10,000 Matching Annotations
  1. May 2021
    1. I want to avoid nginx overhead (especially if they have tons of alias and rewrites) for in-server communication. Basically, you can have sveltekit server, backend server and nginx server, in that case, communicate inside your internal network will be very expensive like: browser->nginx server(10.0.0.1)->sveltekit server(10.0.0.3)->nginx server(10.0.0.1)->backend server(10.0.0.2) instead just: browser->nginx server(10.0.0.1)->sveltekit server(10.0.0.3)->backend server(10.0.0.2)
    1. Stay engaged. As mentioned above, you are expected to check your GVSU email twice daily, read new posts on CampusWire twice daily, contribute to the discussion board daily, and make at least two significant contributions to CampusWire per week. Make daily engagement with the course a habit, and don’t take days off (unless it’s a weekend and you have all your work done).
    2. Budget your time. MTH 124 is a 5-credit course with no meetings, so you will need to plan on spending about 15-20 hours per week doing mindful work. That’s 3-4 hours per weekday if you choose not to work on weekends. If you are taking other courses or have job of family responsibilities, you’ll need to think about where to put these hours in your daily and weekly schedules. In my experience, the #1 reason students don’t succeed in online courses is overcommitment and not managing time well.
    1. First of all, I would start off presenting yourself: Dear XYZ support team I am the web developer in charge of example.com website. By presenting you this way, you are establishing the frame to treat you, hinting that you should be presupposed to be somewhat proficient, so they could choose to answer in a more technical detail.
    2. Consider that many customers are rude or arrogant, so you can safely brag a little and still come off as comparatively wonderful! Help them help you with that short brag and they'll only be appreciative. And remember: be nice and it's ok to lose the modesty for a sentence or two! Source: I'm a CS rep at a tech company, and I appreciate it when savvy customers clue me into it!

      .

    3. If you're already an admin for the zone in question, then the proper way to get that information is to log on to the DNS server or DNS control console and read it right from there. If you're not an admin for the zone, you're not supposed to have that information. Note that the person you are talking to on the phone is almost certainly not a DNS zone admin, so they also should not have that information. If they somehow did have it, they definitely shouldn't give it out over the phone. This is for your protection.
    4. If you choose to say 'I already told you that' {4} then your tone of voice is critical. If you say the above in a snarky/belittling tone the rep isn't going to want to help you. And that does matter. Smile between each response - especially if you are tired or annoyed.
    5. Hey, I'm a PhD in [field] and do [whatever] professionally. Before calling you, I've narrowed down the problem to [something on their end], so that's what needs to be addressed. If I could speak to an engineer about [specific problem], that'd be great; but if we've gotta walk through the script, let's just knock it out quickly. If they end up requiring the script, then the best way to use your expertise is to run through it quickly. Keep the chit-chat to a minimum and just do the stuff efficiently. If they start describing how to perform some step, you might interrupt them with, "Got it, just a sec.", then let them know once you're ready for the next step.
    6. Nowadays when I want technical support I will email my web host and give them all the necessary information, i.e. what I have tried to do to resolve, what I think the problem is etc and usually it is fixed first time within a few hours. If I need urgent assistance I will ring them but 99% of the time email is sufficient and less stressful, rarely do I need to send a second email.
    7. Some people, regardless of their experience level are horrible as teachers. A school teacher gets asked the same question every year. Every year they answer them, even if it seems redundant, and the answers are simple to THEM. Teaching requires patience and the acceptance of being asked "dumb questions" repeatedly. If they cannot handle that, then they should simply not teach or pretend to be a teacher.
    8. If the person answering the call misses something, nothing prevents them from asking you to repeat something. I think the key point that should be added to this answer is to not sound or act annoyed if the support tech asks for something you've already rattled off. To accept that you gave them a whole bunch of information at once, and that they might legitimately have missed or forgot one bit of it. Or, especially if you know the order in which they ask these questions, to take it slower; don't say it all in five seconds, take half a minute. Give them time to click!
    9. Tech support works with scripts. Just get to know these scripts by heart and answer all questions from the script you can in one long sentence, before they ask it. Like in "Hi I have a problem with this and that...I have restarted the router, I have checked the cables, the red light is on, the green light is off, not other lights are blinking......etc.etc.etc. That way the person at the other end of the line can just go click-click-click and you'll be 10 steps further in their script in 5 seconds.
    10. Look for certain questions that have been asked every time, and put those answers into the initial email you send about the new problem. Try to add things that make the potential problem sound local. The more information you give them that you know they will be asking for in their script, the faster you will get someone who can help you. And they will thank you for it.
    11. If you email helpdesk (us specifically), if you use appropriate technical detail you will probably get someone who knows what they're doing, and will greatly appreciate it. If you call, you will get me only. I will ask you lots of questions, with awkward pauses in between while I write my notes, and at the end of it I probably won't be able to help you. Technical detail is still welcome, but there are some questions I will ask you anyway even if they sound useless to you
    12. In one of my internship, I got to befriend a level 2 tech support, so learned a couple thing of how it worked (in that company). Level 1 was out-sourced, and they had a script to go from, regularly updated. From statistics, this took care of 90% of issues. Level 2 was a double handful of tech people, they had basic troubleshooting tools and knowledge and would solve 90% of the remaining issues. Level 3 was the engineering department (where I was), and as a result of level 1 and 2 efficiency less than 1% of issues ever got escalated. The process worked!
    13. OP is referring to letting people know they can speak like proper adults when talking about technical terms, without going through the usual nanny-like discourse that tech support has to provide to non-techies. For instance, it happened to me with Amazon support. The speaker told me exactly where to touch in order to clear the cache of the Android Amazon App Store. Given that I work as an app developer the guy could have just said "please clear the cache". No need to go through "tap here, then here, now you should see this, tap that"...
    14. Which is not to say that people employed on first line support are not knowledgeable; in my experience lots of over-qualified people have to take less advanced jobs in IT just to get into the industry.

      .

    15. So my best advice if you need to stick with them is just to expect the treatment you have become used to and 'play along'. Actually, I find some things often run smoother when you act dumber than you are.
    1. Skirmish mode, where the original game did great, this version lacks a bit of content. For instance, in the original game you could give your CPU (AI) players a name, so you could for instance relive the Avernii vs the XII Legion or anything for that matter. In the remasterd version you can't name any CPU players, which in my opinion is a loss. A lot of the skirmish fun was with the immersion of the factions.

      .

    1. Due to the cost and complexity of VAT/GST, Frozen Soul Games won't be able to register within each country. VAT/GST will be due upon pick-up after we ship to you. Thank you for your understanding.

      .

    1. Unfortunately one can only buy the standard or the soundtrack version, without any chance to upgrade, to buy the DLC extra. In this case I can only say if you get the game on a good sale (75 percent or more) and collect music, or if you want to support the developer, you might want the soundtrack edition.
    1. I've been using (and recently, contributing slightly to) Git for well over a decade. I don't have any single thing I'd specifically recommend at this point, but if you're looking for a decent book on Git, the Pro Git book has a bunch of plus-es: it's on line and kept up to date, it's free, and it's correct (unlike far too many online tutorials). There is also Think Like (a) Git, which covers most of what's missing from Pro Git.
    1. Local development and testing has huge advantages, but sometimes one needs to test web applications against their real-world domain name. Editing /etc/hosts is a pain however, and error prone. Node Foreman can start up an HTTP forward proxy which your browser can route requests through. The forward proxy will intercept requests based on domain name, and route them to the local application.
    1. git push -b

      What is this -b option?

      It's not documented, at least in my version:

             git push [--all | --mirror | --tags] [--follow-tags] [--atomic] [-n | --dry-run] [--receive-pack=<git-receive-pack>]
                        [--repo=<repository>] [-f | --force] [-d | --delete] [--prune] [-v | --verbose]
                        [-u | --set-upstream] [-o <string> | --push-option=<string>]
                        [--[no-]signed|--signed=(true|false|if-asked)]
                        [--force-with-lease[=<refname>[:<expect>]] [--force-if-includes]]
                        [--no-verify] [<repository> [<refspec>...]]
      
    1. For filter-branch, using pipelines like git ls-files | grep -v ... | xargs -r git rm might be a reasonable workaround but can get unwieldy and isn't as straightforward for users; plus those commands are often operating-system specific (can you spot the GNUism in the snippet I provided?)
    1. However, the place where pip places that package might not be in your $PATH (thus requiring you to manually update your $PATH afterwards), and on windows the pip install might not take care of python-specific issues for you (see "Notes for Windows Users", above). As such, installation via package managers is recommended instead.
    1. The NoScript extension for Firefox mitigates CSRF threats by distinguishing trusted from untrusted sites, and removing authentication & payloads from POST requests sent by untrusted sites to trusted ones. The Application Boundary Enforcer module in NoScript also blocks requests sent from internet pages to local sites (e.g. localhost), preventing CSRF attacks on local services (such as uTorrent) or routers.
    2. The same-origin policy prevents an attacker from reading or setting cookies on the target domain, so they cannot put a valid token in their crafted form.

      .

    3. Security of this technique is based on the assumption that only JavaScript running on the client side of an HTTPS connection to the server that initially set the cookie will be able to read the cookie's value.
    4. In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested.

      .

    5. Attacks were launched by placing malicious, automatic-action HTML image elements on forums and email spam, so that browsers visiting these pages would open them automatically, without much user action. People running vulnerable uTorrent version at the same time as opening these pages were susceptible to the attack.

      .

    6. Cross-site request forgery is an example of a confused deputy attack against a web browser because the web browser is tricked into submitting a forged request by a less privileged attacker.
    7. This link may be placed in such a way that it is not even necessary for the victim to click the link. For example, it may be embedded within an html image tag on an email sent to the victim which will automatically be loaded when the victim opens their email.
    8. A user who is authenticated by a cookie saved in the user's web browser could unknowingly send an HTTP request to a site that trusts the user and thereby causes an unwanted action.

      Can a user really unknowingly send an HTTP request? Or would it be more accurate to say the browser (user agent) sends the HTTP request, unknown to its (supposed) operator (user)?

    1. Data tainting[edit] Netscape Navigator briefly contained a taint checking feature. The feature was experimentally introduced in 1997 as part of Netscape 3.[10] The feature was turned off by default, but if enabled by a user it would allow websites to attempt to read JavaScript properties of windows and frames belonging to a different domain. The browser would then ask the user whether to permit the access in question.

      seems to have nothing to do with tainted data, more about trusting frames from other domains?!

    2. This mechanism bears a particular significance for modern web applications that extensively depend on HTTP cookies[1] to maintain authenticated user sessions, as servers act based on the HTTP cookie information to reveal sensitive information or take state-changing actions. A strict separation between content provided by unrelated sites must be maintained on the client-side to prevent the loss of data confidentiality or integrity.

      .

    1. A reflected attack is typically delivered via email or a neutral web site. The bait is an innocent-looking URL, pointing to a trusted site but containing the XSS vector. If the trusted site is vulnerable to the vector, clicking the link can cause the victim's browser to execute the injected script.

      explains how

    2. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, to session cookies, and to a variety of other information maintained by the browser on behalf of the user.

      .

    3. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system.

      .

    1. How do I setup a path alias? permalink First, you need to add it to the Vite configuration. In svelte.config.js add vite.resolve.alias: // svelte.config.js import path from 'path'; export default { kit: { vite: { resolve: { alias: { $utils: path.resolve('./src/utils') } } } } }; Then, to make TypeScript aware of the alias, add it to tsconfig.json (for TypeScript users) or jsconfig.json: { "compilerOptions": { "paths": { "$utils/*": ["src/utils/*"] } } }
    2. How do I hash asset file names for caching? permalink You can have Vite process your assets by importing them as shown below: <script> import imageSrc from '$lib/assets/image.png'; </script> <img src="{imageSrc}" />
    1. There are two ways to move your packages to ESM:Pure ESMThis has the benefit that it’s easier to set up. You just add "type": "module" to your package.json, require Node.js 12, update docs & code examples, and do a major release.

      .

    1. There are two ways to handle the migration:Pure: Rip off the bandaid and completely move to JavaScript Modules.Dual: Introduce a build step that transpiles a CommonJS fallback.

      .