You can only check your email so many times, and you can only work on so many problems at once. You also generally have to be mindful of token consumption. I think it also leads to burnout to work on so much at once. I've been working this way for like a year.
I ran into a situation at work today that prompted me to write up a lesson I've learned over my past 20+ years of working in the field. In my experience, both software developers and software testers often don't think about this.
I really don't see any benefit of introducing a JSON API into the JDK. Jackson works great already. Are they really going to make something that much better?
This is a huge let-down after Java 8, but I guess that was inevitable. Lambdas are a tough act to follow and are probably my favorite addition to the JDK ever.
This discussion reminds me of a 2005 article from Joel Spolsky called "Making Wrong Code Look Wrong". It has a similar point to this article: there are things we can do as programmers to make our code less error prone. It's definitely worth a read if you're interested in this topic and haven't read Joel's article before.
I can't wait to try this out! Pop music can be energetic, but it can also be very distracting. In the past, electronic music has been my go-to, but lately I've tired of it.
It may actually be a good thing if Chrome migrates to OpenSSL. With their resources, perhaps they can do some testing to see if there are any more vulnerabilities out there. At the very least, their continued eye on the project should help it be more secure going forward.
Actually I think the Heartbleed vulnerability was most probably found because of this migration, as it was found by Neel Mehta of Google (and the Codenomicon guys). The date of this draft is 2014-01-26, so it makes sense, that the OpenSSL code is evaluated by the security team before the migration.
Considering how widely SSL is used, and the resources of Google, I wonder if they could come up with their own encryption toolkit? How hard can it be for a company the size of Google to create a library that lives up to eg SQLite's quality standards?
Fix OpenSSL, and everyone that currently uses OpenSSL benefits. Create a new library that's clearly better than OpenSSL, and ten years later there will still be important things that still haven't switched.
The last time I looked at it the go stack was very weak compared to any of the mature C SSL stacks. IIRC it only took me a few minutes to find a security bug (which I reported and is now fixed) that I'd reported against various browsers several years earlier. In short, I highly doubt the go SSL stack is production ready.
What would be interesting to see is a fork of OpenSSL with the intention of cleaning up the code, removing abstractions where they are unnecessary and adding them where they are, and adding a comprehensive test suite to ensure correct behaviour wherever possible.
Those were my thoughts exactly, I think OpenSSL just needs a bit of care and refactoring (possibly a lot depending on which blogs you read) for which they need devs and resources, both of which google has.
Ooh, OpenSSL's FIPS certification. The fellows who've been fighting for years to take it away http://www.itnews.com.au/News/65016,openssl-in-a-fips-flap.a... must be crowing right now. (Regardless of whether their own stuff is any better or no.) Another decertification incoming?
AFAIK the US federal government (excluding the military, which obviously has its own hoops to jump through) generally can't use your hardware/software unless it has the appropriate FIPS certification(s). https://en.wikipedia.org/wiki/Federal_Information_Processing...
Initially this will probably carry a significant premium over normal delivery. However, as someone who lives in a city, I can definitely see there being times when I would be willing to pay the premium. Taking a cab ride to and from somewhere can easily cost $15-$30, so it could actually be cheaper to have the item delivered by a drone if time is of the essence.
