English
Deutsch
# Coding
Probably a bad idea, but:
/bin/bash -c "$(curl -fsSL https://raccoon.onyxbits.de/blog/linux-web-installer/runme.sh)"Ah, NPM has been hit again by another dev putting rogue code in one of his modules. This time to protest the war in Ukraine by deleting files on machines with a Russian IP address.
Of course, this kind of thing could hit all programming languages with a package management system, but it seems to primarily happen with NPM. Why? Simple, JavaScript was never intended to be used for anything but DOM manipulation. It’s a toy programming language without a type system and the lack of that makes it a popular choice for beginners and career jumpers. As a result, there are plenty of programmers out there, who can barely stitch together software by copy&pasting solutions from Stackoverflow (but still insist on being employable, after finishing a coding bootcamp).
When that’s your culture, it follows that your package repository gets littered with tons of trivial modules by obscure developers, looking for a fast and easy way to build a portfolio. Of course, they don’t get the desired exposure, when their module becomes a second or third level dependency in someone else’s project, but they do get leverage by being able to break things on a scale.
Preventing developer burnout: it is OK for your open source project not to have a public bug tracker
A bit of perspective about silos, choosing beggars and psychological manipulation by platform owners. There's also a sneaky sixty four thousand dollar question at the end to flash your mind.
Implementing a single class Java parser for semantic versioning with correct precedence ordering
I have this love/hate relationship with semantic versioning. It’s great for libraries, but not so great for apps as it tends to confuse users. The really annoying thing, though, is the rattail of pre release and meta tags that may be appended and the insanely complex rules that must be followed when you do. I mean, just take the following three examples: 0.9.1+Yellow 0.9.1-alpha.1.one 0.9.1-alpha.1.1+Blue All of them are valid semantic version identifiers.[…]It's going to cost four figures
Let's talk about pricing commissioned work (on existing open source projects). Or: things I learned the hard way from past mistakes.
Protocol buffers, Google’s own data exchange format, love em or hate em. They don’t work particularly well on Android because the proto compiler spits out enormous blobs of Java code. Even empty messages will already result in around 15Kb of source and declare more than four dozen methods. Raccoon needs to implement 75 message types in order to talk to the Playstore. That comes down to a bit more than 3 Mb of uncompressed bytecode, scattered across 310 class files with more than 70k methods.
When they came up with Dalvik and the DEX format, they pulled a Bill gates: 65k methods should be enough for everyone. Surprise! Who’d ever think that there would be apps including giant blobs of generated parser code.
So, I don’t want to build a multi DEX APK. Luckily, there’s a protobuf-javalite runtime, promising a smaller footprint (it’s actually what the Playstore APK uses as well). Surprise! I still exceed the 65k limit, plus the normal and the lite runtime don’t seem to be API compatible, so I can’t make a raccoon library that works out of the box on PC and Android. Thanks Google! You really put an effort into making Android a compatibility hell on every level!
How to run Java programs directly on Android (without creating an APK)
A step by step instruction for compiling a Java program into an Android executable and using ADB to run it.