« first day (4609 days earlier)      last day (332 days later) » 

1:10 AM
> non-u-strings are actually bytes
that's only in Python 2
 
 
3 hours later…
3:53 AM
@roganjosh That website, the D3.js Graph Gallery (d3-graph-gallery.com) is a great third-party website for which visualization to use and how to implement it. I see zero ads on it, mind you I have an adblocker. You should use one too. Most people these days wouldn't browse the open web without an adblocker.
 
 
3 hours later…
6:50 AM
@Arne That's not in python, I was asking for UX advice
Thanks for the help
 
 
5 hours later…
11:35 AM
I am using python celery working with command celery -a src.celery_app worker -n worker@%h
Which is working fine

When I am running multiple instance in my local machine with different worker then only one worker is picking up a task at a time. Which is expected

But when I am running multiple replicas in kubernetes with same command multiple pods picking same task and processing same task. I want only one pod should pick a task
 
12:30 PM
Is this vulnerable to SQL injection?
conn = psycopg2.connect('my connection str')
cursor = conn.cursor(cursor_factory=RealDictCursor)
cursor.execute(sql.SQL("SELECT * FROM table WHERE x= %s"), "sql injection here")
Docs present a different way to do it. So, I'm not sure my case is equivalent. I did test my code above and seems to be matching my quotes (effectively preventing the attack). But I have no idea if a quote is the only way to perform it.
 
What is sql.SQL?
Hmm, I don't think I've ever used that from psycopg2
Just a skim through the docs for it - I'm pretty sure that query would error anyway rather than execute with your default string?
 
12:45 PM
@roganjosh you mean "sql injection here"? I use ';DROP DATABASE IF EXIST table5 and variations of it. And it's safely regarded as a continuous string. But I want to make sure there are not exploits.
 
You're misusing the sql.SQL module. That is for composing strings for things that you can't use parameterization on. That means, it's used for inserting things like the table name into your string before you run the query. It's not meant for actual values, which you're using %s for here
Your query should be cursor.execute("SELECT * FROM table5 WHERE x= %s", ("something; DROP DATABASE IF EXISTS table5",))
Despite the appearance of the query I just gave, it would not be vulnerable to injection because of the use of parameterization. The reason that I think your initial example would simply crash is because cursor.execute() expects an iterable for the second argument, so it would have started unpacking your string character-by-character and found that there weren't enough (there's 1) placeholders for them
If you wanted to make table5 dynamic, then you can't use the same mechanism, which is why sql.SQL exists. The reason I haven't used it before is that I usually just cross-reference with a whitelist e.g. here for the requests in the "Performance Review" section here. sql.SQL looks tidier tbh
Basically, if the variable's directly on the right hand side of = you should use my method (not sql.SQL) and if it's on the LHS, use sql.SQL. I think that rule holds; at least, I'm not able to think of a counter example right now
And finally, as the docs show, you can use both methods. First to do the string interpolation parts, which will ignore your value placeholders, and then pass the values (42 in their example) in a second stage
 
1:03 PM
no idea why my corporate network blocks psycopg.org
seriously, their policies baffle me sometimes
 
@roganjosh Thanks a lot. I'll see how to do it right
 
@matszwecja That's frustrating :/ It's full HTTPS and the certificate is valid, so there isn't an innocent explanation
 
It even blocks github.io
 
@PythonForEver while you're getting your head around this, I would strongly suggest moving away from the %s placeholder. I'm tired of how much confusion it causes because of the clash with the old string formatting methods, which are entirely different. I use %(variable_name)s where possible (VSCode will highlight that) or, :variable_name when I'm using the most recent version of SQLAlchemy where they made %{variable_name}s invalid
Well, invalid or unviable. I'm not sure which. But it throws errors every time I've tried to build raw queries
 
 
3 hours later…
3:46 PM
hi
 
 
3 hours later…
6:21 PM
there's a new theme on stackoverflow o.o
 
you mean the ugly buttons to vote ?
 
Yeah. Those things. I get that they're trying to be accessibility standards-compliant, but why make both the up/down arrows and the post score smaller?
 
6:36 PM
how does that make it more accessible
 
I just don't understand why they need to use the same color as the background. In light mode, there is white on white. When they locked in, in orange, it is a less pain in the eyes. However, a small raised relief could fix it.
As I think about it, yes the dimensions really is an issue. Before it was bigger and highlighted this feature. Now it disappears in the surroundings. Agree
 
i wonder if someone has made a userscript to fix it maybe
 
7:21 PM
Perhaps I was too optimistic in this comment...
Thank you. Some of the previous changes made it seem like SE's accessibility strategy was to make the interface equally difficult for everyone to use. ;) — PM 2Ring Jan 27 at 6:51
 
 
2 hours later…
8:56 PM
is there a technical term for "rescheduling the same task" over and over again. Since it is not recursive by definition, I wonder if there is a different name for it out there.
does trampoline apply here ?
 
9:45 PM
@Thingamabobs Do you mean 'deferring','procrastinating' or just '(repeatedly) scheduling multiple instances of a recurring event'? Give an example pls. And I don't know what you mean by 'trampoline', please give an example of that too. But I'm not seeing how this is on-topic here.
...if just a general question, recommend using English Language & Usage Stack Exchange
 
10:25 PM
@smci "Trampoline" has a CS jargon meaning. We even have a tag
Admittedly, there are only a few Python questions in that tag, but there appears to be a good looking answer here: stackoverflow.com/q/71037285/4014959 (but I only skimmed it briefly).
@Thingamabobs Not really.
I can't think of a standard name for that kind of rescheduling loop. That kind of thing is often needed in animation, eg in a Tkinter .after() call, or a JavaScript requestAnimationFrame(). But MDN doesn't seem to have a special term for it. developer.mozilla.org/en-US/docs/Web/API/window/…
 

« first day (4609 days earlier)      last day (332 days later) »