Following on from the three stereotypes of standards approaches : so you have a standard. Now, how likely is it tosucceed, or at least to be implemented (since standards more or lessnecessarily fail if they're never implemented)?

Well, that depends on the specific standard. But we can ask whatthe continuum of risks is for each stereotype of approaches tostandardization.

At one end of the continuum is pure documentation , where thebehavior the standard calls for already exists and so the standardis 'implemented

Here is a somewhat counterintuitive result (at least for me): supposethat you have the SHA1 hash of some value, SHA1(m) . If you know thelength of m, it is possible to work out the SHA1 hash of m, plussome magic, plus anything more of your choice. In the literature ,this is called an 'extension attack'. I think I understand why thisis so and basically why it has to be so, and now I'm going to

A while back I wrote a little thing about process memory resourcelimits . Today I feel like elaborating on why this isa hard problem that people haven't solved yet.

Let's consider the simplest case possible: per-process RSS limits. Inthe abstract, this is simple; you keep track of how many physical pagesa process has in its page tables, and when a process that is at its RSSlimit wants to add a new page, it must first release its mapping foran existing one

These days, many Python modules make a habit of being selective aboutwhat names they allow to be visible to the outside world; you onlyexpose the official, externally visible interfaces and so on.

This leads me to a thesis: all modules should make visible theirfundamental types, in the same way that the types module makes visible namesfor built-in types. Note that this doesn't reveal any previouslyinaccessible things; outside people could already just use your regularinterfaces to instantiate an instance of the type they

I wrote about this topic ages ago, but I justhad a very illuminating personal experience with this, and I feel likesharing it.

The one place that I pretty much have to use web-based editing iswriting replies to comments here on WanderingThoughts (unless I turna reply into an entry, which I do from time to time). Today I wasflailing away trying to write such a reply (on yesterday's entry ), and I just couldn't make things cometogether right; I

To condense and stereotype a great deal, there are three general ways ofcreating standards:

• invention , where you come up with something that seems good frommore or less scratch (ie, not feeling obliged to pay any attentionto existing practice, if there is any).

  The risk of this approach is getting your standard adopted in thefield; many invented standards fail dismally because no one isinterested in implementing them.

  The Atom syndication feed format is, I believe, an example of thisway.

• documentation , where

Here's a question: what would a 'modern' university email system looklike, one that's in line with the 'students already have online lives'theme of last entry ?

(Let's assume that our assignment is limited to designing the emailsystem, and thus we don't get to question or change what it's used for.)

Clearly, a lot of people will already have outside email addresses andmany of them will want to just forward their university email addressto their

There's a lot of services that people build around the university, bothlarge and small . The general habit isto make them self-contained services that run on your own web site orwhatever, or perhaps ones that integrate with other on-campus systems.

I have come to believe that this is a mistake. These days, universityservices should be assuming that students (both undergraduates andespecially graduate students) will show up to the university withalready established online identities and habits, which means thatservices should

I understand that Python does not have automatic reloading of changedmodules and Python source files, and that some people would like to havethis feature for their long-running programs and systems. However, thereis a right way and a wrong way to do this, especially for things likeweb frameworks.

The right way is to check for updates (and reload any affected modules)immediately before you process the next request (specifically, whenyou wake up knowing that you have a request, you immediately checkfor pending reloads