lucideer

16 ms·

241.
by lucideer 1y ago
A coping strategy is something you turn to to "cope" with a problem when the underlying cause of your problem is beyond your direct control. If you are in a position to address the underlying cause directly, I've found it to
242.
by lucideer 1y ago
ADHD definitely doesn't help but I don't find there's a direct link between ADHD & why I procrastinate. The why is personal to me & unlikely to be the same for everyone but I find these kinds of tools & strategi
243.
by lucideer 1y ago
I feel like this seemed a plausible strategy when I first read it as a serial procrastinator struggling through university 17 years ago. Now, after many years of applying stuff like this successfully for a couple months only to immediately
244.
by lucideer 1y ago
Another English speaker data point here & I actually read dogshit before I read dgsh.
245.
by lucideer 1y ago
Curious if you're a native English speaker - the "-cide" suffix has a general root meaning of "to kill", which means that words ending in it generally have the opposite connotation to the word with the suffix. E.g.
246.
by lucideer 1y ago
A lot of people outraged by this but ultimately this is good news - the more flagrant & public the technical incompetence of the people putting together these idiotic systems, the easier mass push back will be to foment.
247.
by lucideer 1y ago
Not sure what context you're referring to but we're discussing configuration file formats, not data transports, so I doubt that would be a frequent issue.
248.
by lucideer 1y ago
Understandable. I just checked & JSON5 was just 1 year later but even then it would've taken a lot longer to gain sufficient traction to be well supported.
249.
by lucideer 1y ago
> It's because JSON doesn't have comments. This is a big plus but JSON5 has pretty widespread language library support - probably equal to that of YAML tbh (e.g. Swift has native JSON5 support, I don't know that anyone n
250.
by lucideer 1y ago
I feel like these two tenets - (1) yaml should require quotes & (2) the value in yaml is in recursion/anchors - are fundamentally the opposite of why yaml exists & why people use it. The distinguishing draw of yaml is largely t
251.
by lucideer 1y ago
> a reader with a modicum of ability to connect dots Genuinely, without any snark intended: please presume I'm an idiot here because I fully acknowledge I may be missing something blatantly obvious & am just trying to understa
252.
by lucideer 1y ago
You've used an analogy instead of an example to demonstrate your point: analogies can be helpful for explaining concepts but are rarely accurate enough to prove logical parity. It would be much easier to discuss the merits of your argu
253.
by lucideer 1y ago
> leaks information It would have to leak sensitive information to be "subtracting security", which implies you're relying on timestamp secrecy to ensure your security. This would be one of the "other problems"
254.
by lucideer 1y ago
This. I follow John Burns Murdoch on social media & normally find his work great so I was really surprised that the most egregious "graph crimes" shown in this article were visualisations created by him. I'm risking engag
255.
by lucideer 1y ago
I've read a bunch of these types of takes (though this is definitely one of the better referenced & more comprehensive ones) & there's an aspect I haven't seen raised in the context of the correlation of modern trends
256.
by lucideer 1y ago
> I cannot guarantee You mean you won't guarantee. You could guarantee this if you invested in customer service. Choosing not to do so is a choice.
257.
by lucideer 1y ago
Excellent, excellent article. I do have one (odd) question though. Perhaps I'm in a bubble (or outside of a bubble), but I don't know what the opening premise of this article is talking about. Namely: > There’s been an influx
258.
by lucideer 1y ago
You're at the mercy of the hardware in all cases. You can't do anything without trusting some external party unless you make an apple pie from scratch, but reducing the number of parties needing trusting is usually a good security
259.
by lucideer 1y ago
Because there are fewer actors to trust. In the OS you need to trust (1) the OS vendor, (2) the client vendor & (3) any VPN app or HTTP intermediary that's integrated with OS network APIs. In the client you need only to trust the c
260.
by lucideer 1y ago
Attackers don't need these practices to be normal, they just need them to be common enough (significant minority of)
261.
by lucideer 1y ago
I'm not a Java (nor Kotlin) developer - I've only done a little Java project maintenance & even less Kotlin - I've mainly come at this as a tooling developer for dependency management & vulnerability remediation. But
262.
by lucideer 1y ago
> every time I do `make build` I'm going to assume this is you running this locally to generate releases, presumably for personal projects? If you're building your projects in CI you're not pulling in the same version wi
263.
by lucideer 1y ago
A lot of people use tools like Dependabot which automates updates to the lockfile.
264.
by lucideer 1y ago
> in JS land almost everyone uses lax dependency declarations They do, BUT. Dependency versioning schemes are much more strictly adhered to within JS land than in other ecosystems. PyPi is a mishmash of PEP 440, SemVer, some packages i
265.
by lucideer 1y ago
> NPM is special, in that the exposure is so much higher. NPM is special in the same way as Windows is special when it comes to malware: it's a more lucrative target. However, the issue here is that - unlike Windows - targetting N
266.
by lucideer 1y ago
To clarify (a lot of sibling commenters misinterpreted this too so probably my fault - can't edit my comment now): I'm not referring to mitigations in public repositories (which you're right, are varied, but that's a sep
267.
by lucideer 1y ago
> I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. I see this odd take a lot - the automatic narrowing of the scope of an attack to the single ec
268.
by lucideer 1y ago
> I don't think Apple would be removing UNIX-like tools from macOS even without certification. They know how valuable it is that most developers use their systems. I hope you're right but I'm not as confident. Corporatio
269.
by lucideer 1y ago
Astral did something similar for the Python ecosystem (Rust-inspired tooling built in Rust, replacing a lot of pre-existing - bad - tooling) & the impact has been revolutionary. Python had some of the worst tooling of any popular langua
270.
by lucideer 1y ago
> economically When we're talking about societal public investment - even investment in the private sector - capital cost is a much more constrained consideration than anything related to abstract market "competitiveness&quot

More ›