Right, that's partially why I'm confused - hiding it when you visit the URL directly is a big tip-off that you're blocked. Seems to undermine the first part there. Also from a general tech/security standpoint, giving a logged-in user less privilege than an unauthenticated connection just seems like a bizarre design choice.

#1 is weird on twitter, because for a non-protected account, you can view tweets even if you're blocked simply by logging out/incognito. I'm really not sure what the point of twitter preventing you from *viewing* tweets is.

The problem is that the requirements are almost never right, because translating human requirements into programmatic requirements is a skill in its own right. You need domain knowledge to point out that the requirements/specs have gaps where they don't actually support the use case.

I know reading TFA isn't popular around these parts (and to be fair, other articles explain it better), but the issue is that the copyright cops are trying to establish that it was an open secret that RCN let infringers off easy. They're not going after the anonymous users for any sort of infringement, they're effectively just witnesses.

Yeah, libraries are great. What isnâ(TM)t great is wildcard dependency versioning. You should never deploy a version of a dependency unless it has gone through whatever your normal QA process for a release is.

Yeah, this. It's garbage for ANY number of apps, unless you never open more than one window of any app. The windows taskbar works so well because it recognizes that windows are what matter. Switching between "apps" only makes sense on phones because windows are one-to-one with apps.

That's not quite the issue. These are a case of dependencies that you pull in, rather than a platform that you run on which might be updated and deployed independently of your software. However, some dependency management and deployment systems (imo, foolishly) allow for a version range rather than fixed version (e.g. "latest 2.x" rather than "2.1.3.4"). This means that while you might test against 2.1.3.4, as soon as 2.1.3.5 is released, any new deployments would grab the new version despite the fact that you never tested against it.

The solution? ONLY allow dependency versions that you have actually built and tested against to be deployed. You wouldn't deploy a version of your own software that hasn't been tested, and you shouldn't do that with dependencies either. It's just people trading security and stability for convenience (similar to the recent log4j debacles).

To the other reply:

That's generally done passively - if you update a dependency version, you have to build and deploy a new version of your software to actually make that change. The problem is that if you use version ranges, you effectively bypass that.

I even read TFA and it doesn’t explain how one manages to accidentally commit a file that one wouldn’t normally find in a code project.

100% true. Unfortunately, once there *is* a crack out in the wild, it serves no beneficial purpose whatsoever. Companies should be patching out the DRM once a crack is circulated.

Not just cables. It's the same problem with the ports in general. Is this just a USB port? Perhaps it can also charge the laptop? Could it drive a display? Can it do Thunderbolt? There's no easy way out. They can't mandate that every port do everything, because it would increase costs beyond a reasonable degree.

Ironically, this guy is part of the problem. He uses big corporate influence and money to push his personal politics.

I don't think that's really a good way to look at it. If you pay 50% more for a gas car, you don't expect 50% more range. At some point, it's "enough" range, and the value comes from other aspects. After all, by that same logic, there's no reason to buy a model S, because it's only 15% more range than the model 3, despite costing 80% more.

Well, you're still not safe. Purely visual aimbots (e.g. if I am on blue team, look for red humanoid blobs and shoot them) have existed for decades. They weren't very good, but with modern technology they probably could be.

I disagree, because it seems like those anti-theft tags in clothing stores. It's just a "one-time activation" when the cashier removes it and deters theft.

Well, these aren't mutually exclusive. I can say that corporations do bad things while still not wanting my TV stolen or having people looting businesses.

Consider it like this: The alternative to a file picker would just be a text field where you have to write out or paste the file path. Ideally, the file picker dialog would act the same way, by doing one thing and one thing only - let you see and pick files.