connections between Cloudflare and your origin are made through HTTP." You proceed to enable this feature. Does it confuse you that Cloudflare's requests to your origin servers are HTTP?

worik 1y ago

dd/mm/yyyy date formats are cursed.... Perhaps it is mm/dd/yyyy (really?!?) that is cursed....

hollerith 1y ago
mm.dd.yyyy is cursed, too. The not-cursed options are dd.mm.yyyy and mm/dd/yyyy
- dmd 1y ago
  in what world could mm/dd/yyyy not be cursed!? that makes no sense whatsoever.
  - Izkata 1y ago
    It's the US short form, matching the word-month order we always use for regular dates: "August 7, 2025". Note the slashes are important, we don't use dots or dashes with this order. That's what GP was getting at.
    - dmd 1y ago
      And it makes absolutely no sense. I've lived with it all my life (I'm an American!) and it has never made any sense to me.
      - kstrauser 1y ago
        First, I use ISO8601 for everything. This is not me arguing against it. But, I think the American-style formatting is logical for everyday use. When you're discussing a date, and you're not a historian, the most common reason is that you're making plans with someone else or talking about an upcoming event. That means most dates you discuss on a daily basis will be in the next 12 months. So starting with the month says approximately when in the next year you're talking about, giving the day next says when in that month, and then tacking on the year confirms the common case that you mean the next occurrence of it. When's Thanksgiving? November (what part of the year?) 27 (toward the end of that November), 2025 (this year). It's like answering how many minutes are in a day: 1 thousand, 4 hundred, and 40. You could say 40, 400, and 1000, which is still correct, but everyone's going to look at you weirdly. Answer "2025 (yeah, obviously), the 27th (of this month?) of November (why didn't you start with that?)" is also correct, but it sounds odd. So 11/27/2025 starts with the most useful information and works its way to the least, for the most common ways people discuss dates with others. I get it. It makes since. But I'll still use ISO8601.

LeoPanthera 1y ago

"Some phones will silently strip GPS data from images when apps without location permission try to access them." Uh... good?

steve_adams_86 1y ago
I'm torn. Maybe a better approach would be a prompt saying "you're giving access to images with embedded location data. Do you want to keep the location data in the images, or strip the location data in this application?" I might not want an application to know my current, active location. But it might be useful for it to get location data from images I give it access to. I do think if we have to choose between stripping nothing or always stripping if there's no location access, this is the correct and safe solution.
- Aurornis 1y ago
  > saying "you're giving access to images with embedded location data. Do you want to keep the location data in the images, or strip the location data in this application?" This is a good example of a complex setting that makes sense to the 1% of users who understand the nuances of EXIF embedded location data but confuses the 99% of users who use a product. It would also become a nightmare to manage settings a per-image basis.
  - fc417fc802 1y ago
    Not per-image, it would be per-app. The first time it happened it would ask you. There are already quite a few per-app toggles for things like this so it wouldn't be anything new or particularly surprising. That said, an alternative to bugging the user might be that when the app makes the call to open the file that call should fail unless the app explicitly passes a flag to strip the location data. That way you protect users without causing needless confusion for developers when things that ought to "just work" go inexplicably wrong for them.
a96 1y ago
Kind of. But that means any file that goes through that mechanism may be silently modified. Which is evil.

simpaticoder 1y ago

I loved this the moment I saw it. After looking at an example commit[1], I love it even more. The cursed knowledge entry is committed alongside the fix needed to address it. My first instinct is that every project should have a similar facility. The log is not just cathartic, but turns each frustrating speedbump into a positive learning experience. By making it public, it becomes both a tool for both commiseration and prevention. 1 - https://github.com/savely-krasovsky/immich/commit/aeb5368602db30a8fccc5d804625f9d445f2b89b https://github.com/savely-krasovsky/immich/commit/aeb5368602...

delusional 1y ago
I agree, I usually put this sort of information in the commit message itself. That way it's right there if anybody ever comes across the line and wonders "why did he write this terrible code, can't you just ___".
- motorest 1y ago
  As a side note, it's becoming increasingly important to write down this info in places where LLMs can access it with the right context. Unfortunately commit history is not one of those spots.
  - rf15 1y ago
    You are sadly completely missing the point of ever-self-improving automation. Just also use the commit history. Better yet: don't be a bot slave that is controlled and limited by their tools.
    - motorest 1y ago
      > You are sadly completely missing the point of ever-self-improving automation. Just also use the commit history. I don't think you understand the issue you're commenting on. It's irrelevant whether you can inject commit history in a prompt. The whole point is that today's support for coding assistants does not support this source of data, whereas comments in source files and even README.md and markdown files in ./docs are supported out of the box. If you rely on commit history to provide context to your team members, once they start using LLMs this context is completely ignored and omitted from any output. This means you've been providing context that's useles and doesn't have any impact on future changes. If you actually want to help the project, you need to pay attention on whether your contributions are impactful. Dumping comments into what amounts to /dev/null has no impact whatsoever. Requiring your team to go way out of their way to include in each prompt extra context from a weird source that may or may not be relevant is a sure way to ensure no one uses it.

thorum 1y ago

> npm scripts make a http call to the npm registry each time they run, which means they are a terrible way to execute a health check. Is this true? I couldn’t find another source discussing it. That would be insane behavior for a package manager.

deleted 1y ago
[deleted]
dgoldstein0 1y ago
It might be referring to the check if whether npm is up to date so it can prompt you to update if it isn't?
skacekamen 1y ago
probably an update check? It definitely sometimes shows an update banner
jrasm91 1y ago
https://docs.npmjs.com/cli/v6/using-npm/config#update-notifier https://docs.npmjs.com/cli/v6/using-npm/config#update-notifi... https://github.com/npm/cli/blob/5d82d0b4a4bd1424031fb68b4df740c1bbe5b172/lib/cli/update-notifier.js https://github.com/npm/cli/blob/5d82d0b4a4bd1424031fb68b4df7...

burnt-resistor 1y ago

- Windows' NTFS Alternate Data Streams (ADS) allows hiding an unlimited number of files in already existing files - macOS data forks, xattrs, and Spotlight (md) indexing every single removable volume by default adds tons of hidden files and junk to files on said removable volumes. Solution: mdutil -X /Volumes/path/to/vol - Everything with opt-out telemetry: go, yarn, meilisearch, homebrew, vcpkg, dotnet, Windows, VS Code, Claude Code, macOS, Docker, Splunk, OpenShift, Firefox, Chrome, flutter, and zillions of other corporate abominations

kirici 1y ago
>opt-out telemetry: go By default, telemetry data is kept only on the local computer, but users may opt in to uploading an approved subset of telemetry data to https://telemetry.go.dev https://telemetry.go.dev. To opt in to uploading telemetry data to the Go team, run: go telemetry on To completely disable telemetry, including local collection, run: go telemetry off https://go.dev/doc/telemetry https://go.dev/doc/telemetry
- burnt-resistor 1y ago
  Yep, but you're techsplaining to someone who already know this. But still, it's not opt-in. It's always on by default and litters stuff without asking. All that does is create a file but that doesn't remove the traces of all the tracking it leaves behind without asking. This fixes it in a oneliner: # mac, bsd, linux, and wsl only (d="${XDG_CONFIG_HOME:-$HOME/.config}/go/telemetry";rm -rf "$d";mkdir -p "$d"&&echo off>"$d/mode")
  - kirici 1y ago
    Like television and telephone, the "tele" (remote) part is the crucial and defining one. Without it, it's just metry.
TheBicPen 1y ago
Opt-out telemetry is the only useful kind of telemetry

godelski 1y ago

Looks like they're missing one. I'm pretty sure the discussion goes further back[0,1] but this one has been on going for years and seems to be the main one[2] 05/26/23(?) Datetimes in EXIF metadata are cursed [0] https://github.com/immich-app/immich/discussions/2581 https://github.com/immich-app/immich/discussions/2581 [1] https://github.com/immich-app/immich/issues/6623 https://github.com/immich-app/immich/issues/6623 [2] https://github.com/immich-app/immich/discussions/12292 https://github.com/immich-app/immich/discussions/12292

a96 1y ago
Datetimes in general have have a tendency to be cursed. Even when they work, something adjacent is going to blow up sooner or later. Especially if it relies on timezones or DST being in the value.

qdw 1y ago

One of their line items complains about being unable to bind 65k PostgreSQL placeholders (the linked post calls them "parameters") in a single query. This is a cursed idea to begin with, so I can't fully blame PostgreSQL. From the linked GitHub issue comments, it looks like they adopted the sensible approach of refactoring their ORM so that it splits the big query into several smaller queries. Anecdotally, I've found 3,000 to 5,000 rows per write query to be a good ratio. Someone else suggested first loading the data into a temp table and then joining against that, which would have further improved performance, especially if they wrote it as a COPY … FROM. But the idea was scrapped (also sensibly) for requiring too many app code changes. Overall, this was quite an illuminating tome of cursed knowledge, all good warnings to have. Nicely done!

e1g 1y ago
Another strategy is to pass your values as an array param (e.g., text[] or int[] etc) - PG is perfectly happy to handle those. Using ANY() is marginally slower than IN(), but you have a single param with many IDs inside it. Maybe their ORM didn’t support that.
fdr 1y ago
that also popped out at me: binding that many parameters is cursed. You really gotta use COPY (in most cases). I'll give you a real cursed Postgres one: prepared statement names are silently truncated to NAMEDATALEN-1. NAMEDATALEN is 64. This goes back to 2001...or rather, that's when NAMEDATALEN was increased in size from 32. The truncation behavior itself is older still. It's something ORMs need to know about it -- few humans are preparing statement names of sixty-plus characters.
- antonvs 1y ago
  > few humans are preparing statement names of sixty-plus characters. Java developers: hold my beer
  - eadmund 1y ago
    Hey, if I don’t name this class AbstractBeanFactoryVisitorCommandPatternImplementorFactoryFactoryFactorySlapObserver how would you know what it does?

joshdavham 1y ago

This is awesome! Does anyone else wanna share some of the cursed knowledge they've picked up? For me, MacOS file names are cursed: 1. Filenames in MacOS are case-INsensitive, meaning file.txt and FILE.txt are equivalent 2. Filenames in MacOS, when saved in NFC, may be converted to NFD

mdaniel 1y ago
1 is only true by default, both HFS and APFS have case sensitive options . NTFS also behaves like you described, and I believe the distinction is that the filesystems are case-retentive, so this will work fine: $ echo yup > README.txt $ cat ReAdMe.TXT yup $ ls README.txt Maybe the cursed version of the filesystem story is that goddamn Steam refuses to install on the case sensitive version of the filesystem, although Steam has a Linux version. Asshats
qingcharles 1y ago
I created one of the first CDDBs in 1995 when Windows 95 was in beta. It came with a file, IIRC, cdplayer.ini, that contained all the track names you'd typed in from your CDs. I put out requests across the Net, mostly Usenet at the time, and people sent me their track listings and I would put out a new file every day with the new additions. Until I hit 64KB which is the max size of an .ini file under Windows, I guess. And that was the end of that project.
burnt-resistor 1y ago
Yep. Create a case-sensitive APFS or HFS+ volume for system or data, and it guarantees problems.
- nothrabannosir 1y ago
  I’ve done this with my main drive for the last ten or so years and run into not a single problem. I recommend it.
  - burnt-resistor 1y ago
    Then you don't use Time Machine, Migration Assistant, cmake, or a host of other development and systems tools that don't work correctly on case-sense APFS volumes. Sorry, but this is terrible advice unsuitable for all audiences. It might seem to work for now but it's walking in a minefield of nonstandard configuration that could bite anytime in the future. https://forums.macrumors.com/threads/does-anyone-else-use-a-case-sensitive-apfs-drive-format-if-yes-why.2443749/ https://forums.macrumors.com/threads/does-anyone-else-use-a-... https://forums.macrumors.com/threads/heads-up-currently-impossible-to-use-migration-assistant-to-migrate-a-2019-mbp-case-sensitive-apfs-formatted-hard-drive-to-m3-mba.2443495/?post=33583322#post-33583322 https://forums.macrumors.com/threads/heads-up-currently-impo... https://apple.stackexchange.com/questions/474537/time-machine-transfer-case-sensitive-file-systems https://apple.stackexchange.com/questions/474537/time-machin... https://gitlab.kitware.com/cmake/cmake/-/issues/26333 https://gitlab.kitware.com/cmake/cmake/-/issues/26333

binary132 1y ago

This would be a fun github repo. Kind of like Awesome X, but Cursed.

csours 1y ago

You can load Java Classes into Oracle DB and run them natively inside the server. Those classes can call stored procedures or functions. Those classes can be called BY stored procedures or functions. You can call stored procedures and functions from server-side Java code. So you can have a java app call a stored proc call a java class call a stored proc ... Yes. Yes, this is why they call it Legacy.

mdaniel 1y ago
That's ok, modern nodejs apps are represented, too, so everyone can get in on the legacy train: https://docs.oracle.com/en/database/oracle/oracle-database/23/mlejs/using-javascript-modules-mle.html#GUID-0E40C6C1-3458-40EB-A81C-DC11885C2D24 https://docs.oracle.com/en/database/oracle/oracle-database/2... and https://docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Extensions.html#AuroraPostgreSQL.Extensions.17:~:text=plv8 https://docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQ... or, if the modern job postings are indicative, FastAPI to PG to PY https://www.postgresql.org/docs/17/plpython-funcs.html https://www.postgresql.org/docs/17/plpython-funcs.html

tonyhart7 1y ago

ok but this one is not cursed tho (https://github.com/immich-app/immich/discussions/11268 https://github.com/immich-app/immich/discussions/11268) its valid privacy and security on how mobile OS handle permission

account42 1y ago
It is cursed because now the photo management app needs to ask for the permission to constantly track you instead of only getting location of a limited set of past points where you specifically chose to take a photo. Besides giving malicious photo app developers an excuse for these permissions, it also contributes to permission fatigue by training to give random applications wide permissions.

maxbond 1y ago

> Fetch requests in Cloudflare Workers use http by default, even if you explicitly specify https, which can often cause redirect loops. This is whack as hell but doesn't seem to be the default? This issue was caused by the "Flexible" mode, but the docs say "Automatic" is the default? (Maybe it was the default at the time?) > Automatic SSL/TLS (default) https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ https://developers.cloudflare.com/ssl/origin-configuration/s...

motorest 1y ago
> This is whack as hell but doesn't seem to be the default? I don't think so. If you read about what Flexible SSL means, you are getting exactly what you are asking for. https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/flexible/ https://developers.cloudflare.com/ssl/origin-configuration/s... Here is a direct quote of the recommendation on how this feature was designed to be used: > Choose this option when you cannot set up an SSL certificate on your origin or your origin does not support SSL/TLS. Furthermore, Cloudflare's page on encryption modes provides this description of their flexible mode. > Flexible : Traffic from browsers to Cloudflare can be encrypted via HTTPS, but traffic from Cloudflare to the origin server is not. This mode is common for origins that do not support TLS, though upgrading the origin configuration is recommended whenever possible. So, people go out of their way to set an encryption mode that was designed to forward requests to origin servers that do not or cannot support HTTPS connections, and then are surprised those outbound connections to their origin servers are not HTTPS.
- maxbond 1y ago
  I get that it's a compatibility workaround (I did look at the docs before posting) but it's a.) super dangerous and b.) apparently was surprising to the authors of this post. I'm gunnuh keep describing "communicate with your backend in plain text and get caught in infinite redirect loops mode" whack but reasonable people may disagree. I would like to know how this setting got enabled, however. And I don't think the document should describe it as a "default" if it isn't one.
  - 1y ago

egruy 1y ago

Reminds me a lot of phenomenal Hadoop and Kerberos: Madness beyond the gates[1], which coincidentally saved me many times from madness. Thanks Steve, I can't fathom what you had to go through to get the cursed knowledge! 1 - https://steveloughran.gitbooks.io/kerberos_and_hadoop/content/ https://steveloughran.gitbooks.io/kerberos_and_hadoop/conten...

qbane 1y ago

Love to see this concept condensed! This kind of knowledge will only emerge only after you dive in your project and surprisingly find things do not work as thought (inevitable if the project is niche enough). Will keep a list like that for every future project.

Ygg2 1y ago

Why is the YAML part cursed? They serialize to same string, no? Both [1] and [2] serialize to identical strings. This seems like the ancient YAML 1.1 parser curse strikes again. [1] https://play.yaml.io/main/parser?input=ICAgICAgdGVzdDogPi0KICAgICAgICBwZ19pc3JlYWR5IC0tZGJuYW1lPSIkJHtQT1NUR1JFU19EQn0iIC0tdXNlcm5hbWU9IiQke1BPU1RHUkVTX1VTRVJ9IiB8fCBleGl0IDE7CiAgICAgICAgQ2hrc3VtPSIkJChwc3FsIC0tZGJuYW1lPSIkJHtQT1NUR1JFU19EQn0iIC0tdXNlcm5hbWU9IiQke1BPU1RHUkVTX1VTRVJ9IiAtLXR1cGxlcy1vbmx5IC0tbm8tYWxpZ24KICAgICAgICAtLWNvbW1hbmQ9J1NFTEVDVCBDT0FMRVNDRShTVU0oY2hlY2tzdW1fZmFpbHVyZXMpLCAwKSBGUk9NIHBnX3N0YXRfZGF0YWJhc2UnKSI7CiAgICAgICAgZWNobyAiY2hlY2tzdW0gZmFpbHVyZSBjb3VudCBpcyAkJENoa3N1bSI7CiAgICAgICAgWyAiJCRDaGtzdW0iID0gJzAnIF0gfHwgZXhpdCAx https://play.yaml.io/main/parser?input=ICAgICAgdGVzdDogPi0KI... [2]https://play.yaml.io/main/parser?input=ICAgICAgdGVzdDogPi0KICAgICAgICBwZ19pc3JlYWR5IC0tZGJuYW1lPSIkJHtQT1NUR1JFU19EQn0iIC0tdXNlcm5hbWU9IiQke1BPU1RHUkVTX1VTRVJ9IiB8fCBleGl0IDE7IENoa3N1bT0iJCQocHNxbCAtLWRibmFtZT0iJCR7UE9TVEdSRVNfREJ9IiAtLXVzZXJuYW1lPSIkJHtQT1NUR1JFU19VU0VSfSIgLS10dXBsZXMtb25seSAtLW5vLWFsaWduIC0tY29tbWFuZD0nU0VMRUNUIENPQUxFU0NFKFNVTShjaGVja3N1bV9mYWlsdXJlcyksIDApIEZST00gcGdfc3RhdF9kYXRhYmFzZScpIjsgZWNobyAiY2hlY2tzdW0gZmFpbHVyZSBjb3VudCBpcyAkJENoa3N1bSI7IFsgIiQkQ2hrc3VtIiA9ICcwJyBdIHx8IGV4aXQgMQ== https://play.yaml.io/main/parser?input=ICAgICAgdGVzdDogPi0KI...

Havoc 1y ago

One can really sense the pain just reading the headings Also a crypto library that limits passwords to 72 bytes? That’s wild

AstralStorm 1y ago
It's written with constant memory allocation in mind. Silly of them to use such a small buffer though, make it a configuration option.
- nothrabannosir 1y ago
  I assumed all hashes are in O(1) space? Is there any that’s not?
- mras0 1y ago
  No, it's due to the construction of bcrypt - it ends up using the password more or less directly as the key for blowfish (the underlying cipher) which is why the limit is there. Check wikipedia for details.

burnt-resistor 1y ago

Install an SP3 or TR4 socketed CPU in a dusty, dirty room without ESD precautions and crank the torque on the top plate and heat sink like truck lug nuts until creaking and cracking noises of the PCB delaminating are noticeable. Also be sure to sneeze on the socket's chip contacts and clean it violently with an oily and dusty microfiber cloth to bend every pin. c. 2004 and random crap on eBay: DL380 G3 standard NICs plus Cisco switches with auto speed negotiation on both sides have built-in chaos monkey duplex flapping. Google's/Nest mesh Wi-Fi gear really, really enjoys being close together so much that it offers slower speeds than simply 1 device. Not even half speed, like dial-up before 56K on random devices randomly.

stogot 1y ago

This is the best thing I’ve read on hacker news all year

hiAndrewQuinn 1y ago

>The bcrypt implementation only uses the first 72 bytes of a string. Any characters after that are ignored. Is there any good reason for this one in particular?

mras0 1y ago
bcrypt is based on the blowfish cipher which "only" support keys up to 576 bits (72 bytes) in length (actually only 448 bits as spec'ed). Wikipedia has all the details.

physicles 1y ago

Back in 2011, I wasted an entire afternoon on some string handling code that was behaving very strangely (I don’t remember exactly what the code was). It wasn’t until I loaded the content into a hex editor that I learned about U+00A0, the non-breaking space. Looks like a space, but isn’t.

mdaniel 1y ago
Ah, yes, the 90s html was jam packed with   (aka ) to make things not wrap, and that was stellar good fun for copy-pasting The other "2020s" problem is some leading unicode marks which are also invisible. I thought it was BOM but those do seem to show up to cat but just a few weeks ago I had a file from a vendor's site that wouldn't parse but that both cat and vim said was fine, only to find the wtf? via the almighty xxd

phreack 1y ago

Love this. I seem to find a new one every day maintaining an Android app with millions of users. We like to call them "what will we tell the kids" moments. It's a great idea to write them down, I'll probably start doing it!

zzo38computer 1y ago

> Zitadel is cursed because its custom scripting feature is executed with a JS engine that doesn't support regex named capture groups. I think sufficiently old version of JavaScript will not have it. It does not work on my computer either. (You should (if you had not already) report this to whoever maintains that program, in order to fix this, if you require that feature.) > Git can be configured to automatically convert LF to CRLF on checkout and CRLF breaks bash scripts. Can you tell git that the bash script is a binary file and therefore should not automatically convert the contents of the file? > Fetch requests in Cloudflare Workers use http by default, even if you explicitly specify https, which can often cause redirect loops. Is that a bug in Cloudflare? That way of working does not make sense; it should use the protocol you specify. (I also think that HTTP servers should not generally automatically redirect to HTTPS, but that is a different problem. Still, since it does that it means that this bug is more easily found.) (Also, X.509 should be used for authentication, which avoids the problem of accidentally authenticating with an insecure service (or with the wrong service), since that would make it impossible to do.) > There is a user in the JavaScript community who goes around adding "backwards compatibility" to projects. They do this by adding 50 extra package dependencies to your project, which are maintained by them. It is a bad idea to add too many dependencies to your project, regardless of that specific case. > The bcrypt implementation only uses the first 72 bytes of a string. Any characters after that are ignored. There is a good reason to have a maximum password length (to avoid excessive processing due to a too long password), although the maximum length should still be sufficiently long (maybe 127 bytes is good?), and it should be documented and would be better if it should be known when you try to set the password. > Some web features like the clipboard API only work in "secure contexts" (ie. https or localhost) I think that "secure contexts" is a bad idea. I also think that these features should be controlled by user settings instead, to be able to disable and otherwise configure them.

mdaniel 1y ago
> Can you tell git that the bash script is a binary file and therefore should not automatically convert the contents of the file? That'd be swatting a fly with a sledgehammer; if you do that, $(git diff) will no longer work which smells important for shell scripts that evolve over time. But I think you were in the right ballpark in that .gitattributes is designed for helping it understand the behavior you wish with eol=lf just for either that file or *.sh *.bash etc https://git-scm.com/docs/gitattributes#Documentation/gitattributes.txt-Settostringvaluelf https://git-scm.com/docs/gitattributes#Documentation/gitattr...

mitioshi 1y ago

What a cool idea to have such page for a project. I wish more open source projects adopted this. It's always interesting to read how people resolved complex problems