บทถอดความฉบับเต็มของ Episode 10110110: Avocado Prices and Oppenheimer

get because like, it's a frickin shortcode. Like, what? Yeah, look at it, possibly. I did fix it. So you know, anybody watching or listening to this can know that it's a safe and secure plugin for what it's worth. But yeah, the person that was the person that reported it was just a random person using it. And they weren't even getting the report from packstack. Directly. They were getting the report from some other security plugin that used patch tax API to report on issues. So this was already like, second hand, like third hand, you know, and when they asked about it to the plugin, the plugin said, Well, it just on this report over here. You know, we don't know anything about it either. Because I was like, because I think I asked What in God's name could possibly be insecure about Gary a shortcode? Yeah, this doesn't that seem a little like irresponsible on that, that like middle plugins, like, Hey, we got this great database of risks. And yes, was in there. But I mean, what's what's the risk? I don't know, we just looked at this other database. Yeah. Chris And I think it was, I think it was like a cross site scripting thing where like, text wasn't being escaped properly, because there is a possibility that you could put just user text into the progress bar. And because it wasn't being escaped, I mean, like stuff that would only be stuff that would only be affected if you already have admin access. And I basically said that too. But like, also, I wanted to make the alert go away. So I, you know, fix, obviously, but and I also then added that that was when I wrote my first GitHub action, because I wanted to have something that would perhaps tell me when there was a problem. Yeah. But they get up action is based on so 10 up has a plugin vulnerability monitor. thing, it's not an action, it's a thing, I don't know. Tool, which can use patch stack, or I don't know, whatever the other ones are. There's like three. WP scan is one of them. And then there's the one that's not owned by automatic. And that also isn't a patch deck. And the last one is free for basic things. The other two require, like a fee to access the API. So I basically I wrote this action that hooks into their thing, you can pass which library you want to use, and if it needs like authentication, or whatever. And then and then it will give you an alert, if the code that you're shipping had is a, you know, a problem. And so if you are a plugin, then you could add it to your plugin repository, GitHub actions, and it will say, Hey, your plugin is vulnerable. Now. I realized after I read all of this stuff, that this is checking an existing database, it's not going to tell you that the code that you shipped, was vulnerable. It just telling you that database, yeah, it's just telling you that a vulnerability exists in the database with this plugin, because it installs a plug in and then runs the check on it. So it's not, you know, as useful as it could have been. But it's something Gary

that matters less though, like at least it's happening and the alerts are taking place. Like we push code you go oh, yeah, that while I'm thinking about it, Chris you can hook it to a cron and then it can just be like a thing that runs periodically and I love you Gary use Git hubs. Action cron stuff. A little terrible, is it's it's completely hon it's Chris it's, yeah, it's not so worse than WordPress is. Gary Depends on the traffic you get to your WordPress site, I guess. I don't know, I don't know what the trigger is, but it's definitely not reliable. You would like to do this every five minutes. And it's like, yeah, I'll see I'm feeling. I mean, maybe I'll skip that one. It's, I wouldn't, Chris I wouldn't expect a cadence of every five minutes anyway, probably, I would probably only run it once a day or once an hour or something. Yeah, well, Gary in this case, that makes sense. And it would probably be fine at that. But for small things like, Chris yeah. Well, for small things, you should probably be doing it on commit anyway. I mean, unless it's like, unless it's an action that's going to take a really long time to run. Even then. Gary Yeah, we were we were kind of abusing it. We were using it to pull an external system to determine some other stuff. And so the frequency was helpful during the day, especially as it related to like live sales, but what are you going to do it? We didn't need to use GitHub actions for that it was arbitrary that we use that we needed something automated, and we didn't have a machine lying around that we could do it with. But the right thing to do would be stand up a machine that's purpose is to run this cron Chris or use something more robust than GitHub actions like circle CI or something to do that thing. Gary Yeah, we ran into a fun once I don't want to talk about code anymore. Allison mean, I don't even really want to talk about it when I have to for work. So Chris we had a we had a viewer I say this, like, it's a shock. We had we had a comment on a recent video. Yeah, that evidence that or that, that. They said, Hey, I will subscribe, and then I actually saw them subscribe. So yeah, yeah, welcome. Let me find, let me find the comment. Oh, no, I can't find it. Gary I while you're looking for the comment, I will say I was on a call yesterday with some devs. And we had covered our topics. And then we got into like a conversation about the craft of writing software. And that was a lot more fun and mixing. I knew we were like, 20 minutes over our time. And I'm like, Oh, if you need to leave, you can go. I didn't mean to keep anyone. And they were like, they we were we were on the same page. Like no, this was fun to have like a deep cuz we're very different discipline. So it was a lot of dialogue and back and forth. And how do you dot dot dot, and it was really fun and helpful. Chris The users user is Zephyr spelled with an eight. Gary Not sure where the eight would be in Chris Z A

to H Y, capital R. Okay. And then we're Gary gonna spell it eight. And I'm like, well, it's not the first No, right? It could literally be any other. Any other letter? Or maybe not even a letter, just the letter, the number eight injected? Chris Who found us who found us via the genre? inator API. Gary Welcome. Yeah, yes, we're not we're not shutting that down, I guess. Chris Yeah. That works. Well, it's also running on the website. So we'd have to shut the website down for the genre near to, to not work. Yeah. Not Not that I'm like actively testing it probably. That's the thing that we could write a GitHub action just to, like do a proof of life to say like, Hey, it still works. Yeah, like, you know, automated checking to make sure that it's still pinging? I Gary yeah, I see the number coming up every day in our DevOps channel. And I'm confused as to why did we ever figure out why it goes up as much as it does every day? No. Chris I mean, I assume I assume that there are things that I mean, it hasn't gone up in a while. It's been 4,289,805 genres for a while. Gary Maybe we've reached the limit of what's in there. Chris Maybe we reached maybe, maybe, maybe we reach some sort of big int value, where it actually can't increment more than that. Gary Listen, I said I want to talk about code but now I want to find it. Chris Actually been that number for quite a while. Gary That's me. It doesn't work. Let Chris me let me let me generate a new new genre. Gary Well, I don't I don't think that that's the thing is like login. Oh no, we use How do I keep track of it? Sure. Chris Maybe What's the genre neater API? I want to Okay, here's the there's the endpoint. So I'm creating a genre. And it is doing something. Maybe. Maybe not. Oh, no, it did. Bunk. Bunk. Viola Acoustica. That's a good one. Okay, can I do a count? or million 630,786. Gary So it did go up? Chris Let me confirm. Yes. But perhaps the alert bot is not getting the right number because that number is different. Allison So how did we get to 4 million in the first place? Chris I mean, I do think, Gary I don't know. So genre count. But in the binary jazz genre, inator genre account. Function. Chris I do think that we'll at least when we have the genre neater, twitter bot spitting stuff out, like once an hour or your read, then it would be making a lot of stuff that way. And if anybody's using it to do that sort of thing, automated type stuff, then then it could get big that way. Gary This is compelling content. I really Chris I know, we can also compelling audio content, right? Yeah, we can also do, you can also do genre with a number at the end to do a bunch of genres. So we'll give us another 25. But I just did gypsy saxophone. That's a little bit tame, actually. Gary So I just realized that we are not checking for duplicates. Chris Ya know, for sure. We're for sure. We're not checking for duplicates. Because we're just iterating. Every time somebody creates a genre, there's no way that like, yeah, we may have created every possible genre in existence, but we will never know. But we will never know. But that number is probably something ridiculously stupidly high considering the number of variables that we fit into this thing. Gary Well, that was my other thought is, it'd be nice to know what that number like the potential maximum is. Chris I bet that's something that's calculable. It is Gary yes. It's a I don't remember how to do that calculation. But yes, Chris like it's like, okay, so we would like multiply like instruments, by beads by adjectives by prefixes by suffixes, by regions by genres. Because each one of those things can get have any of the other previous things or something. Gary Yeah, I think it's minus one or something at the end. Sure. If you said doesn't matter. Yeah, it is a big number. Yeah. Had a lens app two step flow. Chris I'm done with that one. Gothic crossover dance. That's pretty good. I based up fusion, I mean, honestly, like, it's still a really good but these are. These are legit genres that I would like listen to. Gary I've shared before that, like the best crowds I get when I play at nursing homes or if I open like before, bingo. So I was thinking bingo, Prelude would be being a really good moniker. Yeah. Chris Like as as a name or as a as a performing band name generator. Gary My name is bingo Prelude. Allison Call, you can just add that to the genre neater, it'll say a genre and then be like, you know, like, Gary an example musician or band. So Chris it needs a different it needs a different API, though, like the John inator API could hook into the Bandra. inator API. Back end Gary we probably have talked about before, but I don't recall it. Have you ever watched Phineas and Ferb? Chris There's like character in all amounts. And I know that this has come up in the podcast before Gary the inator Dr. Doofenshmirtz everything he creates is it's funny, it's a it's a good Chris show. It's it's it's a it's a worthwhile way to name things we have. We have the update neater. At Pantheon which is a automation Dr. Doofenshmirtz vein and automation tool that updates things Gary I have a thing that builds fast. It's called a facet inator. Yeah, pretty good. Chris The update near actually requires two parts. There's the update Nader, which is the tool itself. And then there's the update neat function. But update, Nate has been renamed to update tool because having updating Nate and updating the tour was too difficult for people to remember. Like, because it's already confusing enough to know to try to figure out which tool you need to edit to add a new thing to update to Nate. Because it's not super clear where that code lives just at a glance. Oh, it's always one of those things. Where, where's like, where do I put this? We're talking about code again, let's not talk about code. So let's talk about AI. Gary Let's talk about

something. Chris Although our last, our last show description was written partially by AI. Gary Well, if you'll recall, I got a pep talk from AI and I yeah, not you feel perfect. Do you know Pepsi? Um, let me tell you about my breakfast yesterday, because it was it was it was real. Allison Tell me that your Chris breakfast wasn't created by AI, compelling, compelling audio content. We Gary have some really nice English muffins right now. And Chris I think I can eat I think, Gary sorry. So I fried two eggs and put avocado on top, I put English muffin then avocado, then the eggs on top. And I usually go the other direction I put the avocado on top of the egg. But reversing that order made all the difference in the world. And I don't know why I haven't done that before. I'm still thinking about it. And it's been 36 hours. Allison I agree with the new order. Gary Yeah. Doing before, like, I Allison don't know. It's like you weren't living your life to its fullest. Gary I think I think in my head, I was like, Well, I'm having eggs and English muffins. Like a half a one. So it was garnish on top right? But no, actually, if you put it underneath number one, I can eat more of it. Because I feel like it's more important but so good. So good. But then also like it, it actually serves like the place of like I don't need to butter, the English muffin because I got this yummy avocado there. So anyway, that was a quality life improvement for me. Chris We had an avocado recently that was of the variety were like the middle of super hard randomly. But like the outside feels normal. So like you cut into it. And then it's like wait, I can't. I can't. I can't actually cut this in half and I can't actually scoop the thing and then it's just a big mess of avocado in my hand and yeah, it is this Gary shirt. I don't know why I can't see the cut avocado without launching half of it against myself and leaving the green spot on my shirt. So that's my current struggle is this. And you know what? Allison Avocado apron? Gary I do. I have a nice apron. I don't know why I don't wear it when I'm cutting avocado because I'm doing it for breakfast yet. Oh, yeah. Aprons feel like overkill for making breakfast. It's just it's just a couple of weeks. I don't know. I wish Allison those were less expensive. Chris I don't know where do you even get we're in Canada on an island. Where do avocados come from? Are they shipped from Mexico? Off? Yeah, most of our Allison all the condos are from California or Mexico. You can't really grow avocados here unless it's in a greenhouse. Some people do it on. There's a woman who can do it on Saltspring Island, because we were trying to figure out whether we could grow avocados. Yeah, but we don't have a greenhouse yet. So yeah, let's see. Yeah. Well, with the promise of a I mean, avocados are $3 here. So like, I mean, Canadian. So work that out. Is it me? I Chris don't know what it means. Is that worse or better? I'm not even sure. Allison It's probably like Chris I think it's a little bit less than ours. Allison It's like a half like double. So Gary a buck and a half. Yeah. Yeah, I think you're I think that Chris wow, that's the conversion that's gone way down. Because I when I was looking at houses in Canada a couple years ago, it was like, maybe like 70 cents of the dollar or something. Something like that. So I just You can lose like say okay, this number and like a little bit less. Allison Well, I'd have to double check, but I generally just, I don't know. It works in my favor. If I'm making us But if I'm making Canadian, it's all same same. Gary I just assume that it's always $10 More in Canada, if I've learned anything from the back of books. Just the crisis us and in Canada's tech Allison wire books so expensive. No idea. I'm like, What are we doing wrong? Gary Price? Well, you would expect the price to be dropping since the books that are being removed from school libraries have to go somewhere. Allison Yeah. And you think we're going to Canada? Gary Wouldn't you? If you were a book in a library in Florida, I would go to Canada, just send them to Canada. Chris There's, there's a pattern that happens occasionally on Quora, I get my stupid Korra digest every day or whatever. And so I've seen this type of question before, where it's not really a question. It's like, I am leaving the country and moving to insert new country, because I don't like insert chief of state. Yeah, what do I need to know or something? And the answer is almost invariably. So it's the country is either Canada, but the most recent one that I saw was like New Zealand, or Australia? And the answer was, No, you're not. Yeah. Because because it was like, No, we actually, like, you need to like show that your value would be a valuable citizen that we would want before you can even get a visa to live here. Like you're not just moving. There is a Allison weird, I want to say American centric thing of just like, well, I can just move I can just go. But no, I'm like, oh, no, that's not the case with any other. Like, every other country is like, oh, I want to try to emigrate and do this. And you're like, Yeah, cuz there's steps Gary do you? Do you think that's why do you think that is? Is it just like, ignorance and just like, like, extended blue passport, I can go wherever I want. So Chris type of person that would write a question on a question and answer site like Cora, who would say, I'm upset about x person leaving the country I'm going to leave the country is not the type of person who is likely to have done the research involved in understanding what the complexity of immigrating into another country would be. Allison Yeah, cuz it's different than some someone like looking for some anecdotal like experience of being like, Hey, I've looked into this, I am thinking about doing this path, like, Gary oh, because I usually Chris looked at what immigrating to Canada would be like, Gary you're seeing the Venn diagram of the person asking this question on Quora, and the person that's bumped into International Living, is there's no intersection. Yeah. Okay. How's that for a poll? Feel feel pretty good about that today? Allison I also think that like, I don't know, I don't think we're I don't think we're taught a lot about history in the States, the same way that other countries are forced to learn about US history. Chris I mean, okay, so I there's a topic for that there is I think there is like, there's like the however, the Venn diagram of people who complain about, like, people immigrating across the southern border into the US. And the people who don't understand the actual steps involved in legally immigrating into a country is probably like, pretty, like, there's definitely a fair bit of overlap. And it looks almost like a circle. Yeah, I'm Gary saying, yeah. Okay, that's fair. Chris What I was gonna say is, because essentially, those are the people that they're basically asking that question and saying, I'm going to do this thing myself. For this other country. That isn't the US. Yes. Gary I went and saw Oppenheimer on Sunday. Oh, good. Yeah. Hey, today. Chris I have not seeing but Aaron's grandfather worked with Oppenheimer. And so I have one question about the movie. Is there a character in the movie who may or may not be named Lawrence Johnston, who worked on the detonator? Gary If Johnston was messaged, it was mentioned it was only in passing in a scene was not a primary character that I have memory of so okay, maybe, but Chris I don't think so. I was curious. I was just curious, because because he knew he knew him as oppy apparently. Gary And he's that nickname is used often in the movie by many people, for him. Chris And also like anybody who is asking who anybody who is doing research and like, even towards the end of his life, anybody who's doing research into like the bomb and how it was made, and like all the research and like all the research labs, all the science that worked on it, he was one of the last living scientists to work on stuff. So he became a source of a lot of that historical information. Allison The primary source Yeah. Transcribed by https://otter.ai