41 Matching Annotations
  1. Apr 2026
    1. A deliberately planted backdoor doesn’t have a CVE.

      戳中了传统安全工具的阿喀琉斯之踵。基于已知漏洞(CVE)的防御逻辑在应对蓄意植入且会自毁的新型后门时形同虚设。这启示我们,静态的特征匹配已无法应对动态的攻击手段,必须转向对代码运行时行为的动态分析,从“它是什么”转向“它做了什么”。

  2. Jul 2025
  3. Dec 2024
  4. Sep 2023
  5. May 2023
  6. Dec 2022
    1. Basically I wanted to merge every tiddler into one ORG file.

      All this detailed manipulation re/decomposing tiddlers in other formats or adding tiddlers content in a programmatic way is done via TiddlyWikiPharo and inside a single language. For external functionality not implemented or too slow in Pharo (for example YAML to JSON conversion) we try to program it in Nim and create a Pharo wrapper around the Nim binary output.

  7. Nov 2022
  8. Jan 2022
    1. Yes, precisely because I've been involved in maintaining codebases built without real full stack frameworks is why I say what I said.The problem we have in this industry, is that somebody reads these blog posts, and the next day at work they ditch the "legacy rails" and starts rewriting the monolith in sveltekit/nextjs/whatever because that's what he/she has been told is the modern way to do full stack.No need to say those engineers will quit 1 year later after they realize the mess they've created with their lightweight and simple modern framework.I've seen this too many times already.It is not about gatekeeping. It is about engineers being humble and assume it is very likely that their code is very unlikely to be better tested, documented, cohesive and maintained than what you're given in the real full stack frameworks.Of course you can build anything even in assembler if you want. The question is if that's the most useful thing to do with your company's money.
  9. Mar 2021
  10. Jan 2021
  11. Nov 2020
  12. Oct 2020
    1. This is valid javascript! Or harmony or es6 or whatever, but importantly, it's not happening outside the js environment. This also allows us to use our standard tooling: the traceur compiler knows how to turn jsx`<div>Hello</div>`; into the equivalent browser compatible es3, and hence we can use anything the traceur compile accepts!
  13. Sep 2020
    1. One key advantage of 'HTML-plus' languages is that you don't actually need tooling in order to be productive — most editors give you out-of-the-box support for things like syntax highlighting (though imperfect, as JavaScript expressions are treated as strings) and auto-closing tags. Tools like Emmet work with no additional setup. HTMLx should retain that benefit.
  14. May 2020
    1. What I think we're lacking is proper tooling, or at least the knowledge of it. I don't know what most people use to write Git commits, but concepts like interactive staging, rebasing, squashing, and fixup commits are very daunting with Git on the CLI, unless you know really well what you're doing. We should do a better job at learning people how to use tools like Git Tower (to give just one example) to rewrite Git history, and to produce nice Git commits.
  15. Jan 2016
  16. Dec 2015
  17. Nov 2015
    1. The free plan of ngrok allows only a single concurrent tunnel to be opened. Even though BroswerStack and Sauce Labs provide their own tunneling solution, we decided to go with ngrok, in order to provide a more generic solution. We happily upgraded to the $25/month business account following our excellent experience with the free account.
  18. Oct 2015
    1. In version 1.4, bindToController gets even more powerful. When having an isolated scope with properties to be bound to a controller, we always define those properties on the scope definition and bindToController is set to true. In 1.4 however, we can move all our property binding definitions to bindToController and make it an object literal.

      This starts to look a lot like propTypes, except without runtime type checking.

  19. Sep 2015