The short version of the Ruby controversy of the day is here . The really short versionis that the Ruby core has bindings for OpenSSL, some versions ofOpenSSL have defaults that are terrible for security, and the Rubycore developers have decided that they will not change the Rubybindings to fix these terrible defaults. Instead they are simplywashing their hands of the issue and making security the responsibilityof users of the bindings (and OpenSSL).

The Ruby core developers are wrong. Security is everyone's job ,all

Lately I've become a little bit obsessed with the question of whetheryou can create a fully functional metaclass that doesn't inheritfrom type (partly this was sparked by an @eevee tweet , althoughit's an issue I brushed against a while back ).It's not so much that I want to do this or think that it's sensibleas that I can't prove what the answer is either way and that bugsme. But before I try to tackle the big issues I

One of the things going on these days is that an increasing amountof server-side web related programming is being done in JavaScript,specifically in node.js . Various sorts ofpeople have various reactions to this, some of them negative.I've got some half-formed thoughts about this from an outsider'sperspective, but for today I want to stick to one observation thatstands out:

Node.js JavaScript is likely the fastest dynamically typed languagethat you can use on Unix today.

If you

In a comment on my entry on having an audit log , dozzie recommended structured logging. Roughlyspeaking, instead of just logging formatted text message you log all ofthe various pieces of the same information in a way that's explicitlylabeled, encoded, and serialized somehow. These days, for example, youmight encode things as JSON.

In part this is a great ongoing debate between two sides of logging.The advantage of pure textual logs (whether split into database columnsor smashed together in one line) is

One of the smartest things I did when I was writing our web basedaccount request management system was giving it an audit log. Pretty much every time the database getschanged, the web app writes an audit record about it that captures allof the high level details (which user or what automated process, fromwhat IP if applicable, doing what, and so on). There have been twoadvantages of having this audit log.

The first, obviously, is that it tells you what happened (and why)

Every so often someone says that Debian's stable releases have a longsupport period. Unfortunately this is what one would call 'wrong', andfor at least two reasons.

(For now, let us define 'support' here as 'gets security fixes'.)

First, it is wrong as a plain matter of fact. No Debian releasehas ever been supported for more than a sliver over four years,and only one release has hit that mark (Debian 3.0 'woody',released

Armin Ronacher's More About Unicode in Python 2 and 3 contains a lotof information about the subject from someone who works with this stuffand so is much better informed about it in practice than I am. A samplequote:

I will use this post to show that from the pure design of the languageand standard library why Python 2 the better language for dealing withtext and bytes.

Since I have to maintain lots of code that deals exactly with the pathbetween Unicode and bytes this regression from 2 to 3

I've always run SELinux on my laptop; it's how Fedora installsthings, it's worked without problems, and despite all the bad thingsI've said about it I sort of consider SELinux to be the right thingto do so I wanted to keep with it. And unlike my other machines,my laptop is a completely stock setup at the system level and Idon't do anything unusual on it. Then I upgraded to Fedora 20 withyum and things exploded .

(Some

Suppose that you have a vendor with a support period of five years fortheir OS. This is great, since you can install a machine with thatOS and get five years of support for it, right? Well, no, of coursenot. You only get five years of support if you install your machineright away when the OS comes out. If you install a machine two yearsafter that, you only get three years of support for it; if you installa machine four years after the initial release