Back in my entry on why user-hostile polices are a bad thing I said that I believed threatening topunish people was generally not an effective thing from a businessperspective. I owe my readers an explanation for that, because onthe surface it seems like an attractive idea.

The problem with punishing people is that practically by definitiona meaningful punishment must hurt , and generally it can't hurtretroactively. However, when you hurt people and especially whenyou hurt people's future with you (through bad performance

Suppose, hypothetically ,that you are a vendor and you want to push people to upgrade morefrequently. No problem, you say, you will just reduce the support periodfor your old releases. This is a magic trick that will surely causeeveryone to upgrade at least as fast as you want them to, basically at apace that you chose, right?

Well, no, obviously not. There are clearly at least two forcesoperating here. On the one hand you have people's terror of lackof

Django defines both database tables and HTML forms in the same way,a way that seems to be extremely common in web frameworks acrossseveral languages (and which I think first surfaced in Rails,although I may well be wrong there):

class AForm(...):   login = forms.CharField(...)   email = forms.EmailField(...)   ...

This is very appealing initially and Django goes well out of itsway to make it all work. But over time I

Recently I read Ted Unangst's long term support considered harmful ( via ),where he mentions OpenBSD's relatively short term support policy(it's one year at most and less in practice ) and then says:

Now on the one hand, this forces users to upgrade at least once peryear. On the other hand, this forces users to upgrade at least onceper year. [...]

Oh, how this makes me laugh. Sadly.

We have a not insignificant number of OpenBSD

One of the things that people sometimes say is that you have asocial obligation to report bugs when you find them. This seemsmost common in the case of open source software, although I've readabout it for eg developers on closed source platforms. Let's setaside all of the possible objections with thisfor the moment, because I want to point out an important issue herethat I feel doesn't get half as much attention as it should.

If users have a social obligation to report bugs

Last month I noticed that classical viruses by email were stillaround , despite a past history of low virusdetection by our main mail system . Well,funny you should mention that. As it happens, late last week thewhole university was battered a large tide of infected phish/virusemails over several days (and we had several infections ourselves).If our anti-spam system is any good at detecting viruses, I'd expecta serious uptick in virus detection because the actual rate of virusemails was clearly

Bearing in mind that just go get 'ing things is a bad way toremember what packages you're interested in ,it can be useful to keep an eye on updates to Go packages andcommands. My primary tool for this is Dmitri Shuralyov's Go-Package-Store ,which lets you keep an eye on not only what stuff in $GOPATH/src hasupdates but what they are. However, there are a few usage notes thatI've accumulated.

The first and most important thing to

Since I've recently praised ZFS on Linux as your only real choicetoday for an advanced filesystem , I needto bring up the long term downside because, awkwardly, I do believethat btrfs is probably going to be the best pragmatic option in thelong term and is going to see wider adoption once it works reliably.

The core of the problem is ZFS's license, which I've written aboutbefore . What I didn't write about back thenbecause I didn't know enough at the

One of the consequences and corollaries of never trusting anythingyou get from the network is that you shouldthink long and hard before you make your web application generate alerts based on anything inincoming HTTP requests. Because outside people can put nearlyanything into HTTP requests and because the Internet is very big , it's very likely that sooner orlater some joker will submit really crazy HTTP requests will allsorts of bad or malicious content. If you're alerting on this, well,you can wind up with a large