zaarn

29 ms·

271.
by zaarn 5y ago
There is a few libraries that can do some work around localization and formatting, though IIRC most commonly if you need something translated, you just turn it into a format argument as well. So instead of say "hello {name}", you
272.
by zaarn 5y ago
I suspect no, because there is no mismatch between there being no content length header found by this file and the content header later being discovered by some other part of the code. It'll probably require more digging but I don&#x27
273.
by zaarn 5y ago
UDP Connection Tracking is not well implemented on all routers, more than once I've found that forwarding a UDP port makes that UDP port unavailable for other devices to use.
274.
by zaarn 5y ago
Yes but your router might not interact well with Connection Tracking and UDP port forwards. Especially with such wide range ones. I know more than one case where port forwarding disables connection tracking for UDP on those ports.
275.
by zaarn 5y ago
And the router has a clue about those UDP "sessions"? They're not sessions either, it's just an application declaring that incoming UDP packets with a certain destination port (and optionally destination IP, source IP or
276.
by zaarn 5y ago
MOND, as the article points out, doesn't explain this galaxy, however. So it's a point in favor of CDM, if anything, that we find a galaxy behaving according to standard newtonian dynamics, not the modified version. Doesn't r
277.
by zaarn 5y ago
It's not, Firefox will still check your hosts file to see if it can resolve that way. DoH is used only if using a local-only resolver doesn't work to my knowledge. Otherwise stuff like SMBIOS, Avahi/ZC or mDNS would break too
278.
by zaarn 5y ago
As someone with difficulties telling left and right apart, using Either isn't particularly straight forward. This plus the left and right variant become meaningless on their own. Ie, if I wanted an enum of either a string or an integer
279.
by zaarn 5y ago
No that's not the problem. Google already implemented the feature and made money of it. They do owe royalties to Sonos.
280.
by zaarn 5y ago
Google is not being forced to disable this feature, Google decided to. They could have paid royalties to Sonos for implementing the feature like they did, after all.
281.
by zaarn 5y ago
Some SSH Agents can do that but SSH isn't "aware" of this. From SSH's perspective it's simply taking long and you can timeout your SSH connection with that. For Example, KeepassXC offers this feature to require conf
282.
by zaarn 5y ago
It lacks some desirable properties as chemical warfare agent. For one, it doesn't disperse easily and is even noticable at low concentrations. Meaning if you fill at trench with this, it is likely your own trench will notice it too and
283.
by zaarn 5y ago
Deterministic execution simply requires you remove sources of non-determinism. This is not to be confused with defined vs undefined behaviour, like a program behaving different on another machine. As long as it's behaviour remains cons
284.
by zaarn 5y ago
As I've pointed out a few times now, forking upstream is not a long term or sustainable solution.
285.
by zaarn 5y ago
You're free to experiment, though the ProtonMail team has already responded upthread that this is in fact their SpamFilter.
286.
by zaarn 5y ago
Protonmail also responded in this thread with a message stating that this is in fact their spam filter.
287.
by zaarn 5y ago
Unlikely, spammers tend to get creative to bypass spam filters, it would probably scan anything that looks like a URL or Domain just to see if the IP behind it is sus.
288.
by zaarn 5y ago
Proton is not e2e for mails coming from outside Proton, if they aren't GPG encrypted. And in that case they apply very standard spam filters to your mail.
289.
by zaarn 5y ago
This is likely the spam filter scanning over the Links it finds in the E-Mail not actually something spitting the mail content into log4j (and I mean honestly, why would you even do that?)
290.
by zaarn 5y ago
I have plenty of clues of what slave labor is and big companies exploiting the hard work of people working for free without paying them is definitely pretty damn close.
291.
by zaarn 5y ago
I don't think that is any issue whatsoever, the software engineering world has largely agreed on the usage of the word dependency, doesn't really matter what linguists think. Language is consensus, not thesis papers.
292.
by zaarn 5y ago
How many excludes is Java going to ship is forking the problem of unmaintained libraries away becomes too much? When it reaches 5kb? 10kb? 100kb of excludes?
293.
by zaarn 5y ago
That is not sufficient no. As a user, I want to be able to support developers so they have the time to fix things that go wrong. That the log4j Maintainers are entirely unpaid for maintaining what amounts to the bedrock of the java ecosyste
294.
by zaarn 5y ago
Forking yourself is not scalable for fixing a 10/10CVE and I don't get how people think that somehow "fork it" is a viable solution across the entire industry. This is not about forcing my dependencies to do anything, th
295.
by zaarn 5y ago
My argument is not closed source. My argument is that "just fork it" does not magically fix all problems. Closed source makes this worse but "fork it" is no answer either. I believe I made this very clear on my very firs
296.
by zaarn 5y ago
It does because now I pull in a dependency that indirectly relies on log4j instead of my favorite fork of log4j and I end up having the same CVE in the project anyway. Yes this needs to work ecosystem wide, otherwise you have fixed nothing
297.
by zaarn 5y ago
Correct, all those other people will have to manually find some fork or make their own, repeating the same work thousands of times and ossifying that some part of your java build system now permanently includes a section to patch log4j depe
298.
by zaarn 5y ago
This isn't only about companies, people who develop open source software on their own are just as affected by log4j. Funding and resourcing can at least help people and maybe incentive handing the project to someone else.
299.
by zaarn 5y ago
And when another library is unmaintained and breaks, you add those few lines again. And again and again and again, until your gradle file is 90% hotpatching your dependencies.
300.
by zaarn 5y ago
I argue that if your code gets assigned a 10/10 Severity CVE, then it broke, even if nothing changed. It just broke a while ago. Switching one library is not much work. But if it becomes the standard approach then the first time you fi

More ›