joelellis's comments

joelellis | 4 years ago | on: Backdoored password manager stole data from as many as 29K enterprises

As far as I remember, it was used to pass API requests for third party services (like APNS) through the main Bitwarden servers so Bitwarden's secret keys for these services weren't published, but self-hosters wouldn't have to register and manage their own accounts for these services, which can be complicated and expensive (To get access to APNS you have to pay the $100/yr apple developer subscription and you can only use it for your own apps, so you would have to build and distribute, via the app store or testflight, your own build of the app.

joelellis | 5 years ago | on: Amp: Vi-like terminal editor written in Rust

I heavily disagree with most of this comment. Static linking verses dynamic linking is a trade-off, and despite the shared bandwidth disadvantage and the difficulty of replacing the dependencies of a statically-compiled binary, there are a lot of advantages - primary of which is ease of distribution. Because the binary is mostly self-contained, it's far easier to install, can work in more environments and less likely to break as time passes and the systems around it change. These advantages greatly outweigh the disadvantages when developing g the program, for self-explanatory reasons, but also when distributing it. Many developers in languages where dependencies aren't included within the built asset bundle them anyway when distributing them because of this.

In regards to your second point, I will point you to the oft-linked https://wiki.alopex.li/LetsBeRealAboutDependencies .

Finally, your third point. Although much of the ecosystem is changing at a rapid pace, core and major packages, the ones most directly depended on, have either made very strong commitments towards stability, have a proven track record of having few or no breaking changes or both. Additionally, due to the nature of the package manager (and static linking), it's very easy to freeze the churning sections of the ecosystem for your application, use the important dependencies and even patch bugs you're encountering.

Additionally, the fact that rust's ecosystem is advancing at a rapid pace means that, well, it's advancing at a rapid pace. Most packages are high-quality and useful, and many are hugely advanced from what other languages have to offer, like the serde and regex crates. This reflects on the applications built with these libraries - you're probably heard of ripgrep, originally built almost purely to test the regex crate, or JQL, built on serde_json. There are many more amazing crates than I could possibly mention, and many more software projects like OneSignal's notification systems that showcase the amazing way the projects in the Rust ecosystem have been put together.

In short, most of the downsides that you mentioned are really mostly positives, and these positives do affect the applications a lot. Rust does have negatives, but it has plenty of positives, all of which have very concrete effects.

This is a bit of a wall of text, but your first paragraph irked me. Also, Gimp, OpenOffice and VLC are already huge. I don't use FileZilla, but I would expect similar.

joelellis | 5 years ago | on: Amp: Vi-like terminal editor written in Rust

Multi-cursor editing is the fastest way to accurately modify large amounts of text, especially repetitive text. It's well worth learning for your respective editor. Most other editing methods don't come close, especially in terms of speed.

joelellis | 5 years ago | on: The Norway Problem

The most commonly used parsers only accept valid JSON - including the one included within most JS runtimes (JSON.stringify/parse). VSCode explicitly uses a `jsonc` parser, the only difference being that it strips comments before it parses the JSON. There's also such thing as `json5`, which has a few extra features inspired by ES5. None of them are unquoted strings. I've never come across anything JSON-like with unquoted strings other than YAML, and everything not entirely compliant with the spec has a different name.

joelellis | 5 years ago | on: TailwindCSS v2.0

Something to note: If the update frequency of chrome is too much for you, you can use Firefox ESR [0]. This lets you upgrade major versions less often whilst still getting regular security patches, and it's often used in Linux distros that don't want to ship the latest Firefox.

[0] https://www.mozilla.org/en-US/firefox/enterprise/

joelellis | 5 years ago | on: Compiler for the M language of the French DGFiP

The author explains in the twitter thread (french):

https://twitter.com/DMerigoux/status/1314531302079688709

> The difficulty arose from a constraint on the part of the DGFiP which did not wish to publish, for security reasons, part of the logic of the calculation corresponding to the "multiple liquidations" mechanism. Raphael and I recreated this unpublished part in a new DSL.

> The DGFiP also did not wish to publish its internal test sets. We therefore proceed to the creation of a completely random test set, from the unpublished content, in order to be able to reproduce the validation of Mlang outside the DGFiP.

> A little less than a year after the publication of https://blog.merigoux.ovh/en/2019/12/20/taxes-formal-proofs...., we therefore found a compromise allowing to respect both the 'source code publication obligation, and the security constraints of the DGFiP.

> By allowing us to go to its operating site and confidentially access the source code that it did not wish to publish, the DGFiP has enabled us to find alternative solutions that make the publication of the source code concrete and operational. .

joelellis | 5 years ago | on: Witeboard

Well if you're on linux a second-hand one would be great, given you don't have their drivers (and you do have open ones). I have a Graphire3 6x8.
page 1