You don’t need ORMs to prevent SQL injection. Prepared statements have existed for decades.
- 1 Post
- 681 Comments
FizzyOrange@programming.devto
Programming@programming.dev•Do you ever miss important client messages because everything’s scattered?
1·3 days agoHow does it integrate Slack and WhatsApp, given they don’t have official APIs? All reverse engineered?
Well they’re open source so we’re not losing them yet. Especially with
uv, it’s pretty clear that it is such a vast improvement over the clusterfuck of pip that a community fork is virtually guaranteed if it is ever necessary.
FizzyOrange@programming.devto
Programming@programming.dev•METR AI Coding Research Inconclusive Because Dev Participants Refused to Complete Tasks Without AI
1·9 days agoYeah I know, but if you really mean that analogy then the conclusion is that the normal thing for 99% of programmers to do should be to use AI. In the same way that 99% of people do not get around by running.
I don’t agree with that yet - so far I’ve found AI to be a very fast but mediocre programmer. Kind of like giving a beginner access to all the documentation and a time machine. Sometimes that’s exactly what you want. But definitely not most of the time.
FizzyOrange@programming.devto
Programming@programming.dev•METR AI Coding Research Inconclusive Because Dev Participants Refused to Complete Tasks Without AI
1·10 days agoNot everyone that runs is an avid runner.
But I do feel like the analogies aren’t that great. Coding in notepad instead of an IDE is dumb because IDEs work and don’t really have any downsides. AI mostly seems to produce slop that barely works without a ton of cajoling.
FizzyOrange@programming.devto
Programming@programming.dev•C++26 Safety Features Won’t Save You (And the Committee Knows It)
21·10 days agomodern C++ facilities do make a difference to prevalence of bugs.
This is true, but just saying “write modern C++!” doesn’t actually work in practice. First, there are a ton of footguns that even best-practice C++ doesn’t avoid. Using
std::shared_ptr? Great, you’re probably going to avoid memory leaks. Null pointer dereference? Not so much. What’s the modern C++ way to avoid integer overflow?Second, it’s pretty much impossible to completely avoid raw pointers etc. even if you’re trying, and good luck getting your colleagues to actually try. I can’t even get mine to write proper commit messages. You need a machine forcing them to do it properly. Something they can’t opt out of (or at least where opting out isn’t the easy lazy option).
So yeah it’s better to use modern C++ and it is an improvement, but not enough the change the conclusion that you should just use Rust instead.
FizzyOrange@programming.devto
Programming@programming.dev•Inkscape needs help. The Inkscape team is hiring one issue administrator and two C++ developers for part time positions
4·16 days agoDamn that’s pretty good! (Outside the US I mean.)
Presumably this would be a bit higher actually since it’s contract work, not full time.
FizzyOrange@programming.devto
Programming@programming.dev•We Overhauled Our Terms of Service and Privacy Policy - Another VC funded bait and switch
1·18 days agoThat is about their AI service. If you don’t use that then who cares?
FizzyOrange@programming.devto
Programming@programming.dev•Looking for a Q&A community that isn't as restrictive as StackOverflow
2·22 days agoTo be honest I suspect they wanted to do this before, but the power mods wouldn’t allow it. I definitely remember the staff posting a proposal to allow second chances for closed questions, and it was downvoted to hell by the mods. They presumably got scared because they were getting a lot of free labour from the mods (even if it probably wasn’t exactly the kind they wanted).
Now StackOverflow is dead the mods have no power, so they are free to make changes.
FizzyOrange@programming.devto
Programming@programming.dev•Looking for a Q&A community that isn't as restrictive as StackOverflow
3·23 days agoThe company is going forward with it because the “active community” killed their site and now they have no choice.
If they had done it before AI became a viable alternative they might still have some users.
FizzyOrange@programming.devto
Programming@programming.dev•Is it a bad practice to replace compiler warnings with a bunch of TODO notes?
2·23 days agoI would say it maybe makes sense to do that for team based projects so your TODOs don’t impact other people finding new warnings in their code.
For solo projects I don’t think that makes any sense.
FizzyOrange@programming.devto
Programming@programming.dev•Are there programmers that still don't use AI?
21·25 days agoNot the great rebuttal you think it is… AI isn’t really about writing code that I couldn’t write. Unless you’re a beginner it is absolutely not at that level yet. It’s about saving time.
Which it definitely can do. Especially for one-off tasks. For vibe coding projects my experience has been mixed. AI seems pretty good for getting things going, especially in areas you aren’t familiar with (e.g. I wrote a simple Chrome extension with it; never written a Chrome extension before). But after a certain point they seem to get stuck in a muddle and you basically have to stop using AI, fix all the code it wrote badly and continue yourself.
But overall it can still be significantly faster than being prideful and doing it all by hand.
The connection column indicates the connection used. USB FS stands for the usb full speed protocol, which allows up to 1000Hz polling, a feature commonly advertised by high-end keyboards. USB is the usb low speed protocol, which is the protocol most keyboards use.
USB Low Speed allows 1kHz polling too. I don’t think you gain anything at all from High Speed. Keyboards probably only use it incidentally because the chip they are using happens to support it anyway.
Huh I was under the impression that you could limit it to specific applications and dbus would tell kwallet the path of the application making the request (which could be done at least vaguely securely). But upon further investigation it just uses the “appid” that the app reports which it can apparently set to anything it wants. It’s difficult to find information about this stuff though. D-bus is not very well documented at all.
Interesting how do you do that exactly?
I was thinking you can just start the app that has permission to read the wallet, attach a debugger and then inject code to dump the wallet. It’s definitely more complicated than reading a plain text file but not fundamentally less possible.
But really if you have that level of access it’s game over anyway and you just MitM sudo and get root access, or use one of the many local privilege escalation vulnerabilities and get root immediately.
They should be keeping them in something like kwallet. But in practice they don’t because a) there isn’t really a single standard for that on Linux (yeay, I have to support gnome-keyring too!), b) it’s a lot more work than using a plain text file, c) the UX is considerably worse, and d) the security benefits are marginal at best (especially if you have full disk encryption).
Plain text is the most sensible option.
FizzyOrange@programming.devto
Programming@programming.dev•Are there any examples of 'perfect' software?
8·1 month agoYeah you probably can’t do to much more to
pwdoryesor whatever (yeah I know about the silly optimisations). I think once you get much beyond that there are always more features you can add. Even for something likecd, people have made fancier versions with fuzzy matching and so on.
FizzyOrange@programming.devto
Programming@programming.dev•Are there any examples of 'perfect' software?
27·1 month agoNah it was eternally annoying that it didn’t support Unix line endings. Also there are clearly a ton of basic features that people want from lightweight text editors.

ORMs are a pain and so is hand rolling SQL queries and doing the mapping manually.
I definitely think there’s scope for NoSQL databases where the database “shape” matches the normal struct style of programming languages. Kind of like how JSON does and XML doesn’t.
But it seems like all we got was MongoDB and Firebase which are both shit.
Are there any good NoSQL databases? MongoDB and Firebase don’t even have schemas.