when it rains, my internet hurts
Streamed
Merging PRs for Lobsters including filtering empty modlog. Story repository #top PR. Adding notifications to subnav with explanation of what the UI is. Enabling HSTS for better security. Dealing with CSP false alarms and ActiveStorage PurgeJob. Fixing a bug where viewing notifications doesnโt mark comments as read on story view. Unknown cookies PR that broke login when combined with the new CSP.
scratch
topics
PRs
filtering empty modlog https://github.com/lobsters/lobsters/pull/1677
unknown cookies https://github.com/lobsters/lobsters/pull/1672
story repository #top https://github.com/lobsters/lobsters/pull/1668
issues
add notifications to subnav
also added a explanation of what the UI is
also - reading a notification marks the comment as read on story view
HSTS https://github.com/lobsters/lobsters/issues/1676
CSP false alarms
https://github.com/lobsters/lobsters/pull/711
activestorage purgejob
story
a
d <- I write
e
f
b
g <- after I view story
c
h <- after I view story
title
when it rains, my internet hurts
post-stream
Transcripts are generated with whisperx, so they mistranscribe basically every username and technical term. They're OK but not great, advice appreciated.
Recording
01:56pushcx Howdy, toss questions about Lobsters into chat anytime!
computer.
I maintain the site.
And let's see.
So this is office hours, you can ask questions anytime about the site, the community, we can run queries against the database.
I just ran one this morning for a user who wanted a dump of all of their comments so that they could link back to them easily with Ctrl F. I hope they also write a blog or something.
So that one i'm not going to show on stream because it's not like interesting previous stream I showed one where someone.
counted up and how many self promotional posts there were by.
tag that was kind of interesting we can do that sort of analysis or talk about why the site or the code base works, the way it does.
And if nobody has questions, I work through the issues and the pull requests and do other maintenance kind of stuff.
So let's take a look.
I expect these top three PRs are probably all ready to merge.
And then when I've been thinking about the notifications,
03:22twitchtd good morning pushcx
Notifications to use.
So that one is this period on here, 1649.
Oh, it's almost good morning.
I was just talking about your PR.
I think before merging it, I want to get some more eyes on the new notifications because folks use the inbox in a bunch of different ways and I want more people exposed to it.
I know your PR has been hanging out for a minute, and I want to make sure it's not stalled.
It's getting evaluated.
We've touched a lot of core UI lately this summer.
Honestly, it's like years worth of changes in the last couple of months, in part because we've had so many more contributors.
And it's i'm thinking of things like core ui to the main site functions like commenting the upvote arrows have changed and they had to change because they didn't work for people with certain kinds of.
color blindness and then we've done other changes like tweaking the layout of things, and you know, a really interesting example on this one that I would count is.
We fixed a bug where preview comments were kind of indented and it is a straight improvement, but it's also a change and it's like too many changes kinds of people find unsettling, even the ones that are not buggy.
So I try to keep the pace of change fairly slow for the core stuff and replies and now notifications is,
to be a big change to a pretty hot path and so i'm trying to proceed very deliberately and i think maybe so after i do prs and issues i'll look at putting it into the sub nav so that people can start looking at it you know and i'll put a little text at the top explaining what this is and why it's appearing and then maybe i will ping some of the
people who spend the most time on slash replies i'll just grab some names out of the logs and write them a note saying hey would you look at this and give me your feedback i don't know why i want to go so conservative on this one i think it's just because it changes workflow a bit because it works just a little bit differently it has to
And we've made so many other changes in the last couple of months.
So I'm not trying to single out your code.
It's not bad in any way.
There's just an opportunity to handle this one a little more gently.
But I found myself wishing that I had already merged it and you had moved on to already port the site to SQLite because I was struggling to get MariaDB to query to a file.
It is silly, but
MySQL CLI and MariaDB CLI both make it a pain in the butt.
07:01ChaelCodes Hello! o/
Somebody's asking a question off screen.
Oh, hey, Cheo.
Nice to see you again.
PudottaPommin eyo puddot1Wave
Frici ๐
ChaelCodes Good to see you too! The last thursday stream ended early.
All right, so with that closed out, we got a couple of pull requests.
...37Ended early.
ChaelCodes Thursday before last?
Frici wasn't thursday the one chicago weather said no ?
no i actually ran like 30 minutes over my usual time maybe 40 because i was demoing a recheck at the end of that one maybe the one before was short i don't remember so there's this sound and then there's this the
Frici which pushed you to Friday
14.
Oh, yeah, Thursday before last.
Yes.
So freaky is correct.
And I did a follow up stream on Friday.
ChaelCodes Ah! I have the wrong date.
But on Wednesday night, it poured buckets in Chicago.
And on Thursday morning, my connection was trash.
Just giant packet dropouts where for 30 seconds, it would stop, you know, packet loss was like 100% both directions.
Can't really stream like that, right?
This is a thing that's happened to me at a couple of apartments of just there's water on the line.
We don't have buried lines here in Chicago.
We have telephone poles that run down the alley.
And I have fought and fought cable companies about this one because it's happened.
Story repository.
Top.
and this time the guy that came out he was like 12 but he was like wow i hate it for you because it was still drizzling and so when he measured the signal for once it was still trash because usually what happens is it's terrible i tell them it's terrible and like a day or two later they send someone out and it's all dry and it's fine and then
I fight them for months or years and this time they sent someone out like two hours later and it was drizzling and it was the connection was terrible and he was like oh yeah this is terrible and he replaced a bunch of hardware on the outside of the house and it has been great for the last week hopefully that's it but you know I'll know when it rains
ChaelCodes Yay! \o/
which feels very old timey of like, I am waiting for the rain because we don't have internet when it rains.
I don't know.
PudottaPommin let's hope it's water resistant
It's like, I'm not quite at the level of being an old man where I'm like, oh, my knee hurts.
It's about to rain.
But I'm just at the middle-aged part where when it rains, my internet hurts.
ChaelCodes lol
Yeah.
10:31chamlis_ get those downloads queued boys, there's a storm comin'
So let's see.
This one.
Frici LUL
Yeah, I had had the one comment.
ChaelCodes LUL
Yes, Chalice, there you go.
That is exactly it.
You got to get those downloads in before the rain comes.
Get yourself down to the storm cellar with your USB drive.
...56God, that's spoken like a Midwesterner.
I actually do, so there's the, who are they?
The data hoarders subreddit.
I get a kick out of them.
They're these people who build their home arrays of petabytes of data and they take backups of things.
And I'm not quite at that level, but I'm like looking over the fence admiringly.
And if I didn't have any hobbies that cost money, that would probably be the one I picked.
pushcx https://kiwix.org/en/
And I do have, there's a neat software called,
kiwix kiwix i don't know how it's pronounced but i have it on my phone and tablet just i just think it's so cool that i can have a download of like most of wikipedia or actually the real useful one is they have weektionary wikishinary the wikipedia dictionary which is a reasonably good dictionary like it's fairly comprehensive decent source citing
But it's really nice to have that with no network latency.
All right.
And there's just, it's funny, I talked to my nieces and nephews about this, but I grew up in a like horror information environment where if you wanted to look stuff up, either you had a reference book or you went to the library, which means if it was like
Saturday evening when you wanted to know something.
Okay, great.
You got at least a day to wait.
12:45They tease me for having paper maps in the car. In a loving way, of course. So I have commented here. That's good. All right, so this is the break man update. Which should be fine. Because all it is, is these things changing and then this one. Right, we can't use the question mark because it would throw quotes around that one. But that is data from the trusted. yeah typo that's okay i'll take a typo what note did he put on this in particular about notes no no oh i don't like that where's the old one
14:08Frici No library access on Saturday evenings back then? ๐ค Libraries used to be open until 20:00ish here. Though nowadays they just close on Saturdays since nobody visits them on a Saturday anymore.
And I just yeah.
Yeah, I grew up in the suburbs and I want to say.
The.
Library closed at 6 p.m. on the evenings.
Something like that, it didn't stay open terribly late.
...49Frici obviously not Sundays but at least half a day on Saturday was a thing.
yeah and then sundays was even more limited or non-existent all right well as long as i can commit it i will just do the typo enter i wonder at what point
So I have zero concern here that NavMic is doing it.
But we've had people make LLM contributions to the code base.
manateemon Good afternoon, push and chat.
And we've had people on the site boast of, there was one guy who kind of infamously boasted of sneaking a commit into an open source project that he didn't admit was vibe coded, which was, he was deliberately misleading and kind of smug about it.
People were not receptive and positive about that choice.
Oh, hey, welcome, Antibon.
And I wonder at what point people are going to insert typos into slop contributions to make them look real.
Because, I mean, for all the like shibboleths that people are trying to invent, like, oh, only
If you see an em dash or the word delve, it must be from an LLM.
Going the other direction.
LLMs almost never output typos.
be_hold_my_beer hello! logged in just to say this (-: for wiktionary on ios, check out https://motรฎ.net/ -- i really love this little neat app. the author is responsive to feedback too. happy hacking!
I don't know.
All right, that's acceptable.
16:44be_hold_my_beer yes, i with a hat
moti.net does that what is the character after the eye it's not a it's an eye with a little circumflex maybe whatever it is twitch did not recognize it as a url what if
17:16Anyways, yeah, this looks pretty neat.
Let me pull this up here.
Frici twitch chat can't deal with punycode domains and it just rendered it as text
Ah, yeah, so it comes from English Wiktionary.
So this is the same data source.
...33Neat.
Oh, export to Anki.
manateemon Neat app, export to Anki is huge
I am a big, big Anki fan.
You know, you know who else can't deal with puny code?
pushcx https://github.com/lobsters/lob…
He said, like a youth pastor, lobsters cannot deal with puny code, kind of deliberately.
So when this was filed like five years ago, homoglyph attacks were not as well understood, not as maturely handled.
And so...
I wanted to be real cautious about it and folks have contributed down in the comments that I found that they had a mdn has a nice resource for it and.
Someone has implemented chrome's algorithm for the same problem, so if someone would like to improve the handling of international domains in lobsters there is a feature available.
19:26Frici While I do understand the worry about punycode domains, there is so many attack surfaces on things anyway, punycode is the least of someone's worries (especially in this day and age that people don't look at a domain, punycode or not)
So this is good.
Okay, so the breakman build is passed.
Great.
...45Yeah, I think that's fair.
I think what you're seeing with Twitch is one of those things where
like lobsters except twitch is you know a million times larger
was built before it was a thing.
And the marginal benefit of properly rendering and recognizing internationalized multi-character set domains, I don't know what the right term is there, is low enough that I think the security hesitation has held everybody up.
But we have a pretty clear path forward, and it would be nicer to see
an IDN and highlight something that looks like a homoglyph issue rather than hold that up.
So let's go ahead and merge this.
chamlis_ by the way, do I remember hearing we were full on VIPs? I wonder if wiping the slate clean on the year anniversary would be nice to give new viewers a fair shot
I think if the other way to say it would be generally sites do better about it now out of the box, but we're old.
So I've got that merged.
So this one from Jacqueline I reviewed on the last stream.
Oh, that's interesting.
We're actually so the yes, I did.
The channel did hit a cap on how many VIPs it could have.
And then a couple of days later, a regular codebase contributor dropped by and I just didn't even think about it.
And I typed slash VIP on him.
And it set him as a VIP, so I think...
I know the limit is based on how many people you have following or subscribing or chatting or something.
Frici unique chatters iirc yeah
chamlis_ ahh nice
And so, as long as we keep getting those, I can keep adding VIPs.
I don't know.
The streams here are not overwhelmed with people catching my bugs before me, so it's not super pressing.
I don't know.
I've got to think about that.
Maybe catching a bug makes you a VIP for a year.
We could do it on a rolling basis.
I have put it in the stream notes when I added people as VIPs, so it wouldn't be too much to pull out of the history there.
23:44Alright, so kind of thinking a little about code based philosophy there that I am trying to make reasonable trade offs. There was the one Ah, yeah, so I had talked to Jacqueline about the README because she was a new contributor and was just kind of like, there's a lot happening in the README. So if you remember, I touched it up on, what, Monday's stream, last Friday's stream, something, and tried to organize it better. And the previous version, one of the most confusing aspects I recall that I talked about was it mixes getting set up for development with, oh, but also if you're going to put the site in production and start a sister site, this is the other thing you do. And it had been like that because I would just drop in notes as people starting sister sites asked questions. And I have been reluctant to make a commitment that, oh, this is an open source code base for running your own site that looks like HN or Reddit. Because or do I not want to maintain the site at that level of expectations? It's mostly we really want the code public.
25:49Oh, that's nice to have. So I still... It became kind of clear to me at RailsConf a couple weeks ago that using Docker for dev environments is becoming... I think it's probably a majority of developers now. So I am falling behind the times. It's nice to have someone who's actually doing it. using the the popular path to make sure that we're reasonable there all right this cannot be cleared oh that's interesting so rack mini profiler must be overriding huh
26:49so if you don't know rack rails works on top of a service called rack that has a bunch of middlewares and you can kind of think of them as a series of like shell pipe commands and the request and the response go through the layers of middle middleware like they would through all the pipes of a shell command all piped together and
Because miniprofiler is a rack middleware, it kind of runs after Rails.
So I can see how this limitation would happen.
That must have been really frustrating for her to have to debug.
manateemon Lmao
This is one of those comments that is like it's six words, and I can see that it's probably two or three hours of development time to figure out what the heck is happening.
This is great.
This test is really clear.
I like this a lot.
I'm going to leave that as a note.
28:25I've had you know, there's That joke about. And it's one of those that's also like retold about various famous engineers like Edison or something, but. Factory owner has a big factory or the Hoover Dam or something and.
29:26it's not working right and he calls out the expert to fix it and the expert wanders around for a half an hour and of course you know by the time the expert is called all the guys attempts have failed and his experts have failed and all the engineers there have failed and nobody can make this giant expensive machine work right and the expert comes out and walks around for half an hour and looks at it and pulls a piece of chalk out of his pocket and marks an X on the side of one of the machines and says, open it right here. There's a out of alignment or there's a you know thump it with a hammer right here and they do that and it immediately starts working and you know the day is saved the plant works the electricity is generated I'm kind of vague because I've heard like eight versions of this story and then the expert sends an invoice for $10,000 and the plant manager goes what that took you that took you ten minutes Can I see a detailed invoice? And the expert sends back a new invoice broken out into two line items. And it says, making a chalk mark $5, knowing where to make a chalk mark $9,995. And it's a parable on the value of expertise. That experience of an expert being able to condense a huge amount of work into a little thing. is exactly what Jacqueline is doing with this comment here of a very surprising and confusing thing is now like a little tiny chalk mark on the side of this one test. So I like that a bunch.
31:37manateemon Nice segment. Could one see Rack as middleware that come bundled with rails?
all right so let's get this one merged and then this other one so this one about moderation is we have the mod log and
32:13nice segment no i wouldn't call rack itself a middleware i would say that rack is the orchestrator and almost rails is i mean we say rails is the hosted application but it kind of also is one of the middleware and there is no top rack manages all of these things that are like little Unix pipe commands that know how to input a request and output a response or kind of tweak one as it goes by. Rails is just different in that it assumes it will be the last one in the chain, you know, last one to see the request, first one to see the response and do most of the work.
33:12So this one is not too exciting because it's not a bug on the production site, but we do want people to be able to stand up the site locally and not see 500s.
Ooh, and it even has a test.
So our pagination, this is one of our long-running things.
manateemon Hm, I will have to read more about it to grasp it I think. Thanks!
There's even an open issue for it.
Our pagination has always been a lot of copy and paste.
...48Do we have this issue elsewhere? Yes, where we assume that there are things to paginate and they don't have this same change. So the question is, do we want to apply this fix to the other places that pagination code is copied and pasted? Boy, do I not want to do that, especially because I would rather completely replace our pagination.
34:26So someone has, is this the one I'm thinking of?
There's one of these that has a, yeah, see, they also talk about it as a pipeline.
pushcx https://www.simplybusiness.co.u…
That's the dominant metaphor.
Yeah, here we go.
So this is kind of, let me share this link, because this is probably the exact one I'm thinking of, but the, do they not?
No, hang on.
christophermolti message failed to send??
All right, so if we go back up to this little diagram,
It is what I am trying to say of Rack's job is to manage these four things.
Message failed to send.
Christopher, I don't know what you're saying.
If Twitch censored you, I don't even see a notice that it did.
Welcome anyways.
christophermolti Sorry, i sent a message and it failed to send. Thanks for the welcome
So Manatee, if you look at this, this is kind of the sequence of how these middlewares work.
And they've drawn it as a request response diagram.
The middleware metaphor kind of, to me, stacks them vertically, but you could go horizontally.
And so if you imagine one more column here, you would title it Rails, and then there would be one more call and one more response.
And so what Jacqueline has pointed out is because
mini profiler is one of these columns, let's find that it sees the call before rails, but it sees the response after rails.
christophermolti If you don't mind me asking, what do you develop on? what flavour of linux is this?
So if it wants to add its own cookie, it happens after Jacqueline's code to clear cookies back here.
Does that make sense?
pushcx https://push.cx/stream
No, Christopher, I don't mind at all.
This is arch Linux.
And if you look at the stream archive, there's a fact that has some of the
manateemon Oh, wow. Yeah. Hats off to her, that is a deep dive for sure
David Price- config files and other kinds of what's that terminal questions I don't think anybody has ever asked distro before.
Alright, so.
christophermolti perfect, thank you! I'll definitely look at that
pushcx https://github.com/lobsters/lob…
pushcx https://github.com/lobsters/lob…
David Price- Given that we've had a bug hanging around for pagination which yeah agitate.
This one, 394, has been hanging out for ages.
I think I will just accept a one-off fix to this thing and not worry about other things that might have equivalent bugs.
It's just not worth getting into them when I want to completely replace them.
37:23Right, so this one.
...41Supply a moderator that doesn't exist.
38:25So what if I said, took this, and I said a moderator was, rather than a left, who is actually a moderator, let's say Christopher, who just dropped in, and I still get a 404 rather than a 400, and that's not a distinction I really care about.
39:16christophermolti I've seen people on hacker news moan and bitching about the ruby on rails stack that lobste.rs uses. How it's from a maintainer/dev perspective
I think I w I would echo the famous quote from the creator of C plus plus yarn, Sue strip.
He said, there are two kinds of programming languages, the kinds that everybody hates and the kinds that nobody uses.
And if people hate rails,
it's because it's useful for getting a job done and there are always things to be frustrated about if you hang out on the stream, you will hear me gripe about the things I don't like about rails.
But I use it, it works.
I think it solves a set of problems in a way that's been really satisfying to me for a long time and.
christophermolti ahah, as a cpp dev i know exactly what you're talking about
I'm still a ways off from having such big problems with it that I want to pitch it and pick another web stack.
twitchtd rails isn't perfect, but I haven't found anything that's perfect
Yeah.
So what am I saying about this?
40:31Let's see.
41:24Frici Nothing is really.
christophermolti god i love pirating jetbrains products instead of being forced to use vim
okay well not the call i would make i mean if you love the problem or love the products they're not really expensive compared to developer salaries i don't know it's funny we just
undertook a big, giant project on lobsters to replace our free Ansible deployment scripts with a service called Hatchbox because it is absolutely worth 10 bucks a month to me to have an expert work on that and maintain it full time.
The benefit of knowing an expert is taking care of this instead of me is
christophermolti I'd probably pay them if they didn't need me to make an account
just absolutely a no-brainer yeah 10 bucks a month is a wonderful steal nobody tell chris his prices are too low okay i don't need them to be higher but yeah all right so man if you don't like making accounts
christophermolti honestly fair
I don't know how you get electricity to your house or anything everybody wants you to make an account for everything now.
held a bagel shop wants me to have an account for frequent customer and i'm like you know you know my name I come here often enough for bagels that.
You know my face.
All right.
Maybe that's one of my old man characteristics of, no, you actually know me.
All right.
Entering an empty table.
44:17christophermolti yeah, but that's absurd, really.
Frici they do, their system doesn't and that's the pain of running your shop in something you don't fully control.
let's go ahead and merge that all right so i've merged three pull requests which is pretty great but what state am i even in oh i'm still i've been yeah okay so
I demoed it on stream, but I've been working on recheck a bunch the last couple of days.
And so I had showed, you know, as long as I'm here, I'll just show it.
I had showed on stream that it generated a presence validator so that you could immediately find instances in the code base of things that should not be nil, should not be blank.
And we found one.
What was that on story?
Yeah.
twitchtd jetbrains stuff is alright, datagrip was amazing for someone who worked with a lot of different dbs
so if we go to valid story i also so number one i've cleaned this up so there's less of this none or irregularity but i've also tweaked it to start generating length validations so if you were here for that demo stream you may have seen that it said there's no examples here it just had a comment that said coming soon to the beta well now it's here and so it's actually checking the length of the titles
There are eight or nine built-in validations to Rails.
I don't remember, but it's like length, presence, absence.
twitchtd and yes, we paid for jetbrains :)
Oh, I don't remember the rest.
They're all in a case statement.
chamlis_ filling in cases one at a time like that and getting more and more working is always so satisfying
And I am making them all magically transform into validations because boy, does this find bad data.
So let's label this.
Recheck.
ChaelCodes I mean, I won't tell him...
This is just a work branch.
ChaelCodes https://www.twitch.tv/pushcx/cl…
Let me get over to master.
And then... What was I doing?
Oh, git fetch.
46:36Did you clip me asking people not to tell Chris Oliver to raise his prices?
ChaelCodes lol Lobsters does ad reads!
Why does it... Is that generated or did you say empathetic, embracive, moon feels bad man?
...55Frici nah the url are autogenerated
Lobsters does ad reads.
Frici but that was a nice coincidence LUL
Well, I am a happy user.
ChaelCodes Automatically generated, but so accurate!
christophermolti Clion is half decent on windows, but i'm thinking about moving back to linux. There's too much overhead with gentoo maintainance, and arch seems to be okay right now
And I have given testimonials to stuff we use.
Yeah.
I would hope I don't come off as abrasive.
Only when I'm having to tell people to be kinder on the site.
Do I get into that?
Cleon.
I don't know what Cleon is.
Frici Clion is Jetbrains but C++
A cross-platform IBE.
Oh, okay.
I didn't know the name of JetBrains' actual products.
I've been using Vim forever.
I will be buried in a casket with Vim.
So I don't actually know all of the names of these.
chamlis_ I feel like having "feelsbadman" as a potential part of a random URL is asking for trouble
And I sure have not written a for serious amount of C and C++ to know that area at all.
All right, so this is sorted wrong.
Okay, no new bugs, no new updates to bugs either.
christophermolti I've used neovim a whole lot, do you have any experience with that
You know, I've seen, and at the end of that, there's a slug of random characters, the, what is it, I-O-T-L-J-N-T-X.
There is a small hassle that if you generate enough of those random alphabetic URLs, you will generate naughty words.
christophermolti youtube had a problem with this, had fullcaps n-word for a url
pushcx https://en.wikipedia.org/wiki/S…
that'll be curses and slurs and things and it does catch my eye that that i have seen people make naughty word lists and if they generate something with a naughty word they regenerate it but the easiest way to avoid that is to take all of the vowels out of your training set so then you know you only generate fck instead of the naughty word it helps a lot with the skunthorpe problem that has come up on stream before but
christophermolti we've watched tom scott cx
ChaelCodes At 10+ years in tech, some stuff, like editors, start to feel temporary. Like a flash in the pan.
Very clueless filters oh no that's that's a very unfortunate event, but that is the exact event yes.
49:21Tom Scott CX. Is there a.
...35christophermolti oh tom scott did a very entertaining video on this
I don't actually know...
If you put Tom Scott together, is there like a slur that I'm too young to know?
Oh, it's a YouTuber who made a video on it.
Okay.
Yeah, I don't know any YouTubers.
christophermolti btw what do you prefer being called?
You know, I just actually realized I watch less video
ChaelCodes Yeah! Tom Scott is great!
christophermolti push? cx? pushcx
pushcx https://push.cx
and less movies and less tv in the summer because i like to have the windows open and i live downtown and there are like trucks and planes and all kinds of things you can call me peter or pushcx i'm don't really care which but my my personal site is hp push.cx so i just use pushcx yeah push is fine peter is fine
not too particular all right so i will do my usual bumper that this is lobster's office hours and if anybody has any questions about the site or the code base or the community or a particular moderation decision or wants to run a query against the production database we can do all those things you can throw a question in chat anytime otherwise i maintain the site and
I guess the next thing I want to do was nudge this notifications, but otherwise my to-do list for this stream is pretty short.
Like, I would like to work on these kind of deployment debugs, even though they're pretty uninteresting.
I do a little bit look for what's entertaining on stream.
And so, like, Chambliss has an outstanding PR for
updating our common marker that's going to, let's see, I think I'm about 30% through all of the site comments to figure out if they differ between the old and the new one.
chamlis_ staring at HTML diffs for three hours will surely be entertaining
And I did like two hours on stream of comparing them.
Do I still have that terminal open?
No, not on that desktop.
Yeah, here we go.
So there is a very exciting script.
I didn't mean to put those usernames up.
So a bunch of users have renamed.
Actually, it's like two dozen.
But there is this very, very long script of here's every comment that has differed between the two.
And we are up to, yeah, 156,000.
And just for context, there are roughly 600,000 comments in the production database.
christophermolti remind me i need to get invited into lobste.rs before i'm done with my project
Yes, so we are not going to show that on stream i've just been doing a.
You know, like the Pomodoro method I set a timer for 25 minutes and then every day I do 25 minutes of the diffs and then I change gears.
You know lobsters is not a great place to promote a project, it is a great place to discuss things, but if you see it as a traffic source or an attention source.
christophermolti whaaaat wdym you won't show user data on stream
it's not going to go super well for anybody.
53:00chamlis_ I know github did a big migration of their markdown backend, I don't know if they did any writeups about how they tackled that
so oh i actually touched up my jj config look at that i i got like a one-liner thing here somebody had a link on the did they i had no idea okay so yeah i want to be on master not on this
...36I want to be on the replies sub nav now who sub nav is it.
...46This one. yeah so let's make this let's make thomas's notifications visible. and.
54:05Add a note explaining what it is. Let me get the Rails server tab up in the background.
...59Oh, I can't do markdown. I have done this before. I'm so used to typing markdown in comments on the site that I put markdown in the HTML. A little embarrassing. It's shown up in the, what do you call it, the about page.
55:39I didn't.
...44Yeah.
...58Oh no, I did talk about performance. Okay.
56:13Thomas, how did you handle, how does Replying Controller handle notifications actually? So it's when you look at slash unread, it clears the unread replies. But that's just the number, right? I don't remember. Does it base unread on replying on read ribbons? Or user where is unread is true.
57:12What is this?
...21Okay, so when you hit unread, it nudges the read ribbons.
...32Which, yeah, is technically wrong, but everybody must be used to it. So when you look at When you look at an individual story and then you come back a couple hours later and you look at it again, comments will be highlighted. They'll have a little like in parentheses on red next to them. And we do that with a read ribbon, which is like a ribbon in a book with what's the date you last looked. Any comment posted after this should have a little clickable on red header so you can skip through and see just the new comments. People love this. And the slash replies is based on that, and if you look at the unread replies. it's not just going to mark the individual comments that are replying to you, which is all that will show up on that page as read it's going to nudge the read ribbon for that whole discussion. yeah so. People must not be using the unread replies page very much if this hasn't been reported as a bug. That's okay.
59:15All right, no, it's not code. We want TT, right?
01:00:06I want to just say it was a hell of a lot easier to implement this way.
...15I'll just say I don't need to justify it too much, I don't think.
Everybody has had the, like, transitional states are hard.
I don't want to add a custom, a whole ton of code to combine them, especially because they work in fundamentally different ways.
Like, a notification is a thing that you are setting whether it's red or not.
where the discussion is the latest timestamp.
Yeah, I think the... Let me double check this.
The notifications controller doesn't move the read ribbon, right?
twitchtd it doesn' move read ribbons
It just marks the... Yeah.
Do I want to explain that?
01:02:03hey thomas do you think that that's a bug actually now that i typed that out yeah so it doesn't move read ribbons and i don't think it should because so hang on let me sketch this out so if we have a story and there are like comments abc right and i write d and then I get two replies, E and F, and in the meantime, this guy and this guy get replies, right?
...54So notifications will show me E and F, and it will show me they're unread, and I can read them Everything is great. When I come back to the story, E and F will be listed as unread. G and H will be listed as unread. But E and F are not unread because I saw them on notifications. And currently, that unread tracking, I mean, it says unread, but it's really just a timestamp. I think this, what I'm arguing for, not arguing for, what I'm talking myself into is that I should update this single story view so the concept of an unread comment is it came after your read ribbon and you have not read the notification. Because if I read notifications unread and I see ENF and I go back to the individual story, they're going to be highlighted as unread again. And it's confusing to have the same word used for both. And I have actually read them. Like I went to the page and I read them.
01:04:16Yeah. Let's see if that's something I can just hack out.
...31So we grab the ribbon. Yeah, the unread tracking. God, does that just logic happen, happen down in the view? Yeah, it does. So the individual comment asks the read ribbon and then the read ribbon is just if it's unread based on the date so i don't want to add a 1 plus n
01:05:37But I think the story view has to start loading your notifications to know if they're unread. I guess it really only has to load.
...54Yeah, all right. So I'm going to delete this section, put this back.
01:06:08All right. Oh, there was also the style thing I wanted to tweak.
...24Yeah.
...31When it's a message. The subject is in bold on a second line and what's in a comment. It's not bold and it's on the same line. And I would like to. Well. Yeah, I think they should maybe be a little more similar message. So that's. Here.
01:07:19So this one puts the unread where in relation to the title.
...34Title is 119. Unread is 75. So unread is before.
...51Go back to message. Notice message. Notice message. There's unread. And then there's the subject, which we'll put in a span because I'm going to make it in line.
01:08:30How did you pick bold, by the way, for that, Thomas?
Was that... Was this already here?
twitchtd for the subject of the message?
No, you added this.
Does the... Yeah, for the subject of the message.
Because I didn't think the other message views... We don't use a lot of bold on the site, so it caught my eye.
01:09:05twitchtd I just liked highlighting the subject and making it distinct from the body
Yeah, I think if it's inline, that makes a lot of sense.
If it's up on its own line, it's clear because it's up with the other metadata.
twitchtd I think the bold was when it was inline
twitchtd I know we did some styling changes
so i'm going to go ahead and remove this then my one hesitation is that really is going to make messages look very similar to stories it says re instead of on and it has the message icon instead of
the voters now we can get some feedback on that we'll see all right so where does this load comments
yeah from story threads for presentation.
Well here's a question should know I don't think I think if we think of notifications as their own noun viewing the story shouldn't clear the notification shouldn't mark it as read.
We really want this to be one way.
01:10:56Yeah. So.
01:11:07We don't want to include. All of the notifications we really only want.
...21So. This is just a story show, right? Yeah. So what I want is to say. That we have a. Read by notification is. And I'm just going to write the query here and we'll think about a scope, but.
...59if user yeah types because i want i want it to be empty array for anybody so we will say if user yeah we'll do it we'll do it the easy way and then i'll refactor if user read by notifications equals notification where let's go through a user notifications cause it's on the user model, right? Notification notifications. Yes. Has many notifications. And then do we have a, no, we don't have any scopes. So I will add a scope red.
01:13:02is new I guess we only need the ones that are newer than the read ribbon That doesn't seem worth the extra selection. We don't want. We want the opposite.
01:14:08All right, in one line. Yeah, I'm fine with this. This, otherwise it's that. Have a short little turn area. I almost want to push it into a scope on notifications or a scope on, yeah, but Rails is so bad at the null object pattern. All right. So we got that. And then. That automatically is passed into the view. Which is stories show. And where you render the thread. We will pass along. Read by. You know that. That returns the comments. That's not what I want. Or it returns the notifications, but what I want is the comments.
01:15:25And I don't know that I can ask for that, can I? Like I want, this is a collection of notifications, but I want all the comments associated. What's the right way to get that out of the Rails queries? Do I have to search for comment?
01:16:07select right no that gets me the id i want look no dot limit three dot look that'll get me just the bear yeah
...44twitchtd btw, since notifications is polymorphic, you will want to do where(notifiable_type: "Comment") as well
Oh.
Yeah, thank you.
01:17:57But this is still not what I want, because this is going to be every notification they've read, rather than on this story. And Rails Active Record really doesn't love this kind of join.
01:18:35twitchtd you would have to pluck notifiable_id instead of comment_id as well
so i really do want to say joins comments locations read comments join comments where comment i gotta test this in the no i only care about the comments that are read because on the thread view i only want to show comments i don't care about the notifications
I'm going to run to sequel on this where comments story ID is.
But this is going to fail with merge stories.
Oh, merge stories, why are you like this?
01:19:53Didn't I? at a helper method for this because it comes up so often it gets me an array of this story plus all of the ids of the merge stories and i do not have it apparently
01:20:31Nope. Am I doing it in the view?
01:21:11This is me writing the ugliest version I can. And then if it's correct,
...47Doesn't this have the merge stories loaded at this point?
01:22:42Why is this way down here? This is what I want, the list. It's going to preload everything. So addStory.mergeStories is what I want. I want to slot their IDs off. This is a lot.
01:23:25I even got all the parentheses to line up. I'm going to be a little surprised. And I definitely didn't. So that needs to close. That needs to close. Yeah. What else? No, I did close those.
01:24:02The outerware. Define method notifications for nil. Let's just put in a placeholder user.
...20Define methods for of comments.
...29Did I not save the notifications model? of comments of messages.
01:25:07what am i missing why can't i just pile scopes on like read as a scope and it inserted it and it didn't care i can't do oh comments
...44Did I typo something here? Why did the read and unread scopes work but not notification?
01:26:00I guess I hadn't saved it somehow? Yep, hadn't saved it somehow. OK. Undefined method ID for nil, let's say. We've got to have a story, preferably one I've commented in. Well, let's just grab a story. Can't join notification to association named comments. Does it not have a join the notifiable?
...54Can't eagerly load polymorphic association. Okay, so we've got to turn this whole query inside out to start from comment, don't we? So comment where, and we can put the story part here. Actually, this part, We can just lift wholesale. We may not lose all of this. So find me all the comments on this story or any merge story. And then we want to find where the ID of the comment
01:28:06is like this so okay there's the preload for story the preload for users and then find me all the comments on this story and the comment id is in search the notifications for me where i have read them and it's a comment that's correct that's what i want right all the comment notifications for me on this story. This is Rails being clever. It knows it doesn't have to write an in if there's only one element. I'm gonna double check that.
...57Yeah, see, and then if it was a merge story, it would transform into that, which is fine.
01:29:46And.
01:30:07twitchtd what was that User/:pushcx syntax?
Thomas, how does this... Filtering.
All right, so this is probably correct.
Oh, that's a hack for me.
It's a convenience.
...30Yeah, here we go.
twitchtd oh, that's a custom method
So you can define...
twitchtd that's actually really neat way of using / in rails
methods in ruby for those infix operators like slash like custom braces yeah and so for each of them it looks kind of like there is a user directory and i am looking for pushcx and so it is just doing that yeah there's like we're looking up story and comment by their short id just it makes life easier for me in the console
I don't remember where I saw it.
I want to say on Blue Sky or something.
Yeah, you can do it with a handful of methods that work in FIX.
My other favorite Ruby kludge, I have been looking for an excuse to use this, but if you have a class foo,
new it'll take an eye right so obviously what are we mad about oh it's not it's not new it's initialized i never remember this
01:32:14so great you can also say you can create a method we'll just leave it without arguments actually just to save confusion
So I could also say foo one, and I'll get wrong number of arguments.
So in Ruby, functions are in a different namespace from classes, or methods are in a different namespace from classes, basically.
So this foo method is totally unrelated to foo the class.
They just happen to have the same apparent name.
soul_serpent Ah, lisp does that with functions and variables
And if you have the parents or a, I think it def bool arg, let's method with arg.
01:33:35Ah, hi soul serpent, yeah. So if I said foo with one, yeah, I do get it. If I say foo like this, I still get it. So I have been sort of waiting for an opportunity to use this really dumb, surprising fact so that I could have instances of foo where foo is say a immutable data type and it has a constructor that throws so that you cannot create invalid instances. So this would be like, I don't know, we've been talking about users. If user has to have a username of link three and you pass in no string for a username or a short string, it just throws, you cannot construct an invalid object. And then maybe like, this method could be the one that runs all of those same validations and returns them as a array of errors so it's sort of the the result type i don't know it feels like there's something here waiting to happen if anybody wants a weird corner of ruby syntax to play with
01:35:10This is getting ridiculous.
...47oh thanks cat he's laying on the mouse again all right so we have this partial so now down in the thread
01:36:32That's kind of tortured logic. Is there a Ruby enumerable that's the opposite of include? I never remember.
...49Yeah, so we have include. It's not reject.
01:37:01yeah nothing's jumping out at me as the inverse.
...18So now comment is unread if it is before the read ribbon.
and
It is not read by notification.
I think that's what I want.
Let's look at this diff.
twitchtd https://api.rubyonrails.org/cla…
We've touched a couple of things like the message styling.
This kind of surprising functionality.
Added the scope.
Exclude.
Aha!
Yes, that's exactly what I want.
I didn't.
twitchtd it's not in ruby though
twitchtd it's in rails
How did I not see that in the list?
So this means that those.
01:38:48Let's run the tests here.
01:39:23So what's our issue?
...34Oh, I didn't include it up at the top here.
01:40:39so off screen because it's my inbox i have peaked at notifications and i want to add that why is there not a reply link on a message there is on a comment and we get the inline comment
01:41:11For this, we have to click the timestamp. Let's make it the timestamp or the subject.
...52twitchtd for messages, it just relies on the message controller for replying
Looking good.
01:42:27All right, I feel like this is pretty good. Let's run this sweep one more time. I'm going to do that in the background because I expect it to pass. I just want to look at the diff one more time.
...48Added a couple of scopes, fixed an odd behavior.
01:43:28Oh, no, a critical vulnerability. What do we got GitHub? So this is Dependabot, a very nice free service that GitHub gives us and tells us that we have. No Pugiri patches lib XML. I feel like we get one of these every couple of months.
01:44:00soul_serpent Can I ask why you left stripe?
soul_serpent lol
and then the other one is about thor which we don't use so i'm not worried about it yeah of course you can ask the answer is i have nothing disparaging to say about stripe and i have nothing to disclose about why i have nothing disparaging to say about stripe in more practical matters
I was working on IndieHackers.
So I worked on Atlas, which is a tool for incorporating startups.
I worked on onboarding, which is when someone signs up to the dashboard.
So there's a bunch of conversion optimization kind of stuff happening there.
And then there's IndieHackers was owned by Stripe.
So it is a podcast forum and news site for...
independent entrepreneurs the idea is to inspire especially developers because it is kind of techie focused but basically the core message of this site is if you have a professional skill that someone pays you for you can in some way make money directly off of your skill whether that is
A product an E book, of course, consulting and indie hackers is intended to I think inspire its readership to do exactly that, and it started independently of stripe it was acquired by stripe when it was.
six months to a year old i don't remember it was run by stripe for about six years i say run by stripe but it was still managed by the allen brothers courtland and channing and then i joined and i worked on it for two and a half years with them and then it was spun back out as an independent company and that was when i departed stripe by the calendar
All right, so here's this.
Let's just bump Thor.
I don't really worry about it, but... All right.
soul_serpent hows jj been over git?
Let's take a look at... Let's say bump Okugiri Thor.
I'm going to grab the CVE number here.
Where are we?
Oh, it's more than I care to list.
I love it.
I've left a couple of long comments on the site about it.
pushcx https://lobste.rs/search?q=comm…
Oh, I don't have my bookmark shortcuts here.
There we go.
So start from the lower one, because I kind of introduce it and what I like.
soul_serpent thanks :D
And then just a couple of days ago, I left a second one in response to a question.
But short version is I like it a lot.
And I am slowly replacing all of my use of Git with jujitsu.
Yeah, I should take those two comments and format them as a blog post.
Because I kind of brain dumped a lot of stuff about not just version control, but there's like a long digression in the middle about
software design and one of the things i really like about jujutsu is it has a much friendlier and safer command line interface than git and it was funny i cited a specific thing i did with jujutsu of i did this and it popped up a message that was like hey you probably wanted to do this other thing here's the tool and then i cited that as
very very positive because i really it was dead correct about what i was doing and even if even if it hadn't you know nailed me i would have liked to know that for sure and then the person who added that message popped up in the comments and was like oh hey i added that so that was a very nice small world moment
01:48:41Let's bump that. And I haven't actually deployed. I meant to do that after those pull requests, but we can just do this one now.
01:49:10twitchtd if I don't respond to any questions, I'm walking the dog
Frici oh yeah after enough office hours I finally ended up actually giving it a try too
Yeah, no worries, Thomas.
So I finished with notifications for now.
And we'll see how the responses come back to that.
Hopefully, it'll be pretty positive.
Frici I notice that even though I fumble to start with... i fumble a lot less than a decade ago with git... and I recover faster
But I would assume that people will catch odd behaviors or want changes.
That's just the nature of real world use.
So we'll see how that goes.
Cool.
So that's deployed.
So now we will start seeing that.
Let's put this in here.
Also needing a notification.
Frici unsure if that is me being much more confortable with VCS or just a niceness to jj's usability
Comment as read on Story View.
Also added a explanation of what the UI is.
Yeah.
Yeah, Pritchi, that is exactly the main point of my first comment that I linked there on Jujutsu.
I should say the earlier comment is,
it's just such a more polished UI.
And part of that is it learned from Git.
Git had a very funny start where if you look at the early stuff, the early comments that Linus made about the UI, he would say things like, oh, I'm working on the plumbing and all of these commands are the low level Git operations and I just need this thing to work and I have the whole data model in my head, so it's fine.
and surely someone will build a porcelain on top of it on top of the plumbing and it will have the nice friendly user interface and some of the commands got called porcelain but honestly they were not higher level or friendlier or safer than the plumbing commands
And the distinction is really not clear if you're looking at an individual command, deciding whether to run that, and wondering if it's going to put your repo into a weird-ass state.
So I think it was just maybe adopted faster than wanted.
And then as soon as it got adopted, the GUI kind of froze in amber.
Yeah, I don't know.
I've kind of wondered about that over the years of because Git wasn't the primary thing he was maintaining.
Obviously, he was maintaining the kernel.
I don't know the early days of Git to know if other folks stepped up to do more maintenance and if they felt that they had the authority
to make breaking UI changes to the command line.
But regardless, yeah, the Git command line has a lot of odd corners in it and they're very reluctant to break backwards compatibility because they're in so many workflows.
And so you have stuff like Git switch is intended to replace checkout because checkout has like
three different uses and some of them can throw away work and switch is like no let's just for just the process of moving between branches let's make one command that does that and does that safely but they're never going to get rid of checkout is my impression it's not going to start printing deprecation warnings there's not going to be any like you have five years to change your scripts and your usage
And it's that that's a cultural project thing of, are they willing to make breaking changes?
And I guess I already noodled on that like an hour ago about lobsters of wanting to be a little more conservative in the core UI.
And that's things like reading replies and writing comments.
So Thomas is working on something very big and central and important that I don't want people to feel unsafe in.
but I am willing to change the core UI to improve it.
Jujutsu also is, so I've only been using it a couple of months, but I have seen some of the discussion on their Discord, and they are willing to make breaking changes to their UI.
It's a lot easier when you are pre 1.0.
I hope they maintain that spirit, because nobody gets everything right the first try.
soul_serpent I've fallen in love with magit so it's an even harder sell for me :c
And if you freeze an amber, I don't know.
I've been thinking about that a lot.
pushcx https://push.cx/discord-vs-irc-…
We have some distributed protocols like, oh, that's where I talked about it.
In the Discord kind of roundup.
So I'll throw this in here.
This is a topic that the chat room kind of rehashes pretty regularly.
I had an aside here that most of IRC's problems are structural.
Chat is very valuable, but feature deployment has stalled because it's brutally hard to reach consensus.
Maybe email and the web managed it because of competitive commercial use.
Maybe the protocol isn't as extensible because it's not as forgiving of unsupported features.
There's probably an amazing book waiting to be written about how open protocols and standards thrive or die.
And this is the same kind of thing
on a smaller scale in an individual project like Git or Jujutsu of, can it make absolutely vital breaking changes?
And the web has managed this and email has mostly managed this, but they have been, you know, they've had their flaws and they have their old cruft in them, but they have succeeded beyond anyone's wildest dreams at the time those protocols and standards were introduced.
where IRC has not.
And I don't mean to be mean to IRC, but it has had nothing like the success of email or the web.
And the same kind of thing of Git and jujitsu and even lobsters is it's not enough to be good.
You also have to have
the ability to improve and make changes and accept that some of them will be mistakes
And keep going and I assume everything this is 100 times easier in a small project like lobsters or a coherent single project like jujitsu and get, then it is a distributed protocol with multiple stakeholders, like the web chat email.
I don't know there's.
feel like i'm rambling back and forth over the same couple of points because this is something that i've been chewing on in my head for the last year or two a lot and it feels like i hope someone will write an incredible book about what this is that some projects are more adaptable and more capable of growing than others
Because I think that is by far the most important thing.
You know, one of my personal philosophies is it kind of doesn't matter where you start as long as you're improving at least a little bit.
Or I've heard it said that a little bit of slope makes up for a lot of Y intercept.
01:57:52All right, so let's close out my many tabs. Is there a tab close? No.
01:58:11That's what I wanted. All right, so we've got that deployed. sites not on fire right so off screen i am logged into prod and i'm going to go peek at that new notifications to see that i see my little message oh good and then like here's a message and i can click on it and then if i reload it shows that it's red Oh, that's a bug. All right, so. Messages controller. When I view an individual message, it should be marked as read. This message. yeah it has many notifications but i don't so what i want is yeah thomas are you back from walking your dog
01:59:58I guess not. Well, must be a lucky pup to get a nice long walk. Messages have their own read tracking that we should replace with notifications.
02:00:18And I am going to
...43Frici @soul_serpent there are some attempts already but nothing as comprehensive as magit
1649 okay yeah that's unmerged.
02:01:15Yeah, you know, I've never used Magit, but it is one of those things I hear cited as a real power tool that people love and never want to give up.
02:02:11Frici that said as I was saying earlier I find myself less worried or jumping into magit/fugitive when working with jj than when i worked with git
yeah i'm i'm still getting more comfortable with rev sets but it's kind of obvious how much more powerful they are and i've done it here on stream where i pulled something up and i ran the git integration of fugitive because i wanted to see that here in the editor on something
I have no idea if someone is making an equivalent for Jujutsu.
That would be nice.
I don't use this all the time.
I don't know why.
I made a push a year ago to use fugitive more like to use its interface for viewing the diff I made and making commits instead of as you've seen like pop note or command line and doing it.
It just didn't take I guess i'm too comfortable with the command line.
that's familiar.
Alright, so.
let's let's grab this link and we'll say at
02:03:44pushcx @twitchtd When you're back, I found a small bug: https://github.com/lobsters/lob…
all right so let's see i've been going oh right on for two hours so it's a good time for another bumper that this is office hours for lobsters if anybody has questions about the site the code base anything else feel free to pop up anytime here in the twitch chat and ask and then otherwise you can just kind of hang out and look over my shoulder as i work on the site
02:04:16I'm kind of peaking it. Yeah, this is spam. So somebody submitted a story about AI and digital agencies and it's self promo. And they're not active elsewhere. And I had another story removed three weeks ago. Yeah, this is just. Okay.
02:05:27Not dealing with that guy. And there's like a
02:06:14Just tidying up.
...21And then there's a political rant. I clearly didn't.
...45Clearly did not make a great pass down this this morning. So one of my kind of twice daily chores is that I read slash newest and pull off topic stories. Not very exciting, especially if I'm not actually showing it on stream, but. All righty. So with that done, usually stream for another hour or so, but I'm kind of short on topics. Let's take a look at HSTS because I think this is like a caddy config. Yeah.
02:07:46We have previously had this enabled for lobsters and then disabled it after a while. When we were doing a bunch of migrations, the one issue is
02:08:09Oh no, this isn't certificate pinning. This is just, you should only be using HTTPS. Yeah, this one I'm fine with a very long timeout.
...23And then I think we used to be on the HSTS preloaded list and then we stopped serving it long enough that we fell off. all right so let's see if caddy has an option for just enabling this or if it's just a yeah if it's just a single header we could add this to rails yeah i could set a header field and i think i'm fine doing
02:09:10chamlis_ fwiw, the .dev domain will have HSTS enabled at the top-level
yeah so let's curl dash i the prod and it is not present we put most yeah i'm familiar with that one
...49hicarobot your comment in the pr is weirdly formatted due to the misplaced backtick
Yeah, we can put CSP.
My comment in the PR.
Oh, did I typo something?
Thanks for catching a typo.
hicarobot no worries!
Let's bring that back.
Ah, I see what you mean.
02:10:17There we go, easy fix. All right, so we will go ahead and say, grab this.
...33yeah one year is fine so well actually it doesn't matter whether you have the huh Chandler, because you just talked a second ago, the CSP on line 62, is there a reason that it uses the visitor matcher? Because I would think we would want the reports from everyone.
02:11:33chamlis_ that's the fallback one, for people who got served from the cache and didn't get one set by rails
we say speaking of git blame no we didn't say anything about it ah okay well then let me not appear in the middle of it i'll put this up here and then i'm gonna grab the url here
02:12:12And then let's add this comment.
...44Okay, yeah.
...50This can be re-enable, HSTS, fix. What was that issue number? This was actually easier than I thought. I was thinking of certificate pinnings, a bunch of work. 1676, so let's grab that. I don't know, I could wrestle with log rotate again.
02:13:23All right, so let's deploy. And then also I'm going to have to bump caddy. So anytime we touch the caddy config, there is a...
...54Where am I?
02:14:00There is a button in the Hatchbox UI that I have to click, so I've got that up off screen.
All right, so the code is deployed and I am clicking update caddy.
And the log says completed and the site is up.
And now if I curl.
hey strict transport security max age beautiful i like that we've got this together so this whole thing with the caddy file pre is me hacking around a limitation of hatchbox a little bit i praised them earlier so this is my my you know fair and balanced griping
When we have tweaks to our caddy file, rather than telling Hatchbox, hey, here's my caddy file that I want to use in the repo, there's just a text area on the control panel where you can paste in your caddy file.
So there's obviously no automatic versioning of that.
twitchtd @pushcx thanks, I'll work on that (not right now)
So what I pasted in was,
this caddy file that imports these files that live in the repo.
And that's fine.
This is a little bit clunky, but I'm fine.
Oh, thanks, Thomas.
Yeah, no rush.
Just expect that we'll get it reported as a bug probably in a day or two as folks start working with the new page.
02:15:48Well, that's horrifying. Is this just a post a day ago? No, a year later? Uncheck some errors. It drops all the subsequent frames. I don't think I knew that. I assumed.
02:16:14Huh. That's kind of surprising behavior. Do they explain why they do that?
...31chamlis_ if you'd like a shorter one and you haven't already handled it, I commented in the missing avatars issue a while ago
Maybe this is a C thing where they wanted to return a single integer rather than a variable sized array of the frames.
...47chamlis_ I think sqlite disclaims all responsibility in the face of disk corruption
Oh, did you?
I missed that.
02:17:31Oh yes, I haven't changed my email for ages.
...56So what's yours is. I'm going to just copy this link. Let's just do this here. My email address is actually all over my profile, so there's nothing secret happening here.
02:18:27Well, let's run yours, and we get a 200.
And then if we do mine, yeah, we still get a 200.
So if I take that off and I say save it to push the x dot, it's odd that it's a JPEG and not a PNG.
chamlis_ I get a different hash somehow...
to pull this off here because i know firefox does like a completion which cx code lobsters push cx dot png no dot jpg whatever the file format huh you get a different hash somehow
Did I type on my own email?
02:19:37chamlis_ I'm only using `-n`, what does `-p` do?
Yeah, I don't know what to say.
FD31, yeah, I got the URL correct.
ComplexPlane The link to the stream on the bottom of the site is missing the www. prefix btw
Oh, I don't know what dash P does actually.
I must have, and it does affect the hash.
I started typing the echo over on another terminal
off screen and then because of the dash n it printed the prompt funny and I had a p and I just read that as a dash p so let's go back here and we'll run the curl i on my avatar and we still get a 200 and a jpeg
02:20:41chamlis_ oh, it echos the `-p` as well if you do that, at least for me
twitchtd -p isn't valid, it just gets printed by echo: echo -n -p hi -p hi
ComplexPlane yeah it doesn't work without www
ComplexPlane at least for me...
complex plane does it matter does twitch serve things with the dub dub dub yeah i'm still getting the g it doesn't work without that really let's let's get recursive so that's fine
It loads for me.
ComplexPlane hmm
I mean, I can add it.
02:21:27mjiig I believe browsers auto add www. for sites they've seen use www. before
chamlis_ so I guess the issue is on your gravatar account
Yeah, it looks to me like.
ComplexPlane maybe a chrome issue?
Which does redirect, so I might as well.
mjiig Under at least some circumstances
Yeah.
So let's fix the issue that.
...44Probably MJ is correct here. Let's go look at the, what is that, application layout?
02:22:19twitchtd ComplexPlane I've got chrome and that link wfm
I think if, so in a browser I've got, I pulled up, well, actually we could check here.
ComplexPlane OH, my /etc/hosts is messed up, haha
ComplexPlane ignore me
So if we ask for which.tv push CX, yeah, they're 301ing us to the www.
So I might as well, rather than, you know, it's fine.
Honestly, you just saved everybody a 301.
ComplexPlane hurray
So now the stream loads, what, 10 milliseconds faster?
I'll take it.
02:23:03Frici efficiency SeemsGood
So what's going on with Gravatar?
I don't know.
mjiig A lifetime saving of dozens of bytes over the network
I don't think it's anything with my account because I haven't logged into Gravatar for, I don't know, literally years since I last changed my avatar.
...24Excuse me, MJ, I prefer to call that a career. So I'm pulling up my Gravatar login off screen. Check. Why did you email me? Can't I just have a password instead of you email me? I'm not keeping this cookie for being logged in. We're going to do this again.
02:24:09Gravatar seems to have forgotten my avatar because it's putting me in a new user flow. OK, so Gravatar just deleted my account. That's why my avatar has been missing.
...41chamlis_ didn't self-censor enough all those months ago
sign done and it looks like it didn't work because it did something dumb with canvas that i didn't permit because why would you use canvas now it wants a ton of personal info oh god gotta get rid of this thing it's become
Frici I never looked if there is any gravatar alternatives...is there really ?
some kind of upsell process did i say something candid and common about the sir who runs gravatar and wordpress with an iron fist
chamlis_ there was a stream where we were self-censoring to avoid the it coming up in searches
so frichi there is some weird i say weird someone in our issues and prs was like hey why don't you use my random service and if you pulled up the random service it made some noises about being independent and libre software but then also there was no idea who ran it what their budget was what their policy was it was a total
Kind of amateur.
Yeah, Chambliss, I did that early on because it was very clear that the guy who owns those things was searching his name and picking fights across the internet.
02:26:59I don't know why I'm doing this download process. Oh, I'm also typoing URLs. Come here. So let's grab that. And let's grab that MD5 some. Because it's just me. All right. Well.
02:28:02Yeah, that was... I'm thinking about what you just said there, Chamlus. That was like last December that he was really on a tear. I wonder if maybe his very expensive professional lawyers finally got some client control and were like, please stop saying things to your case that's damaging online.
...36graefchen Hello limesHi
Oh, you know what?
This is... Oh, I think I know what the bug is.
Hey, Grafchen.
I bet this was our bug.
Wait, hold on.
...58Where is it?
02:29:12So I think it was our bug, but in a very silly roundabout way.
It's not quite a bug.
So we have the settings.
We go to slash avatar.
So there's an avatars controller.
Yeah.
So here's what happened.
I had a different old email.
Oh, hey again, Grave.
I had a different old email on my personal account.
Probably just like ph at my blog or something.
And then a couple of years ago, like three or four years ago, I standardized on using peter at pushcx everywhere.
so i replaced it on my lobsters account but that doesn't expire the gravatar and when we save that we save that as username not the md5sum of the hash so i replaced my email address you know there was reports that others were missing
So what was happening was if you update your address on lobsters we have saved.
That gravatar and continue serving it indefinitely until we do something like totally rebuild the server to use hatch box and then all of those avatars didn't get migrated over.
Because people's email address and changed.
Wow for the first time i'm glad I took a complete backup of the whole disk on the old one so either I can go fetch those out of the backup or we can just hunt because what's happening here is people's email is out of sync how funny okay.
So.
chamlis_ one fewer mystery
tar.
02:31:32So it is probably not, you know, I got smited by a jealous god. No, this is a totally logical sequence of steps here.
02:33:31graefchen Having backups is always good. limesSmart
So let's also go to profile, push CX or profile man till they push CX.
Yeah.
So there's that.
And now off stream, I'm going to pull up my settings page and then I'm going to click the expire button.
And then my little Baba is you is going to appear.
I have pretty high confidence this is going to work.
Where's my button?
Expire cache.
pushcx https://store.steampowered.com/…
chamlis_ is that a sepia-filtered version?
avatar cache has been purged of files and reload shift reload there we go all right so the baba is back and if anybody wonders my avatar is just a screenshot from
twitchtd ah i always wondered where your avatar came from
this excellent game called baba is you it is a wonderful little meta programming game or not programming game puzzle game and the the meta layers of it i think that's a gravatar bug because i saw that too and it's not supposed to be
02:34:59graefchen Why did you even choose the ยปBaba Is Youยซ Avatar? limesLurk
Yeah, they have filters, and apparently the default filter is fade.
How about the default filter be pass-through?
chamlis_ blimey
Gravatar has clearly added some features.
And I literally cannot turn off that default.
I don't know.
yeah it's just forcibly putting a filter on it one more reason to dust off that active storage pull request and just drop this external dependency because this thing doesn't work like if i can't turn off the filter
Or it's just buggy.
It's something about it doesn't like the canvas.
I don't know.
The last thing I want to do is spend a bunch of time struggling with fucking Gravatar.
So I try not to change my avatar too often.
I want to say this is the third one I've used.
So this is like every 10 years or so I update.
But Grave, yeah, the short answer is I just really like Baba Is You.
I think it's a delightful game.
It's charming.
And I'm not especially good at it or anything.
I just really, really enjoyed it.
And I had that like a little spiral thing.
ComplexPlane People who are cracked at Baba scare me
It was sort of a Fibonacci spiral.
It was very hard to make out.
Didn't have a lot of personal meaning.
I'll tell you what the next one will be, though.
ComplexPlane also in the strongly-admire-but-not-great-at-it camp
pushcx https://memory-alpha.fandom.com…
chamlis_ lol
i want to give the the baba is you you know it's full decade run and then the next one is going to be i'm kind of aging into it i've pulled it up on stream i guess so he is a forgettable side character but he's in like five episodes
of Star Trek Voyager, there is this guy who is named Pete Harkins, which is which is basically my name.
So at some point, this image or some variation of it is going to be me.
And I mean, I'm, I'm a middle aged white guy, this is pretty much what I look like.
I mean, you've seen one middle aged white guy, you've seen them all, right?
So if I crop it so that you see less of the collar, it'll be less obviously a Star Trek thing.
Or maybe there's even a scene, like there's an episode where he invites Barkley to dinner.
I watched all of Voyager when it was airing with a friend.
I think there's an episode where he invites Barkley to dinner.
So presumably there's a scene where he's out of this uniform.
So I may just start using that as my avatar.
Probably not him making a stern face at Lieutenant Barkley fucking up, though.
If he ever makes a kind face, I'll go screen grab that.
02:38:37I don't think I want to haul all the caches. Yeah. Rather than dig around in the old server's backup. or avatars and restore. Well, if for avatars to restore, I'd have to sort out which ones were Not place folders and haven't been placed on the new server by users.
02:40:47all right well so chanlis you have indirectly solved the bug there which is very nice i bet this is one of those i bet the filter thing is going to be one of those where if i ran through the flow in chrome instead of firefox either it'll work better in chrome or it'll work better in my chrome because it doesn't have any privacy settings turned on like Why does Gravatar forcibly try to use Canvas instead of you uploaded a file, I'll serve that file? I don't know. It's very clearly a single-page app, so expectations are pretty low. What is this? Is this a political rant? This is... At least it is about programming. Are all of our comments just going to be politics? Yeah, top one is politics. Second one is politics and bureaucracy. That is a good book, by the way. Another business rant. Scams like this is not generating a topical discussion.
02:42:17And it's self-promo? No. It's just by a new user. I wonder if... So once again, I'm pulling stuff off. Did this user try to submit it on their own and hit the restriction? No. That's good.
...46There's a thing where sometimes people try and submit, they hit the restriction, and then they get their inviter or someone to submit it for them. I'm especially concerned about that when stuff is marginally topical or it's self-promotional.
02:43:23All right. So what else do we have here? Got maybe 15, 20 more minutes free. And I don't have a 15 or 20 minute more topic on my head. not write off last updated you know i bookmarked it for a reason let's pin this here you know we could take a second to look at the csp reports and i'm actually going to throw up the note about Well, I'll throw up the last call in a minute. We don't have to do that too fast, but.
02:44:38So, Chandler, since you were chatting a second ago, the. CSP header you added is still recording plenty of exceptions and. It would be nice to reduce some of these false alarms. And I would like to refresh myself on where we were at with that.
02:45:10We have a CSP controller with the fingerprints.
And what if I just look at... Yeah.
chamlis_ oh yeah, that is a lot...
so just today we've gotten a couple of thousand reports and like right off it's stuff like the safari web extension that i want to say we saw here yeah can you remind me did we start on this at all
...56chamlis_ I have a branch locally where I added some of the filters from sentry
There's a pull request.
Yeah.
They will mention this.
02:46:11chamlis_ I think we were talking about it on IRC at some point
Right, so this is what I was thinking of where you've broken a bunch of this out.
Because we found the century list.
How's that branch going?
Is there anything we can do?
So one of my concerns is there are so many of these I've had to turn off exceptions on the exception monitoring service.
...52chamlis_ give me a couple of minutes and I'll push it someplace
And I would like to turn that back on.
But there are so many of these that are in trouble.
Sure.
Because otherwise I can just hack in and return.
But if you've already got this list that you found from Sentry, yeah.
02:47:28as long as i'm here i'm kind of skimming the the bug queue and the only reason i'm not bringing the bug queue on screen is it has things like users ip addresses and usernames in them and i don't want to accidentally leak that pii so we have a complaint missing configuration for the production active storage service Oh, that's so that's I know what that is. In.
02:48:13We'll come back to that, and I'm going to make that two lines because Chambliss said she'd open up here in a second.
...31In config storage, we had a second block that said production that effectively duplicated this. I had been thinking of this as like a dev production versus test production environment thing, but we didn't need that. So that got folded together by a contributor who recognized the redundancy. And then what I didn't realize was this verge job was saying production instead of local. So how do we... Is this in solid queue? I think we just need to bounce solid queue for these errors.
02:49:35Yeah, so let's go to, I'm going to double check jobs to see if anything says failed.
chamlis_ did some very quick fixes just now so it may be entirely broken, but I've pushed to https://github.com/chamlis/lobs…
No.
So yeah.
I can show you what this one is because it's not there's no PII so warning we're switching into light mode gotta bring this over so this is some bit of internal rail stuff to clean up I think caches in active storage
And it's throwing that the production service, and that's the one that we deleted.
So I think I just can pull up the wrong terminal.
There we go.
Pull a patch box and bounce that.
So on there we have processes, solid queue.
And I will restart that.
And I will mark the active storage bug as resolved.
So if it pops up again, we'll know.
I'm going to remove this.
02:53:39twitchtd I'm off, have a good day, thanks for the stream!
Oh, thanks for dropping in, Thomas.
02:54:12So this, I think this link goes to Mastodon's request to make lists public. Yeah. Okay. So I do want to hang onto that.
02:55:04All right, there we go. That's just me cleaning up some errors that show up in prod. Don't run Mastodon.
...37You know, I don't feel bad about that one because I did learn a bunch about the code and the way, you know, it's always hard to have too much confidence in things that integrate with production services, third party services until you've actually run them in prod. So I'm glad I did. But yeah, I don't want to deal with the exceptions anymore. They're just clogging up the tracker. All right. So then I will grab, see that done. So I'm waiting to see that done. And then in the bug tracker, which is a service called Telebugs, I am going to mark the bug as resolved. Because hopefully it is.
02:56:45chamlis_ oh I didn't make a PR, I can do if that's easier
so with that let's go look at the polls channels did you say you pushed oh it's up on your branch all right
I just assumed you clicked open on a PR, but that's just fine because I have you as a remote.
No, no, no.
This is totally fine.
I'm already there.
So let's jump over to here and look at it.
Oh, I'm on top.
I'm going to say show BVW.
Ignored schemes.
You know, I know almost all of these, you know, are offhand.
What is Sir Simrez?
Huh?
I like that the web is a weird and complicated place when I'm not cleaning up after that.
So we grab the source file if it's there.
We try and parse the URL if the ignore scheme.
And if you rescue.
This is reasonable.
02:58:25I wonder if we want to.
Invert this logic where if you don't have a valid URL.
We should just drop it.
I'm trying to remember that I have a format of the...
chamlis_ source-file is non-standard, so I think I was trying to separate it out
So you are digging for source colon file.
I'm pulling up an individual report.
Oh, we have them in that bug.
I don't have to.
All right, didn't I paste some here?
Yes, we have these.
Source file is non-standard.
Yeah, I was getting that confused with document URI.
02:59:25So your code, if it can't parse source file, it just passes it through. This looks like a very safe first step. where we're just discarding known bad data, I think this is pretty good.
...47Do we have any tests that throw something in the CSP controller just to make sure that we don't have any syntax errors? Yes, we have a spec request. Okay. If this is green, I'm going to trust that this is good enough to filter out some of this bad data.
03:00:15Good.
All right.
So I'm going to make a new commit that is VVW.
chamlis_ no, only twitch was already taken
or that is based on bvw and master with the description merge wait are you you don't have an underscore on github right you don't okay i can never remember which one has the underscore
03:01:14all right that looks good why am i not getting my
...46Can I do something to my shell history? There we go. I don't know why I wasn't getting this auto-completed and I wanted it back. At some point I will make an alias for this because I've started making aliases in Jujutsu. But that is not a today thing. Oh, so where's... There we go. I will throw up this because I think we're in the home stretch here. should have done it a minute ago so we will deploy and then it's a little yeah i'm going to pull up the bug tracker so light mode warning too slow i thought it was going to i have kind of a complicated setup for trying to minimize showing tons of stuff on screen but So the bug server actually is on a very weensy little, I think it's a $6 a month VPS. And so when it has 6,000 errors and it does not run at incredible speed, but that's fine because usually we have like, six errors in a month rather than 6,000 in a day. But you can see that we just have a ton of these kind of guys showing up in production. And the number here is the number of times we've seen a CSP violation with that fingerprint. And then if you come down and I'm not going to keep scrolling down because I know there's one of these with PII. See, this one is just a bug. SID public ID. It's public ID.
03:03:59This feels like some kind of random crap out of, I don't know, it's something in the storage layer. Undefined method public ID for nil. Honestly, this might be a Rails bug.
03:04:24So it's someone who is trying to log in. So I'm definitely not going to show that on stream. And they probably... Yeah, I think that's honestly a rack bug. Should bump action dispatch about that. Is there one? Yep. Let's see if we find anybody talking about this.
03:05:17Yeah, this is the bug, but it's four years old. I mean, this is the exact exception.
...41Hmm.
...52All right, so we've bumped from 801 to 802. I'll take it.
03:06:25Actually, I think this is a serious bug. So one of the things about we're going back to light mode here. There is something conspicuous. In this bug. Which just happens to match the exception from a couple of years ago. It caught my eye just before I closed it. That there are 26 reports, and I thought, that's weird. Well, there's a conspicuous graph. And they all start appearing about an hour ago, which is going to be when I deployed the cookie thing. So I think the cookies are getting inappropriately cleared and we have broken logins.
03:07:40remove unknown cookies but but something is wrong here so I'm gonna
03:08:12let's grab if I pull up lobsters and I try and log in in an incognito I get the OTP prompt and I fill the OTP and I logged in But that was definitely I think these 26 reports are legit like people trying to log in 26 times and there's some kind of bug. That's preventing them because. These sure look like valid logins.
03:09:06So. When we are setting up the session. Is this wrong in prod? Because I know when we override this to give it a cute name.
...48That's correct. I don't understand this bug. And it's clear for some users that login is broken. pretty dang bad so i'm gonna revert let's find out how to make a revert commit okay
03:10:34So can I say revert this one? Will it understand that I want to revert that whole branch?
03:11:10Okay, and then it wants me to say where. So let's say on master. Okay. Yeah, but it says it's empty because it's only, all right, so that's not useful. Scan QR. Excellent. Oh, well, let's bring master up to this bump.
...51And then. There is probably some clever rev set way of saying I want to revert all of these commits. I don't know what it is. I think it's. I think it's actually I can name the first one and then dot dot the last one so let's grab this. For dash are that. Dot dot. The last one. And. Is that destination. Okay. Okay, so wait six. To add tests, updates. One, two, three, four, five, six, seven. One of these is missing.
03:13:02The last one about Docker, which actually is fine to not revert. I don't know. Is this a.
...32You made me six commits on top. That was unexpected. I guess that means I could just give it the one that didn't happen.
...56Well, this is maybe the most annoying thing I've had happen in JJ, which is pretty cheap. But
03:15:15chamlis_ can you undo out of this?
Does it need to be in the other order?
...23I could, but we have a whole lot of other work and it's not that I want to revert.
chamlis_ oh right missed what you were trying to do
To change my local history, it's that I want to be able to push another commit that reverses the branch.
...44Did it not?
...50Yes, it resolved to more than one revision. That was the point is I'm trying to revert multiple commits.
03:16:24I wonder if I want to know. Didn't enter. Sir, you are really not helping right now. I don't have the spare attention for you to be needy.
03:17:05If this just errors and says that it can't squash multiple, I'm going to be pretty frustrated. Hang on.
03:18:08Doesn't it feel like it's got to be this function?
...18It's this function. I get it.
...42There.
03:19:22know i honestly wonder if it's csp if they're getting a csp violation on a login page and the csp is saying oh hey look you have a cookie and accession and you don't need either of those things because you're not logged in yet and you get an extra step when you're doing the 2fa authentication so there's one more page load in there so here we stick things in this session and we redirect, and if somebody fires a CSP while in this flow, it's gonna blow this away, because the cookie is, and the session is a global variable.
03:20:35Yeah, and they could have a redirect to,
03:21:44I just got a DM that's slow.
03:22:23So as long as I'm saying that there, let's go ahead and say that in the CSP controller as well.
...37Are there any other controllers that you hit in this indeterminate state of being logged in and logged out?
chamlis_ well done on figuring that out
I think, well, so this actually is harder
chamlis_ anything in signup?
because it's gonna happen with CSP, but if you are going through the login flow, and you submit the password form, you're sort of in this half logged in state, and then, yeah, we should definitely skip it on sign up and invitation request, yeah.
03:23:25So there's a kind of a bug here, where if you are people aren't going to hit it often, but if you log in with to fa enabled. You do username password you get redirected it asks for your to fa. And then. In another tab you load one of these pages that wants to clear the session cookie I think this session empty should catch these and then you would submit and you'd have a broken session, I think this fix this aspect of it will be good. yeah I don't.
03:24:11yeah.
chamlis_ I need to head off, thanks for the stream!
I think this is fine because when you request, it should stick stuff in your session or it should not.
But either way, it's not maintaining things.
All right.
Take care, Chambliss.
It was good chatting with you today.
And I promise I'm still working through Common Marker.
All right.
So let's deploy.
03:25:24So I'm waiting for the deploy to finish before I whack enter asking this user to test.
...36But it's going to be a slow deploy because I bumped Rails, so it's got to do the bundle install.
03:26:19Let me see if I can reproduce it in a different browser. You know, as a web developer, I have like nine browsers hanging around. Let's try this one.
...42No, we seem to just be down now. That's bad. Let's look at the journal. Okay, we're booting and immediately crashing.
03:27:19And it's something about Thor that I just bumped. No. Here we go.
...35It is complaining. Before process action, clear session cookie has not been defined. It is an after action. That's just a bug.
03:28:01So where did we touch it? We touched it in CSP controller, which is here. We touched it in invitations controller. Doesn't everybody love bugs that we can't regrow in dev? login controller i am actually glad that rails is throwing this exception as opposed to just silently ignoring skip because i would never have noticed
03:29:19all right as long as that's running nothing here to catch because that should fix it but okay yes lobster is just loaded for me
03:30:03dzwdz well that's a new error page
And if this doesn't work, then I'm going to comment out all of the stuff around cookies because it's not working and I want to be fresh when I'm debugging something fiddly.
...43So just for shits and giggles, even though I don't think I can repro it, I'm going to get back to trying to log in in another browser and I see the OTP and I was logged in just fine and I'm browsing around and I'm not getting logged in and out.
So that part's fine.
pushcx Are you seeing an error now?
So I don't know.
It could just be Chrome.
03:31:22Hey, DZ.
Wrong browser.
Are you seeing an actual error or outage right now?
dzwdz nope, not anymore
Because we're dealing with something that is hard to repro.
...49dzwdz there was an Application Error from hatchbox
What was the new error page you saw, by the way?
Oh, you may have seen the one that comes with Hatchbox and Caddy.
Yeah.
Yeah, actually.
So there were certain states on our old Nginx setup where you would just get a white page instead of anything that looked like an error.
So that is one thing that has been improved.
If you...
dzwdz sure, one sec
have a second could you try logging in because we've had an error with logins and i can't repro it and i am hassling the bug reporter but it is kind of sluggish because it's overwhelmed by false alarms about csp which should stop coming in but that doesn't mean there aren't
6,000 a day for the last two months in the database.
03:33:00Let's sort by last seen.
...24dzwdz worked in a new private browsing window
dzwdz i'll try out some different devices
okay that's promising yeah it's really not clear which devices were hitting the login issue and i think it's fixed but you know when you fix a bug that you can't actually reproduce oh okay so a user who
David Price- kaios actually I don't think he minds be naming him so he's the person who posts all the wonderful weekly threads is the one who pinged me and said that he couldn't login.
03:34:44All right, so with Caius reporting that it's fixed, I'm feeling pretty good about it being fixed. I'm going to wind down the stream here. And I'm going to keep a close eye on the bug queue.
03:35:09All right, so DZ, I appreciate you testing.
dzwdz is there time for like an one sentence summary of what the fix was?
If you do see anything odd hopefully it'll show up in my logs but also you can just message me on irc whether you say my name in the chat room or just DM me, then I will find out.
...35I can show you the fix.
The.
We merged some code to clear unused cookies, because if you don't have cookies, you can get the full page cache, so the whole site runs faster.
However, and it even had a comment about it.
My best guess for what was happening is during the login flow, some browsers were sending false alarm
reports for content security and what I mean by false alarm is the content security thing says like oh this page shouldn't have any javascript on it and the browser is like oh well I tried to run javascript that looks like a. CSP violation, maybe that's a cross site scripting attack, let me send a report and when you would send a report.
would come to this controller and the controller would run the clear session cookie and if that happened while you were in the login flow if you have a 2fa enabled so you get asked for a totp code there's a page load in the middle of the login flow so we may have had that bug lurking for a while
So we tried to make a pretty thorough fix of things that you should be allowed to hit while logged out and saying you've got to have an empty session.
dzwdz okay, i ran out of devices
And kind of a boots and suspenders approach, because I really do think this is just if you have 2FA and you had particular noisy extensions.
Oh, great.
Well, that's actually real confidence building.
dzwdz my ps vita doesn't seem to support TLS1.3, smh
Thank you.
dzwdz actually no i have one more
then there was a second bug where i wrote skip before action that needed to be skipped after action your ps vita oh yeah well we also don't support game boy advance you know it's funny we are we were somebody's benchmark there was i don't remember their name now but a year or so ago
Maybe it's the Ladybird browser.
They were using lobsters as their reference page.
dzwdz yes, i remember that!
If we can render this page that doesn't use too much features, doesn't use any JavaScript, maybe we can
yeah so if we say lady bird kind of funny to be a benchmark that way yeah so we got our pages and it's not anyways i know i've talked about this on stream i just don't want to dig back in the browser anyway
All right, well, kind of a jump in stream today.
I will try not to crash the site live on stream again.
Did you see that?
You know, I automatically reloaded, but that was just GitHub being a weird SPA again where the whole page was pushed down a bunch.
dzwdz oh hey i've found the "Hapax legomenon" easter egg
And I see so much of that jank on GitHub now that I hit reload in a half a second.
Didn't even think about it.
Hey, did you learn the Latin phrase from that one?
dzwdz i thought it was a reference to that google thing at first
That's, you know, after Casimir Pulaski Day, which is a recent addition, Hapax Legomenon is my favorite Easter egg in the site.
So it's a firm second.
What is the Google thing?
dzwdz i forgot what was the phrase for that
graefchen GH switch to React (?) was ... an decission. limesHmm
I have no idea what this is.
03:40:11Yeah, it's been an ongoing process.
...43dzwdz i don't remember the details, there was some old thing where you would try to find two words with only one google search result
Oh, you're I remember what you mean yeah it was called it had a cute name Oh, this was such a.
An early web thing.
dzwdz not that early i think
yeah Google one shotting and i'll see i'm overriding it with modern jargon.
Google sniping.
dzwdz relatively to google's lifespan
I mean Google wasn't early they didn't even get started till 98 and then they weren't really popular till late 99 2000 something like that but.
dzwdz wasn't it named after one phrase that used to be that?
yeah there is a jargon term for if you search for something two words, maybe even without quotes because it used to do exact text search and all search terms.
yeah I don't know.
Wasn't it named after one phrase that used to be the...
I don't know.
I know what we're talking about, but I cannot remember the term for the life of me.
I'm a little fried after talking aloud for three and a half hours, so I got to wind up here.
Anyways, thanks for dropping in, folks.
The next scheduled stream is on Monday at 2 p.m. Chicago time.
Which, yeah, I'm still a ways out from when I'm taking some time out.
Oh, DZ, you'll have to find that for the next stream.
dzwdz i'm looking for it right now
dzwdz i'm almost certain it was two words
More likely, I'm going to snap awake at 3 in the morning, and I'll be like, oh, it was called... See, I wanted to say it was one word, like Google snapping, or Google shotting, something like that.
A Google nope?
That was a different thing, I think.
Anyways.
Well, we will answer it maybe on Monday's stream.
I'm donezo.
Take care.