nhumrich

9 ms·

91.
by nhumrich 2y ago
It's very good in other ways, but I do enjoy that it's a CLI tool and not a full fledged editor.
92.
by nhumrich 2y ago
I love the idea of datastar, but wonder how does one test it without using e2e testing? Also, I think it would be amazing and so much simpler if instead of using SSE, it just included all the events in a response. Maybe with SSE as an optio
93.
by nhumrich 2y ago
Then dont teach them t-strings
94.
by nhumrich 2y ago
Yes, which is essentially how SQLalchemy works today. You can still put strings in the context though, so for more complex things, it's turtles all the way down. Also, as f-srrings are more ergonomic, people now reach for them, even w
95.
by nhumrich 2y ago
yes, it does actually need syntax support. In order for it to work, you need to preserve which parts of the string are static (hard coded) and which parts are dynamic (likely user input). Which you can only do at a syntax level. You could p
96.
by nhumrich 2y ago
You cant process an f-string the same way you can process a t-string. An f-string does not preserve which parts of it are static and dynamic, which you need to know to properly escape user input.
97.
by nhumrich 2y ago
Your example is a bit too simple. What I mean by that is, you have hardcoded your function to inject a specific part of your string. But t-strings allow you to write the full query `t'select * from table where name = {name}'` dire
98.
by nhumrich 2y ago
Good for you.
99.
by nhumrich 2y ago
Correct. Intended for library authors to do that. A SQL library, for example, could accept a template type and mitigate against SQL injection for you.
100.
by nhumrich 2y ago
PEP 501 when originally written (not by me) was intended to be the competing standard against f-strings, and to have been more inline with ES6's template strings. There was debate between the more simple f-string PEP (PEP 498) and PEP
101.
by nhumrich 2y ago
No. Not really intended to be a replacement for jinja. But it also depends on how you use jinja. If you use only very basic functionality of jinja, maybe.
102.
by nhumrich 2y ago
yes. t-strings are not `str`
103.
by nhumrich 2y ago
Yes. Only if your dev remembers to use sanatized all the time. This is how most SQL works today. You could also forget and accidentally write a f-string, or because you dont know. But with t-strings you can actually prevent unsanatized inpu
104.
by nhumrich 2y ago
f-strings immediately become a string, and are "invisible" to the runtime from a normal string. t-strings introduce an object so that libraries can do custom logic/formatting on the template strings, such as decided _how_ to
105.
by nhumrich 2y ago
One solution that existed for a while was using the `!` operator for deferred. `t!'my defered {str}'` The main reason for non having deferred evaluation was that it over-complicated the feature quite a bit and introduces a rune. D
106.
by nhumrich 2y ago
All discussion on PEP's happens in public forums where anyone can opine on things before they are accepted. I agree that the experts are more likely to participate in this exchange. And while this is wish-washy, I feel like the process
107.
by nhumrich 2y ago
PEP 501 allowed `.format()` to do this, but discussions on PEP 750 felt that format shouldn't be needed, because when you need a basic format, you should probably just use f-strings. But maybe `__format__` can be added in in a future v
108.
by nhumrich 2y ago
Pretty sure PHP does not have this feature. Can you give me an example?
109.
by nhumrich 2y ago
> You could achieve the same thing with a function returning an f-string no no. > just use a tag type and a sanitisation function that takes a string and returns the type Okay, so you have a `sqlstring(somestring)` function, and the d
110.
by nhumrich 2y ago
There was a very very long discussion on this point alone, and there are a lot of weird edge cases, and led to weird syntax things. The high level idea was to defer lazy eval to a later PEP if its still needed enough. There are a lot of exi
111.
by nhumrich 2y ago
Libraries can enforce only template strings, and properly escape the output. This is already possible in Javascript, and you can completely prevent injection attacks using it. > The developer forgot to interpolate not possible if you en
112.
by nhumrich 2y ago
Nick Humrich here, the author who helped rewrite PEP 501 to introduce t-strings, which was the foundation for this PEP. I am not an author on this accepted PEP, but I know this PEP and story pretty well. Let me know if you have any question
113.
by nhumrich 2y ago
Perhaps performance, multi threading, and static typing are not the #1 things that make a language great. My guess: it's the community.
114.
by nhumrich 2y ago
True, but these things happen very very rarely. Also: 1. Is there anything you can do about it? No? Remove the alert, replace with a "we are down sorry" message. Yes? Then automate that thing. Rinse and repeat after every incide
115.
by nhumrich 2y ago
The difference with dev oncall vs doctor on call is that it is self inflicted. Why are you getting paged? Because you built the system. Either your system isn't resilient enough, or you have noisy alerts. Both are problems you should
116.
by nhumrich 2y ago
Yes, which is what most real world hash tables do. They resize themselves once hash collision is too probable.
117.
by nhumrich 2y ago
Yes because in trademark lawsuits, proving a brand doesn't actually use it/control it, is a very common way for them to lose the trademark.
118.
by nhumrich 2y ago
It's pushed by a teenager and cuts grass?
119.
by nhumrich 2y ago
This is a really good perspective. I appreciate you sharing!
120.
by nhumrich 2y ago
I loved svelte. But svelte5 seems to be a bit of turn off. It's not even the runes. Slots was hands down the best feature of svelte. And they deprecated it I still can't for the life of me figure out how the new way is supposed t

More ›