erkl

I think you're operating with a different definition of 100%.

QUIC operates on top of UDP, which would make it layer 5.

I agree, but in this case we're not talking about reasonable false positives (e.g. toast burning or candles being blown out). I wouldn't put up with a £10 smoke detector waking me up in the middle of the night for no discernible reason, much less one I paid £89 + shipping for.

First off, thanks for the reply.

I have to say it feels a bit weird to deduct points (so to speak) from a highly regarded cryptographic hash function because it doesn't outright prevent one particular, broken MAC generation scheme, but I guess the argument has some merit.

While I think it's harmless to say that SHA-512/256 is stronger than SHA-256 (as they otherwise provide the same theoretical level of security), I still think it's wrong to claim that SHA-512/256 is also stronger than SHA-512, which has a vastly greater theoretical security margin.

Just use a MAC algorithm that isn't terrible.

Unless you know something about SHA-512 that I don't, calling it less secure than SHA-512/256 seems like a mistake.

Now, I'm not sure this is useful at all, but I think it would make sense for the value of an if-expression to be Option<T>.

> An unknown address family will return a '0'.

In this particular case, returning 0 doesn't necessarily indicate failure. Binding a socket to port 0 means you're asking the operating system to pick an available port for you, which one might argue is a reasonably safe default for unknown address families.

This throws an error:

    typeof x; // throws an error
    let x = 1;

This doesn't:

    typeof x; // returns "undefined"
    var x = 1;

While using variables before declaring them is bad practice, I think it's fair to argue that this behaviour is inconsistent.

If a publicly distributed first-hand account by the person in question isn't "solid proof," what exactly are you looking for? What reason do you have to think she's being anything less than truthful?

Packages in the Go standard library are no different from user packages – they're just included in the Go distribution. If you find the need to modify anything in net/http (to fix a bug, add low-level hooks, etc), just copy it into a subfolder in your project, like so:

> cp -R $GOROOT/src/pkg/net/http ./net/http

Then simply change all "net/http" imports to "./net/http". Now you're free to carry out any changes you'd like.

P.S: Just because you can do this doesn't mean you should.

I would definitely be interested in this.