70 Matching Annotations
  1. Last 7 days
    1. entrées vivent en localStorage (condorcet.past-scrutins, tableau de {url, title, at}) parce que c’est local par appareil par essence : ce que ce navigateur a vu, pas ce que tous les utilisateurs du scrutin ont vu.

      Readback. Et même pas pertinent pour comprendre le test qui suit

    2. pour qu’on ne puisse pas reconstruire l’ordre soumis par le précédent à partir de la position initiale.

      C'est aussi pour éviter le biais cognitif qui tend à préférer le premier choix

    3. mode per-device, chacun vote depuis son propre appareil — mais on doit pouvoir simuler ce flux sur une seule page de test pour ne pas dépendre d’un serveur de sync : Alice s’identifie, vote, puis on efface la clé d’identité du localStorage, on recharge, et on revient à l’identity-screen où Alice apparaît grisée (déjà votée) et Bob peut prendre sa place.

      Trpp hack

    1. An audit against these principles takes the form of a table: every observation cited by file and line, classified under the principle it tests. The conclusion follows from the table; it is not stated alongside it. An uncited verdict is a guess; a cited verdict has done the reading

      This looks like witchcraft spell

    2. When a bug or oversight surfaces during implementation

      Or a change of mind, or a change of code due to a recent upgrade and a breaking change in a lib, or ...

    3. These asides should be rare

      And when we feel the need for an aside, it may mean that there is a gap between what can express human language and computer language, but it may also mean that the code is poorly written or may need some refactoring. The structure of the code in no way must follow the structure of the prose. We have the power of noweb to put the code back in the correct order during tangling, so we mustn't write a poorly designed code with the excuse that the prose went one way and not the other

    4. Each named symbol earns its own introduction

      Not necessarily. The code split is arbitrary (one block per symbol, several symbols per blocks, several blocks per symbol...). Explaining every getter and setter of a boilerplate java code is useless for instance. By contrast, writing several non related functions with only a vague prose about general ideas with no clear way to guess the links with the functions calls for a few more sentences to explain or splitting the code block. What rules is that the reading flow is the most important. If the reader needs to stop and say "wait a minute... what the hell are those functions for? i was reading about nice abstract things and I don't understand the connection with the code i'm reading", it means that we broke the flow

    5. never a readback of the code.

      Sometimes, a short readback makes sense if that is needed to understand how the code is a translation of the prose. It's an aside see below

    6. standalone “test paragraph” separated from the main narrative: if a behavior is worth testing, it is worth stating in the narrative, and the test follows naturally

      This sometimes happens because the agent was confronted to a bug and added some mitigation. It then adds an extra prose and test to explain it without integrating properly. We may want to emphasize that in that case, the prose itself may need refactoring so as to become coherent again. Simply adding a hack with a test and extra dumb prose may make the testing green, but in no way it is acceptable.

    7. A paragraph whose only purpose is to describe the block that follows (“this function does X, it takes Y as a parameter…”). Prose states the need, not a paraphrase of the code

      This is ambiguous and may confuse the agent. There is prose about the code

    8. This order reflects the fact that we know what we want before we know how to achieve it.

      No, it reflects the way we address another human being. LP brings human comm at the center of coding

    1. même manchon vu dans les deux postures rend le compromis évident : à gauche debout, les couches se déposent à plat, la calotte se referme doucement en haut sans appui ; à droite couché, la surface ogivale surplombe le vide et réclame un peigne de supports.

      Partie et graph inutilrs

    2. Bambu Lab A1 mini6, buse 0.8 mm déjà montée. Combinaison bed-slinger + grosse buse : les extrusions épaisses masquent le ringing en Y7, et l’adhésion inter-couche reste excellente en haute flow (tests Prusa 0.4 vs 0.6 : +25.6 % d’impact sur la grosse8). On garde la 0.8.

      Indigeste

    3. import math import warnings import build123d as _b123d from build123d import ( Align, Box, BuildLine, BuildPart, BuildSketch, Color, Compound, Locations, Mode, Plane, Pos, RadiusArc, Line, Rot, add, extrude, export_gltf, fillet, make_face, ) warnings.filterwarnings

      Détails techniqurs

  2. Mar 2026
  3. Dec 2024
    1. if an ID token is intercepted and the system doesn’t validate it properly, attackers can impersonate users.

      Same for access tokens, if not validated correctly

    1. user has granted a permission for the client to get an ID token, but she didn’t imagine that the permission would enable the client to call APIs of the irrelevant resource server.

      For a first party scenario, the user is likely not aware of the notion of resources. Per simply use an application

    2. client that has no relationship with the resource server can access APIs of the resource server using an ID token that the client has legitimately obtained in an utterly irrelevant context.

      No, the resource server can check that the proper client (azp) is accessing the resources

  4. Nov 2024
    1. API shouldn’t accept a token that is not meant for it. If it does, its security is at risk. In fact, if your API doesn't care if a token is meant for it, an ID token stolen from any client application can be used to access your API

      While this is true, it is not the only option. If the resource server checks that the token was indeed issued TO one of its known clients, that excludes the risk of accepting ALL the possible ID Tokens

    2. If your API accepts an ID token as an authorization token, to begin with, you are ignoring the intended recipient stated by the audience claim

      You can still check it, make sure it was intended for YOUR client and your client alone.

  5. Mar 2024
  6. Feb 2024
  7. Sep 2023
    1. scientifique doit tout savoir sur ce qui est attendu avant de pouvoir être surpris, et cela nécessite de l'expérience sur le terrain.

      Effet Dunin Kruger ?

  8. May 2023
  9. Jan 2023
    1. The only way in which one can know the world is through the means by which they know the world; a method cannot justify itself. This argument can be seen as directly related to Wittgenstein's theory of language

      Lien avec Achille et la tortue ?

  10. Jul 2022
    1. Nudges steer people towards a particular behaviour by creating environmental conditions that trigger a given heuristic strategy. In contrast, boosts change behaviour by fostering people’s decision-making competences

      IOT, nudge rely on some supposedly existing state of system 1 while boost educates the system 1

    1. Loaded language (also known as loaded terms, emotive language, high-inference language and language-persuasive techniques) is rhetoric used to influence an audience by using words and phrases with strong connotations.

      Associé à synonymes à connotation opposée

  11. May 2022
  12. Feb 2022
    1. { "kind":"reveal", "source":"tz1WmhTgcckoDagACbXAxatWMKy7yesY349p", "fee":"0", "counter":"1527770", "gas_limit":"10000", "storage_limit":"0", "public_key":"edpkva47oZEvUyhonx13xfBBVckJDYHWXHUZmdoz7gxiZE8tW45FjK" }

      Fee = 0

    1. REST concentrates all of the control state into the representations received in response to interactions. The goal is to improve server scalability by eliminating any need for the server to maintain an awareness of the client state beyond the current request. An application's state is therefore defined by its pending requests, the topology of connected components (some of which may be filtering buffered data), the active requests on those connectors, the data flow of representations in response to those requests, and the processing of those representations as they are received by the user agent.

      Hateoas ?

    2. REST components perform actions on a resource by using a representation to capture the current or intended state of that resource and transferring that representation between components

      Hateoas : the hypermedia os the way the state is communicated from the client to the server

    3. model application is therefore an engine that moves from one state to the next by examining and choosing from among the alternative state transitions in the current set of representations. Not surprisingly, this exactly matches the user interface of a hypermedia browser.

      Hateoas. It dpes not say that the server rrsppnds with the lonks

    4. application state is controlled and stored by the user agent and can be composed of representations from multiple servers

      The state is user agent's business and may even overlap several servers ontologies

    5. REST is defined by four interface constraints: identification of resources; manipulation of resources through representations; self-descriptive messages; and, hypermedia as the engine of application stat

      Hateoas

  13. May 2021
    1. // Create a wallet const wallet = arianee.fromRandomKey();

      Example of ambiguity around the term wallet nothing tells whether here wallet means "private keys on your computer" or "account at arianee"

  14. Apr 2021
    1. Contrairement à l'enregistrement, aucun des services susmentionnés ne nécessite un agrément obligatoire pour pouvoir exercer

      Agrément != enregistrement

  15. Feb 2021
    1. Remembrance Agent

      Funny how the acronym is also the one of Reticular Activating System, that David Allen, in the gtd, claims to be the part in the brain responsible for similar associative memory triggering.

  16. Jan 2021
    1. what is the goal of a scientific experiment at hand? If the goal is to establish a discrepancy with the null hypothesis and/or establish a pattern of order, because both requires ruling out equivalence, then NHST is a good tool

      Occam's rasor

    2. The figure was prepared with G-power for a one-sided one-sample t-test, with a sample size of 32 subjects, an effect size of 0.45, and error rates alpha=0.049 and beta=0.80. In Fisher’s procedure, only the nil-hypothesis is posed, and the observed p-value is compared to an a priori level of significance. If the observed p-value is below this level (here p=0.05), one rejects H0. In Neyman-Pearson’s procedure, the null and alternative hypotheses are specified along with an a priori level of acceptance. If the observed statistical value is outside the critical region (here [-∞ +1.69]), one rejects H0.

      IIUC, Fisher's p-values tests H0's significance while Neaman&Pearson's alĥa, beta compares the relative significance of H1

    1. A note that is not connected to this network will get lost in the card file and ill be forgotten by it.

      A good idea for a review for expiring notes: use the degree and the date of the note as a hint. An old unconnected note may be forgotten to avoid polluting the system. A good companion capable of discussion and surprising us should (IMHO) also be capable of forgetting fading stuff, like I do.

    1. There are two possible ways to assemble a draft with the help of notes from the archive: Copy and paste everything into a single document and rewrite later. This creates a strong relationship between your draft and your notes right away. If you change the notes in the process, the changes won’t be reflected in your draft. Reference notes instead of pasting their content. This is a much weaker relationship. You don’t rely on the content of a note itself, but on the note’s existence

      Can we do both with org-transclusion?