That email is from the openbsd-misc mailing list. Lots of open source projects have their own lists where you can get help. C++ people still use usenet (comp.lang.c++).

Stack Overflow is often references more than official documentation, and it’s way way better than what we previously had: Xperts Exchange (which had the answers at the bottom, but was setup so it looked like you had to pay to see them).

They might have their issues, but I still have found the Stack Exchange sites really useful. Until I read this post, I wasn’t even aware of the massive deletion problem. I don’t think any of my posts have been deleted, but there’s no way to know for sure.

The actual keylogging inside is done inside of CSS; you’d still need something to exfiltrate it with.

Could you expand more, or maybe share a link, about the Redis critique? I’m curious to learn more about that.

I’m a noob if it comes to databases. Could you tell what alternatives to Postgres are there? I understand that answer is mainly: it depends. But maybe you could write a couple of “if this then that” alternatives?

AFAICT, most software does not run an especially demanding workload.

When the value your software generates is high compared to the (computer-and-therefore-operational) load it generates, correctness and features are in higher demand.

I have access to one of the oldest continuously developed go code bases in existence outside of google. The optimization server (from https://techcrunch.com/2013/07/24/walmart-labs-scoops-up-website-optimization-startup-torbit-to-help-it-keep-pace-with-amazon/) is a single go binary clocking in at 17mb.

This app handles traffic for the 37th most popular site in the US.

Most of our other “microservices” style binaries weight in around 10mb. They generally do something like read from a queue, do some work, and put a result in object storage or another queue.

That’s all true. But what’s a bit silly to me is that the JVM doesn’t have to be that way. I have a very small script I use, jn, that is basically nothing but a thin shim to java -Xms32m -Xmx32m -client -noverify that I use for little utility programs.

How well does it work?

benjamin@Reliant ~/s/jcli> time python -c 'print "Hello, world!"'
Hello, world!
        0.02 real         0.01 user         0.00 sys
benjamin@Reliant ~/s/jcli> time jn -cp build/classes/main Main
Hello, world!
        0.08 real         0.05 user         0.02 sys
benjamin@Reliant ~/s/jcli>

So, slower than Python, but plenty fast enough for me to view it as “instant.” I know that Clojure’s a lot more complicated for tons of reasons, but there’s no reason you can’t have irbesque startup times on the JVM.

Go has a pretty strong contender to ‘infrastructure’ with dl.google.com running in Go. This site serves ChromeOS, Android, Chromium & .deb updates. Additionally I believe cloudflare had parts of their infrastructure in Go and they are in-front of a lot of web pages.

I’m aware of a fair few things in go - a few examples:

• kubernetes (container management)
• cfssl (PKI infrastructure)
• vitess (mysql proxy for horizontal scaling)

I’m pretty sure Dropbox has some amount of their infrastructure written in Rust, but most is still in Go. I’m not sure they’ve written about it in a blog, but there is at least an HN comment.

I read it as, SQL is insecure because bad developers will end up using it incorrectly.

That seems mostly reasonable to me. Using SQL in PLs where the default way to use it is by passing in ordinary strings that contain code is indeed insecure. Imagine if mainstream PLs had us defining and calling functions by calling eval() on strings all over the place: I would expect that to lead to terrific quantities of horrid security problems too. I accuse that passing a string to sqlite3_exec() or mysql_query()or PQexec() is equally as scary as passing a string to eval() because RDBMS query languages are either powerful enough to execute arbitrary code or complicated enough to inevitably have bugs that can be leveraged into arbitrary execution.

I’ve seen an interesting alternative in one of C J Date’s older books, “An Introduction to Database Systems”. He has examples of relational queries embedded directly into a language that looks like PL/1, where the queries are actually fully parsed at compile time. I think they had all the niceties, like references to ordinary lexical scoped variables in the queries turning into code that does all the correct binding at runtime and everything.

I’m thinking that one could make a much safer language be just as convenient as doing broken string concatenation is in current PHP, by using quasiquoting, reader macros or just straight up embedding SQL’s entire grammar into the PL’s own grammar in an expression context. I’d identify “PHP with mysql_query() replaced by quasiquoting” as a safer PL than “current PHP”.

Another strategy for making SQL injection harder to write by accident that I’ve seen is in the postgresql-simple library for Haskell. The query execution functions accept a string-like type called Query for which there is an IsString instance, so you can switch on the OverloadedStrings pragma and write code like execute connection "INSERT INTO dogs VALUES (? ?);" (name, cuteness) ­— so the correct, parameterised-query pattern is easy and convenient to write. At the same time, the incorrect string-concatenation code is still possible but much less convenient, so you’re much less likely to write it it. While you can build Query objects from strings, the syntax to actually do that is longer and involves looking up more stuff than the syntax for putting parameters in your queries.

IIRC there are also quasiquoters that let you write that as something looking like [sql|INSERT INTO foo VALUES (${name}, ${cuteness});] as an expression and automatically turn that into the above parameterised-query.

In all of the above, anywhere I refer to “PHP” you may instead read “any PL in which you use SQL by passing an ordinary string to a function or method with query or execute in the name”, i.e. very nearly all of them. PHP only does slightly worse than average here because mysql_query() comes bundled with the runtime but you have to install an ORM on purpose, whereas plenty of other PLs come with neither SQL bindings nor an ORM so it’s almost equally difficult to install the ORM or the raw SQL binding.