1. 1

    +1 for intellectual humility, whether that means choosing the simpler design, or taking tone to refactor, or listening to your reviewers.

    -1 for the “ancient chinese proverb”. If I had a nickel every time one of those turned out not only not to exist but to run quite counter to the norms of ancient china…

    1. 1

      Sure, many “ancient Chinese proverbs” probably didn’t originate in ancient China. But it doesn’t matter, it’s just a meme. In Star Trek, Spock claims “only Nixon could go to China” is an “old Vulcan proverb.” Obviously it’s not, it’s just funny.

      And proverbs don’t have to reflect cultural norms. “An apple a day keeps the doctor away” is one of the most well known proverbs in the US, but I don’t know a single person who actually eats an apple a day.

    1. 11

      Wow, that’s almost as expensive as the Dygma Raise, but for a more basic, non-split board…

      wait. It has a USB 3.2 Gen 2 hub. With two Type C ports for plugging devices in, i.e. not counting the port for the computer. That definitely makes it much more valuable than expected, as true USB-C hubs (as in, not just C-to-many-A, but to-many-C) are still super rare.

      1. 4

        I don’t get it. Wouldn’t it be better to use an external hub, so you can upgrade it when the USB standard will change again?

        1. 2

          C-to-many-C won’t give you enough current. Since it’s shared with your keyboard, you don’t even want to jam the signal with any high throughput stuff. So it’s practically useless, especially on a keyboard.

          1. 8

            Your claims sound bogus to me but I have nothing concrete to dispute them. But I do use my keyboard+mouse through a USB hub and never noticed any issues even when reading data full speed from a USB SSD on the same hub.

            1. 2

              The maximum is still 900 mA going down. SSDs typically use less power than HDDs. My HDD draws near 900 mA, and it doesn’t work well with anything else on a same hub.

            2. 5

              From a naive search on internet, USB-C seems to be capable of quite enough to handle high throughput stuff:

              USB 3.2, released in September 2017, replaces the USB 3.1 standard. It preserves existing USB 3.1 SuperSpeed and SuperSpeed+ data modes and introduces two new SuperSpeed+ transfer modes over the USB-C connector using two-lane operation, with data rates of 10 and 20 Gbit/s (1 and ~2.4 GB/s).

              https://en.wikipedia.org/wiki/USB-C

              I’m not sure what you mean by jamming the signal as even with keyboard + mouse + external SSD + 1G Ethernet cable, we’d be far from 10Gbps possible with 1 single USB-C cable.

          1. 19

            I really dislike the containers == performance meme. Containers on Linux have never been about performance. They were designed for packing as many jobs into each machine as possible. With enough machines, reducing overhead is worth the performance hit.

            VMs can’t share physical memory without invasive changes in the guest OS. And the guest OS itself has its own memory overhead. Containers solve these problems, at the expense of stressing scalability of the host OS internal data structures and mechanisms.

            Unless job packing saves you enough resources to hire at least one engineer to manage whatever orchestrator you choose, containers just add operational overhead.

            If containers make sense for your developer productivity, that’s great. Modern tooling affords plenty of conveniences. But they offer most people nothing for performance or scalability.

            1. 5

              I really dislike the containers == performance meme. Containers on Linux have never been about performance. They were designed for packing as many jobs into each machine as possible. With enough machines, reducing overhead is worth the performance hit.

              FWIW, I’ve never heard of this meme, and this idea runs contrary to almost every performance test we’ve done at $WORK while containerizing our microservices. Yes, putting multiple docker containers on a single box does provide a nice benefit (though there’s nothing stopping you from shipping multiple static binaries and managing them through a service manager), but this is just a bit of an extension to Amdahl’s Law, where you’re still limited by other factors on the box.

              At least with the folks I’ve talked to, containers have always been an ergonomic benefit, one often taken at the expense of some performance. At $WORK, we thoroughly performance test containers to see if the degradation is actually worth it for a given microservice .

              1. 4

                Containers are wonderful from an ops perspective where you can focus on putting software “somewhere” because it’s nicely contained.

                1. 20

                  The big problem is that ‘containers’ overload a bunch of loosely-related things:

                  • The abstract idea of a program, its configuration, and its dependencies all packaged together.
                  • The concrete representation of that abstraction as a distribution format created from a bunch of composed layers.
                  • A mechanism for building things in that format.
                  • A set of isolation mechanisms for running things distributed in that format.

                  The last bit is particularly bad because it’s completely different on different platforms. On Linux, it uses namespaces + cgroups + seccomp + string + duct tape + prayer. On macOS it use xhyve on top of the hypervvisor framework. On Windows it uses Hyper-V. On FreeBSD it uses jails or bhyve. These have very different performance characteristics. The original motivation for jails was that there would be less overhead from being able to share kernel services than start an entire new copy of the kernel, but the most recent versions of jails support having a separate copy of the network stack per jail because contention in the network stack was making it slower to run large numbers of jails than to run separate VMs. With memory ballooning / hot-plug, it’s quite feasible to spin up a load of VMs and have them dynamically adapt the amount of memory that they have. With modern container-optimised VM systems, each VM is actually a copy-on-write snapshot of a single image and so shares a load of kernel memory that doesn’t change between runs.

                  The building mechanism is a somewhat unfortunate conflation because people often mean ‘Docker’, which is an awful imperative build system that makes all of the non-trivial things in software packaging (reproduceable builds, provenance auditing, and so on) harder than they should be.

                  The distribution format isn’t great either, because it’s based on tarballs and so isn’t naturally amenable to any kind of live validation. You can check the hash matches for the tarball itself, but for reusable read-only layers you really want something like dm-verity that is able to check every block against tampering as you use it.

                  1. 2

                    The building mechanism is a somewhat unfortunate conflation because people often mean ‘Docker’, which is an awful imperative build system that makes all of the non-trivial things in software packaging (reproduceable builds, provenance auditing, and so on) harder than they should be.

                    Practically speaking, how many folks don’t use Docker when deploying? Much like Linux is the de-facto OS for cloud services, Docker containers are the understood context for “containers”, and so the bullet points you list already have choices made for them.

                    1.  

                      To the best of my knowledge most large-scale deployments don’t use Docker. They use something like Kubernetes + containerd + runc, rather than anything using the Docker daemon or the Docker containerd shim. Docker is commonly used as the build tool, but other things are gaining popularity. In terms of deployment, VM-based isolation is increasingly common relative to the pile of namespace + cgroup + seccomp hacks, though Google is still pushing gVisor.

                    2. 1

                      Is there some reason these container based systems aren’t using shared memory for data transfer between machine-local components?

                      Are they relying on the network stack for security & process isolation?

                      1.  

                        Using the network stack isn’t actually that bad for jail-to-jail communication: messages over the loopback interface can bypass a lot of the stack and have a bunch of fast paths. The contention issues are more to do with network-facing services. Whether you use fine-grained locking, RCU, or anything else, there are bits of the network stack that become contention points. With the VNET work, the only shared state between two jails’ network stacks is at the ethernet layer and that’s just a simple set of ring buffers, so scales much better than anything above it. Now that SSDs are common, containerised environments are starting to see the same problems with the storage stack: anything that’s giving ordering guarantees between bits of a global view of a filesystem can introduce contention and you’ll often see better performance from giving each container a separate block device and private filesystem.

                    3. 8

                      Just like an uberjar or a static binary. Ohh wait those do not require a 1million line additional runtime.

                  1. 3

                    I understand the basic premise: virtual method calls for all non-static functions in all shared libraries hurts performance. But wow I do not have enough background to understand the other 95% of this article explaining the trade offs.

                    This is why I like that Rust and Go use static linking. I appreciate the plight of distro maintainers needing to patch libraries and wanting to avoid rebuilding the world. But I honestly would rather download and reinstall my entire base system every week than care about dynamic linking. Distro maintainers already build packaged software themselves anyway, so it’s hardly a question of upstream developers being responsible enough to update their builds.

                    This ship has already sailed for the cloud native crowd with docker and AMIs and immutable infrastructure. Same for MacOS—multi-gigabyte system updates are the norm. Maybe I’m just privileged with my gigabit internet, but the dynamic library dance seems like such a waste for such a small benefit.

                    1. 7

                      For what it’s worth, zsh history has time and duration in its history mechanism with setopt extendedhistory.

                      % sleep 7
                      % echo this echo should take 0 seconds
                      this echo should take 0 seconds
                      % fc -l -i -D -2
                       4793  2021-05-08 10:58  0:07  sleep 7
                       4794  2021-05-08 10:58  0:00  echo this echo should take 0 seconds
                      

                      fc: access to shell history, stands for “fix command” as without arguments it opens the previous command in an editor and runs the saved result

                      -l: list instead of “fix”

                      -i: ISO datetime version of -d date flag

                      -D: duration

                      -2: not a flag, just sets the history cursor start to 2 before the end (using 0 as start prints all history)

                      I can also recommend setopt incappendhistorytime, which appends to the history file after every command completes rather than when the shell terminates. I find it’s often useful to have immediate access to recent history in new shells.

                      1. 7

                        I’d say it’s more “testability implies modularity”. You can still modularity without testability, for example if don’t have testing oracles. That can happen when you’re doing scientific research or simulation.

                        Then again, @matklad makes a good case for “testability without modularity”, so maybe it’s more like “testability ≈ ≈ modularity”?

                        1. 6

                          To me, it’s difficult to devise a modular system when the modules are only consumed by each other. Tests add a second consumer—albeit artificial—to each module, illuminating parts of the design that are over-coupled.

                        1. 3

                          “Add layers of indirection to enforce harder constraints”

                          “Try to test and lint for any constraint you add to your code”

                          I’m in favor of linting checks. Less so in favor of adding a layer of abstraction to enforce compliance. Layers of abstraction are not in vogue right now.

                          1. 2

                            It’s not just that they’re not in vogue, it becomes quite easy to forget to add constraints when you take away the constraint from the lexical scope the coder is working in, especially in a loose-typing situation where as a coder you can’t tell one way or another whether the constraint has already been covered.

                            If you’re writing strong, full-featured types that bolt right into the programming language, whatever that language is, then it doesn’t matter. But far too often a coder will set up an abstraction, add a bit to it, then at some later time add constraints all over the place that are somewhat related. In that scenario, in a large codebase you can’t tell what the the hell has been fixed and what hasn’t.

                            “Be consistent with constraints” is a much truer statement than many might be willing to acknowledge. It applies both to your language constructs as well as your coding practices.

                            1. 4

                              In E and relatives, programmers can produce “guards”, which are regular objects that can transform other objects. For example, in:

                              def x :Int := 42
                              

                              Int is a guard. In this case, it has simple behavior: Either accept an integer, or throw an exception. But guards can do arbitrary things. This gives programmers the ability to attach arbitrary constraints to their code at binding sites for names, and constrain the values to which those names can refer.

                              1. 2

                                This is where the aspect-oriented programming guys were going. I haven’t kept up with them, though.

                                https://en.wikipedia.org/wiki/Aspect-oriented_programming

                                The Executable UML guys were also headed this way. I haven’t kept up with that work either, sadly.

                                https://en.wikipedia.org/wiki/Executable_UML#Action_Language

                              2. 2

                                How instead would you propose to implement GDPR-aware and activity-logging constraints other than abstractions that raise “method not implemented” at compile or run time? What linter rule would you write that could analyze the complete code path involving a potentially multiple database transactions and guarantee that some of those transactions write to the activity log, and those that do write everything?

                                With an abstraction thats easy. If the body of Activity.execute changes, so must the body of Activity.append_to_history.

                                If the history method needs no changes, the commit author can justify that in the commit message. Google has tooling that suppresses lints if certain fields are present in the commit message. But even without such tooling, you only need a modicum of diligence from code reviewers to ask “why can you ignore this lint? could you update your commit message?” should it pop up on a merge request.

                              3. 2

                                I think the difficulty is the imperfection of lints. Sometimes this is Basically Fine (enforcing some design pattern or the like), but other places it could be Very Bad (confirming that you are properly sanitizing user input).

                                In an ideal world type systems would be more usable for the “annotate data with lint information” use case… the only two systems I find that get close are Typescript and Clojure’s metadata stuff, everything else is way too heavy. The state of the art in ADTs is very much a local maximum that I think we need to get out of if we want to make improvements here.

                              1. 3

                                Warning, this site appears to be hacked – the article showed up, but a few seconds later redirected to a blank page at a different site with a weird hostname that asked permission to pop up notifications… (Safari 14.1 on macOS 11.3 beta, with the Ghostery blocker plugin installed.)

                                1. 2

                                  You might want to send them a message. It seems to be Wordpress, so not that weird if it was compromised. I haven’t had a redirect but I’m behind seven proxies. (Joking, just AdBlock and pihole). Here is the archived version: https://archive.md/NSHex

                                  1. 1

                                    I can’t help but wonder if this could have been avoided if they just blogged about a memory safe language instead.

                                    1. 1

                                      I didn’t have that problem for this site on iOS. But I have occasionally had that problem on random sites, totally unreproducible. I suspect it’s malware embedded in ads, but I can’t prove it since I don’t browse the internet with a debugger open.

                                      This site doesn’t seem to have ads, so who knows? Definitely weird. I wasn’t able to reproduce on my Mac either, with Ghostery enabled or disabled.

                                    1. 2

                                      @mthwsjc Just an FYI, small typographical error here:

                                      […] to scan more repositories for more leaded credentials

                                      Guessing it should be “leaked”, not “leaded”

                                      1. 13

                                        I generate all my credentials unleaded. Better for the environment.

                                        1. 2

                                          thanks

                                        1. 3

                                          Original talk video and transcript on acmqueue.

                                          A recent post here, Disasters I’ve seen in a microservices world covers “timeouts, retries, and resilience.” I myself have experienced frustration with these problems. So I consulted a knowledgeable friend for solutions better than my historical go to (no queuing; only client retries). He sent me this.

                                          Applying CoDel—a packet-level queue management algorithm—to userspace services makes a ton of sense. They are fundamentally the same problem but I had never made that logical leap before!

                                          And adaptive LIFO is brilliantly simple. It would definitely work well even without CoDel.

                                          1. 2

                                            I really enjoyed the original article and it got me thinking about patterns for delays, back pressure and queue management. This is is spot on!

                                          1. 8

                                            I’m not sure about the “satire” tag; my impression is the proponents are deadly serious. You can bet I’d use it too with the number of times I’ve written return Err(something).

                                            1. 5

                                              This isn’t a new phenomenon :) From http://www.catb.org/jargon/html/H/ha-ha-only-serious.html

                                              Indeed, the entirety of hacker culture is often perceived as ha-ha-only-serious by hackers themselves; to take it either too lightly or too seriously marks a person as an outsider, a wannabee, or in larval stage.

                                              1. 5

                                                No, and it is probably for the best. yeet is just a placeholder term to prevent bikeshedding and preventing progress on a legitimate (and very cool) feature, not a serious language proposal.

                                                Not serious, but I love the idea of using a nonsense word to prevent bike shedding. Every time someone says “Well, I prefer…”, they can be informed that no, this isn’t the final keyword and that the final keyword will be decided after the semantics are worked out.

                                                1. 3

                                                  Agreed, this is a serious albeit humorous campaign. BTW you can suggest removing that tag via the “suggest” link under the headline

                                                  1. 1

                                                    As much as I appreciate the humor, and the cleverness of the yeet placeholder to discourage bike shedding, is it worth adding special syntax to the language to save on writing a couple of parens? It definitely seems unnecessarily magical to me.

                                                    yeet e;
                                                    throw e;
                                                    Err(e)?;
                                                    return Err(e);
                                                    

                                                    These are all the same, yes?

                                                    1. 2

                                                      These are all the same, yes?

                                                      Not really, there are fine differences. The last one wouldn’t do an .into() conversion argument, the last two only work for result, while the first two work for any try type. That is, yeet; would return None in a context of a function that evaluates to Option.

                                                      1. 1

                                                        Sure, but couldn’t you also do None?; which is the same amount of chars as throw; and more clear?

                                                        1. 2

                                                          I don’t have discussable opinion about this question, I can only comment on sameness :)

                                                  1. 5

                                                    I wondered about private network assignments after reading this recent curl post about IP address formats. 192.168. corresponding to octal 0300.0250. sparked my interest!

                                                    1. 2

                                                      This inspires me to try this with SQLite FTS!

                                                      1. 2

                                                        high five

                                                        That was my first thought too!

                                                      1. 13

                                                        I laughed pretty hard at someone suggesting SHA2 as a remotely reasonable password hashing choice.

                                                        1. 4

                                                          SHA2 with PBKDF2? Sure. SHA2 alone? Please no.

                                                          Otherwise the article does make a good point. Personally I think the biggest benefit of the modern HTTP everywhere culture is the widespread proliferation of HTTPS rather than tons of custom protocols.

                                                          1. 8

                                                            SHA2 with PBKDF2?

                                                            PBKDF2-HMAC has some interesting failure modes. Unless you absolutely need FIPS-140 support (because you’re support USG customers), you probably want to use Argon2id.

                                                            What I took away from this post is that we need more libraries like libsodium, that offer the top-level primitives that programmers actually use, rather than “safe” versions of things they shouldn’t be using. Tink is sorta there, but we really need to move away from all the terrible failure modes that happen when using crypto wrong and towards things that help you make the right choices. Another good example is Fernet from pyca, which makes some opinionated choices about how to use several primitives, but saves programmers from doing the wrong thing.

                                                            1. 1

                                                              PBKDF2 is “if you have to, then ok” type of choice. Use Argon2 or bcrypt if you aren’t forced to use PBKDF2.

                                                            2. 1

                                                              It’s a good hash… for a checksum.

                                                              1. 1

                                                                Why? I mean, it doesn’t have specific hardening to slow down brute-force attacks but is that all?

                                                                1. 1

                                                                  Right, it’s not a KDF at all and so trivial to brute force that you might as well be in the clear. It could be a building block in a KDF, but sibling comments have covered that.

                                                              1. 2

                                                                Does it even make to work on the “basic three” (M&S, M&C, SS) outside of hobbyist projects?

                                                                I’d assume that for running professional software none of these three are competitive to more advanced GC implementations.

                                                                1. 6

                                                                  Loads of professional software is written in outrageously slow languages like Ruby and Python. If that’s acceptable, I see no reason why a slow, unsophisticated garbage collector should pose a problem. Of course it’s nice if the GC is better, but plenty of serious, non-hobbyist projects were built on Ruby before it even had a generational GC.

                                                                1. 6

                                                                  In most cases?

                                                                  • k:v stores for fast lookups (requirement: 50ms p90 latency with 30.000 req/s)
                                                                  • storing 50TB flat data for analytical workloads
                                                                  • storing relational user data for web applications

                                                                  I think SQLite is sometimes a good option for #3.

                                                                  1. 20

                                                                    FWIW, SQLite is by far the most-deployed database in the world. It’s just that most of its deployments aren’t in servers — it’s in almost every cellphone in the world, and probably in most cars and TVs built in the last decade. I’ve heard it’s found in microwave ovens too.

                                                                    I know people here tend to be focused on servers, but databases aren’t just for that.

                                                                    1. 12

                                                                      k:v stores for fast lookups (requirement: 50ms p90 latency with 30.000 req/s)

                                                                      Trivial for SQLite. Arguably the best case for SQLite performance. See Expensify using SQLite as a KVS reaching 4 million QPS.

                                                                      1. 6

                                                                        Yeah, when I saw the title, I’ve thought “oh, another one?”. And yes, the app makes some (unsubstantiated) claims about “thousands of concurrent writes”, and even if true, I wouldn’t say “most cases” works here.

                                                                        I mean, yes, SQLite is valuable and has its definite uses. And yes, a lot of applications out there could probably work with SQLite instead of whatever else they may have. But “most cases”? I’d rather say “few cases”, go into a niche, and then rule the world in that niche.

                                                                        1. 7

                                                                          Your notions of most vs. niche are kind of backwards… https://www.sqlite.org/mostdeployed.html

                                                                          it seems likely that there are over one trillion (1e12) SQLite databases in active use.

                                                                          1. 3

                                                                            That would suggest there are trillions of webapps there. Is say majority of those trillions are embedded in a mobile app - practically one use case. And a great I’ve at that - you’d have to be a little insane to ship a postgresql to acompany your mobile app.

                                                                            The article seems to claim that you should be developing web applications and replacing your regular database servers with it. I mean, for single-to-few-users blogs, sure. Even some small apps. But for most cases where I’m using PostgreSQL or a MongoDB cluster, I would probably not be doing myself favors by replacing them with sqlite.

                                                                            So take my comment in that context, of how I understood the article - using sqlite instead of postgresql. In that context, I would not go for “most cases”, that’s what I’m vasing my comment on.

                                                                            1. 5

                                                                              There are not trillions of webapps, but there are, combined, over a trillion airplanes, smartphones, industrial machines, automobile computers, infrastructure controllers, and other real world places you want to have a database.

                                                                              The world of computer technology is so much more than the web, or even the internet.

                                                                        2. 4

                                                                          storing 50TB flat data for analytical workloads

                                                                          Sqlite recently increased the max database size to 280TB, because people had reached the half-way point of it’s previous limit, so 70TB Sqlite databases exist.

                                                                        1. 26

                                                                          Very similar story from a few weeks ago: SQLite is not a toy database – I won’t repeat my full comment from there.

                                                                          SQLite is very fast. [..] The only time you need to consider a client-server setup is: [..] If you’re working with very big datasets, like in the terabytes size. A client-server approach is better suited for large datasets because the database will split files up into smaller files whereas SQLite only works with a single file.

                                                                          SQLite is pretty fast compared to fopen(), sure, but PostgreSQL (and presumably also MariaDB) will beat it in performance in most cases once you get beyond the select * from tbl where [..], sometimes by a considerable margin. This is not only an issue with “terabytes” of data. See e.g. these benchmarks.

                                                                          Is it fast enough for quite a few cases? Sure. But I wouldn’t want to run Lobsters on it, to name an example, and it’s not like Lobsters is a huge site.

                                                                          Well, first of all, all database administration tasks becomes much easier. You don’t need any database account administration, the database is just a single file.

                                                                          Except if you want to change anything about your database schema. And PostgreSQL also comes with a great deal of useful administrative tools that SQLite lacks AFAIK, like the pg_stats tables, tracking of slow queries, etc.

                                                                          And sure, I like SQLite. I think it’s fantastic. But we need to be a tad realistic about what it is and isn’t. I also like my aeropress but I can’t boil an egg with it.

                                                                          1. 9

                                                                            SQLite is pretty fast compared to fopen(), sure, but […] MariaDB will beat it in performance

                                                                            I would actually be interested in knowing whether SQLite handles that query that broke Lobste.rs’ “Replies” feature better than MySql/MariaDb.

                                                                            But I wouldn’t want to run Lobsters on it, to name an example, and it’s not like Lobsters is a huge site.

                                                                            I think Lobste.rs would run fine. It would probably be more an issue with the limited amount of SQL SQLite supports.

                                                                            1. 7

                                                                              The replies query broke because the hosted MySQL Lobste.rs relies on doesn’t do predicate push down. SQLite does do predicate push down, so it wouldn’t have the same problem.

                                                                              However SQLite doesn’t have as many execution strategies as MySQL, so it may be missing a key strategy for that query.

                                                                              1. 5

                                                                                SQLite’s query planner is honestly a bit smarter than MySQL’s in certain ways. For example, MySQL, as recently as 2017, did temporary on-disk tables for subselects. SQLite instead usually managed to convert them to joins. Maybe that’s been fixed in the last four years, but I wouldn’t assume that MySQL would be faster/that SQLite would be slower.

                                                                              2. 1

                                                                                Lobsters uses some fairly complex queries; usually those kind of things tend to do less well on SQLite, although I didn’t run any benchmarks or anything. I found that SQL support in SQLite is actually pretty good and don’t necessarily expect that to be a major issue.

                                                                                From what I understand is that the biggest problem with the Lobsters hosting is that it’s running MySQL rather than MariaDB. While MySQL is still being actively developed, from what I can see it’s not developed very actively and MariaDB is leaps ahead of MySQL. At this point we should probably stop grouping them together as “MySQL/MariaDB”.

                                                                                1. 1

                                                                                  Aside from the operations perspective of migrating data, converting things that are not 1:1 between mysql and mariadb, etc. are there any features in lobste.rs that prevent the use of MariaDB?

                                                                                  1. 1

                                                                                    It used to run on MariaDB until there was a handover of the servers. AFAIK it runs well on both (but not PostgreSQL, and probably also not SQLite).

                                                                                    1. 1

                                                                                      I guess their current hoster only provides MySql (for unknown reasons).

                                                                                      I asked about offering hosting, but never got a reply.

                                                                                2. 12

                                                                                  I also like my aeropress but I can’t boil an egg with it.

                                                                                  I bet you could poach an egg with it, with some inventiveness and a slightly severe risk of getting scalded. ;)

                                                                                  1. 3

                                                                                    When I posted that comment I was thinking to myself “I bet some smartarse is going to comment on that” 🙃

                                                                                    1. 2

                                                                                      Joking aside, I think a better analogy would be comparing the Aeropress to an espresso machine: the Aeropress is going to get you really good coffee that you’re going to use every day, costs very little, is easy to maintain, and you can bring with you everywhere, but it’s never going to give you an espresso. But then again, it’s not really trying to.

                                                                                      (The analogy falls apart a bit, as one of the original claims was that it could produce espresso. I think they stopped claiming that though.)

                                                                                    2. 1

                                                                                      LOL

                                                                                      …and audible laughter was emitted. Thanks for that.

                                                                                      1. 1

                                                                                        On the other hand if you had to set up and supply your password to obtain admin rights every time you just wanted to make coffee….

                                                                                        …because some nutjob might want to use it for boiling eggs and the company wanted to stop that….

                                                                                        …the device that just let’s you get on with making coffee (or boiling eggs) is a hellavuh lot faster for many jobs!

                                                                                      2. 5

                                                                                        Except if you want to change anything about your database schema.

                                                                                        SQLite has supported ALTER TABLE ADD COLUMN for years, and recently added support for dropping columns. So I’d amend your statement to “…make complex changes to your db schema.”

                                                                                        SQLite has stats tables, mostly for the query optimizer’s own use; I haven’t looked into them so I don’t know how useful they are for human inspection.

                                                                                        1. 2

                                                                                          SQLite has supported ALTER TABLE ADD COLUMN for years, and recently added support for dropping columns. So I’d amend your statement to “…make complex changes to your db schema.”

                                                                                          Yeah, the drop column is a nice addition, but it’s still a pain even for some fairly simple/common changes like renaming a column, changing a check constraint, etc. I wouldn’t really call these complex changes. It’s less of a pain than it was before, but still rather painful.

                                                                                          SQLite has stats tables, mostly for the query optimizer’s own use; I haven’t looked into them so I don’t know how useful they are for human inspection.

                                                                                          As far as I could find a while ago there’s nothing like PostgreSQL’s internal statistics. For example keeping track of things like number of seq scans vs. index scans. You can use explain query plan of course, but query plans can differ based on which parameters are used, table size, etc. and the query planner may surprise you. It’s good to keep a bit of an eye on these kind of things for non-trivial cases. Things like logging slow queries is similarly useful, and AFAIK not really something you can do in SQLite (although you can write a wrapper in your application).

                                                                                          None of these are insurmountable problems or show-stoppers, but as I mentioned in my other comment from a few weeks ago, overall I find the PostgreSQL experience much smoother, at the small expense of having to run a server.

                                                                                          1. 6

                                                                                            it’s still a pain even for some fairly simple/common changes like renaming a column

                                                                                            https://sqlite.org/lang_altertable.html :

                                                                                            ALTER TABLE RENAME COLUMN The RENAME COLUMN TO syntax changes the column-name of table table-name into new-column-name. The column name is changed both within the table definition itself and also within all indexes, triggers, and views that reference the column.

                                                                                      1. 3

                                                                                        Thank goodness. I am so effing tired of needing to download yet another terrible app just to do a simple task (this week’s example: paying for street parking in a town I’m visiting). Almost all mobile apps aren’t worth the storage space they take up on my phone, let alone the fact that I trust my browser’s sandboxing much more than native apps.

                                                                                        1. 2

                                                                                          I trust Apple’s sandboxing well enough. But I 100% agree that random one-off apps should just be web apps. Or even just web pages. Why on earth should paying for street parking be an app at all? That’s a <form>.

                                                                                          1. 1

                                                                                            To keep your payment info safe, I guess.

                                                                                            Anyway, even Apple agrees that not all app need to be installed, and created AppClips. I’m sure Android has something like it too.

                                                                                            https://developer.apple.com/app-clips/

                                                                                        1. 7

                                                                                          I have wondered this for so long!

                                                                                          1. 3

                                                                                            I have a faint memory that one of the really, really old CVEs was for this. A privileged script that expected its arguments to be file names, I think, and could be made to do Wrong Things by passing in shell metacharacters or -.

                                                                                            1. 10

                                                                                              People (rightly) talk a lot about the security implications of software being written in memory-unsafe languages like C. But, while there’s a lot of talk about the gotchas in shell programming, there’s shockingly little talk about the security implications of having so much software written in a language where it’s almost impossible to handle files correctly and almost impossible to handle strings correctly,

                                                                                              1. 7

                                                                                                I think that if a language’s safest way to compare strings uses syntax as weird "x$a" = "x$b", that’s a warning sign with letters big enough to read from space.

                                                                                                The sign reads do not use this language to write code to be run by strangers, and if there’s a footnote, the footnote says “this is a fine language to write a plugin for git bisect and that kind of one-offs, but not for writing things to be run by stranger, okay? you understand now?”

                                                                                                1. 3

                                                                                                  Yeah, I agree. Another interesting challenge is to iterate over all the files in a directory, correctly, and without doing the actual loop in a subprocess; it’s probably possible, but most people’s first 3 attempts will probably be dangerously broken.

                                                                                                  I agree that shell is a fine language for tiny one-off things, but I believe it’s being used way more broadly than that. I just ran a find /usr -name '*.sh' | xargs cloc [1] on my system, and found 114501 lines of shell across 1050 files. I don’t have a great level of confidence that none of those shell scripts ever consume untrusted input.

                                                                                                  [1] As an interesting footnote, find /usr -name '*.sh' | xargs cloc is incorrect; it won’t work if files contain whitespace, quotes or backslashes. The “correct” (AFAIK) command would be find /usr -name '*.sh' -print0 | xargs -0 cloc. I sure hope nobody has ever made that mistake in a context where files may contain “weird” characters! Also, that approach only works for iterating over a relatively small number of files; how many is dependent on your particular POSIX system!

                                                                                                  1. 4

                                                                                                    It also ignores the staggering number of shell scripts that are involved in the init process that aren’t named *.sh!

                                                                                                2. 3

                                                                                                  Bash is like glue, only a fool would make a whole building out of it.

                                                                                              1. 3

                                                                                                To be fair it was a different URL, so the duplicate submission detector didn’t work. The author must have migrated their blog off medium.

                                                                                                And from a comment on the previous post: Introducing Glommio, a Thread-per-Core Crate for Rust & Linux, which uses io_uring.

                                                                                                1. 3

                                                                                                  The author must have migrated their blog off medium.

                                                                                                  Well, they got their own domain name but it’s still hosted by Medium

                                                                                                  1. 2

                                                                                                    Yeah, I don’t blame OP at all. I just knew I had seen that article before so I went looking for it.