Yeah good point. I suppose the problem is this function that operates on numbers allows numeric strings to be passed in in the first place. The only place where I would really expect numeric strings to exist is captured directly from user input which is where the parsing into a numeric data type should happen, not randomly in a library function.

It’s kind of insane how bad this whole is-number thing is. It’s designed to tell you if a string is numeric, but I would argue if you’re ever using that you have a fundamental design problem. I hate dynamic typing as much as anyone else, but if forced to use it I would at least try to have some resemblance of sanity by just normalizing it to an actual number first.

Just fucking do this…

const toRegexRange = (minStr, maxStr, options) => {
  const min = parseInt(minStr, 10);
  const max = parseInt(maxStr, 10);
  if (isNaN(min) || isNaN(max)) throw Error("bad input or whatever");
  // ...

Because of the insanity of keeping them strings and only attempting to validate them (poorly) up front you open yourself up to a suite of bugs. For example, it took me all of 5 minutes to find this bug:

toRegexRange('+1', '+2')
// returns "(?:+1|+2)" which is not valid regexp

I hate that Google is exerting even more control on the internet with their TLD, but I don’t really think this attack is made all that much worse with .zip TLD. I can already bury a .com in a long URL and end it in .zip just fine like so:

https://github.com∕foo∕bar∕baz@example.com/foo/bar/baz.zip

Or even use a subdomain to remove the @:

https://github.com∕foo∕bar∕baz.example.com/foo/bar/baz.zip

The truth is most people don’t look much at URLs outside of a domain to verify its authenticity, at which point the .zip TLD does not do much more harm than existing domains do.

For mitigation, Firefox already doesn’t display the username portion of the URL on hover of a link and URL-encodes it if copy-pasted into the url bar. It also displays the punycode representation when hovering or navigating to the second example.

Edit: looks like lemmy now replaces 0x2215 which is a character that looks like forward slash with an actual forward slash, so my comment is a bit more confusing. For clarity, the slashes before example.com in the above urls were 0x2215 and not “/”.

While I agree that first party systems suck, as someone with neither an iOS or Android device I personally prefer something work rather than a screen that says “connect iOS/Android”.

Definitely agree, but your link is protected by cloudflare (yet another centralized service destroying the internet) and therefore I’m unable to get through because I have privacy.resistFingerprinting enabled on my browser so cloudflare is unable to determine I’m human I suppose.

I despire youtube and it’s monopoly, and I think it get’s an appropriate amount of hate on here and HN, but what confuses me to no end are the people who complain about youtube turn right around and constantly recommend cloudflare. Can someone explain what I am missing?

That’s wild, I’ve never seen an upside down port.

I agree reversibility is better and am happy usb c will finally kill this meme.

I would have more sympathy for Youtube if 1. it wasn’t the de-facto standard where essentially all video media gets uploaded to (which Youtube itself has done everything in its power to make happen) and 2. the company that owned it didn’t also own the most popular phone OS, most popular search engine, most popular email provider, most popular ad network, most popular maps, most popular online office suite, most popular airline booking, 2nd most popular cloud hosting… The list goes on

Until a federated solution like peertube gains more traction I have no problem paying content creators directly via patreon, and do everything in my power to not pay Google a dime. Trust me, they can afford it just fine.

Yeah that’s fair. But I feel like I’ve seen these “USB superposition” memes since before IoT was even a thing.

Can someone explain to me why I keep reading about people having problems plugging in USB A connectors upside down? I feel like I’m taking crazy pills. Per the spec, the holes always go up. They indicate the correct way to plug in the port. Not only that, but the printed logo on the connector also always goes up.

The only time this is SLIGHTLY confusing is if you have a desktop tower where the motherboard is essentially mounted sideways, but for that case it just takes an extra second to think which way is “up” from the perspective of the motherboard.

And before anyone says “who reads the spec?”, it feels like I subconsciously knew this for something like a decade before I even knew what a spec was.

Yes, you are correct in that a single individual’s action will make no difference, just like your single vote makes no difference either. However if everyone does their part it can make a massive difference.

While your individual contribution makes no difference, you still should try to do your part. Yes, change takes work and a bit of sacrifice. Just like how it takes time out of your day to do research on candidates and go to the polls.

If you don’t do the work, it doesn’t make you smart or clever, it just makes you an asshole taking advantage of others.

If I super heat a metal and it turns visibly red what is happening? Was it already emitting infrared and as it gets hotter the frequency shifts up? Or is it still emitting infrared but has a wider band of frequencies it is emitting as well (i.e. is it emitting frequencies below infrared as well as visible red)?