Things Spenser is reading

Tzu-li and Tzu-ssu were boasting about the size of their latest programs. ‘Two-hundred thousand lines,’ said Tzu-li, ‘not counting comments!’ Tzu-ssu responded, ‘Pssh, mine is almost a million lines already.’ Master Yuan-Ma said, ‘My best program has five hundred lines.’ Hearing this, Tzu-li and Tzu-ssu were enlightened.

-- Master Yuan-Ma, The Book of Programming

There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies.

-- C.A.R. Hoare, 1980 ACM Turing Award Lecture

A few weeks ago, I heard that my slow and unreliable ISP was raising their prices, and I decided to look around for a better ISP. I found one in the form of Novus, which has fibre runs to towers around the Vancouver area. I signed up; they came to the building and placed the necessary patch cable in the basement telecommunications room; and I had 50/10 Mbps internet access costing less than my previous 25/2.5 Mbps.

Then I went onto Novus' account management website and found my bandwidth utilization graph. "Cool", I thought, "they're using RRDtool. I wonder if they're generating the standard day/week/month/year graphs, or just the monthly graph." Right click, open in new tab, look at URL. "Huh, that's interesting, it's just a path to a .gif file, not a CGI invocation. Well, maybe they're rewriting usage_graphs to the directory with the graphs for whichever user is logged in. What do I get if I issue a request for the directory itself?"

This is an annotated version of my 31C3 talk on Thunderstrike, a significant firmware vulnerability in Apple's EFI firmware that allows untrusted code to be written to the boot ROM and can resist attempts to remove it. There is also an hour long video of the talk if you prefer to watch instead of read. If you just want the tl;dr version, you can skip to the summary of the talk or check out the FAQ.

It's nearly midnight. The end of a long coding session. Your code seems to work pretty well; all tests pass and it doesn't blow up when you use it. It was a hard-fought battle, and you’re feeling g...

How to maintain the balance between adding new features and refactoring existing code? Here are some rules of thumb for choosing when to refactor and how much.

I built a live-coding web app for the Oculus Rift where you code in JavaScript using Three.js and watch the world change around you in real-time. It's quite ...

AngularJS expert Mark Meyer runs down the top 10 mistakes made by AngularJS developers, from code organization to bloated controllers.

As a developer who is just becoming comfortable with AngularJS, this post brought up a few issues I've already started to encounter.

On Wednesday of last week, details of the Shellshock bash bug emerged. This bug started a scramble to patch computers, servers, routers, firewalls, and other computing appliances using vulnerable versions of bash. Since then [Cloudflare] we've been monitoring attacks we've stopped in order to understand what they look like, and where they come from. Based on our observations, it's clear that hackers are exploiting Shellshock worldwide.

We want to find regular expression delimiters that enable us to avoid inserting additional escape sequences into our patterns. This is ideal when we want to inject foreign patterns where we can't guarantee which characters will be used.

Paul Morris has a great breakdown of the various regex delimiters that can be used, and why some are better than others. At his recommendation, I've been using {...} and have found my patterns to be much more readable.

The goal of this article is to provide a very practical guide to deploying a machine learning solution at scale. Not everything is proven right or optimal, and as with …

Totems (an analytics and marketing platform for Instagram) developed a Neural Network to determine gender of an Instagram user. Of the users I tested, it was able to successfully (and with a probability of 0.98+) determine the gender.

There have been hundreds of posts written on the dangers of using curl <url> | sh to install (Node|Ruby|Composer|etc), and a common response is that you can view the source before executing it. Darian Moody has written a quick PoC on why viewing the source in your browser is not enough to ensure something does what you expect.

To cut straight to the chase, this attack works on the theory that the content of the .sh files are easily checked for safety and that the version of the file viewed in a browser window is identical to that which would get downloaded via curl. The problem with this assumption is that a given browser and curl do not send the same user-agent by default and therefore someone with knowledge of this could take advantage of this and compromise the .sh file (jumping through other loops do to that first obviously).

What is the core difference between Gulp and Grunt? Mark Dalgleish has put together some great slides explaining the ins-and-outs, and some of the history behind both.