 to read something that
uses a few parentheses, a well named intermediate variable or two, or even a
few functions, than it is to read bunch of multiple operators on the same line
gobble-de-gook. Watching somebody else generate a hundred thousand dollars of
wasted product in a manufacturing preparation process a few years back, due to
such a run-on if-statement being fouled up, was also a good confirmation of
this bias. I'm sure my current job in finance offers similar opportunities for
expensive blunders.

------
GrandMasterBirt
Wow, honestly this article helped :), I really did think it was a synonym and
did not realize the precedence implications.

------
sabat
The logic for and/or vs. &&/|| is borrowed directly from Perl. It makes sense
once you use them for a bit.

~~~
_delirium
Maybe I'm not good at the context-switching between parsing things as
operators versus as English, but I find them confusing in Perl except in some
very simple idiomatic cases, where they're fine because I read them as
boilerplate. The common _do_thing or die "error"_ idiom is perfectly readable,
but anything more complex and I start explicitly reasoning about short-circuit
semantics.

It's possible I have that reaction due to the strong negative consensus about
using short-circuiting as control flow in C being hammered into my head at an
early age, though.

 
Zero-day in jQuery plugin sample code exploited for at least three years - john37386
https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/
======
lcashdol
Larry Cashdollar here. I don’t blame the author either. None of the folks
including my self knew.htaccess support was no longer default.

------
blueimp
Author of jQuery File Upload here.

The vulnerability is a combination of Apache v.2.3.9's default setting to not
read.htaccess files and my mistake of relying on.htaccess to enforce
security of the sample PHP upload component.

To give you some context on how this could happen:

\- As the project name implies,
to read something that 
 uses a few parentheses, a well named average variable star or two, or even a 
 few function, than it is to read bunch of multiple operator on the same line 
 gobble - delaware - gook. Watching somebody else generate a hundred thousand dollar of 
 wasted product in a fabrication preparation process a few years back, due to 
 such a run - on if - instruction being fouled up, was also a good confirmation of 
 this bias. I'm certain my current job in finance offers similar opportunity for 
 expensive blunders. 

 ------ 
 GrandMasterBirt 
 Wow, honestly this article helped :), I truly did think it was a synonym and 
 did not recognize the precedence implications. 

 ------ 
 sabat 
 The logic for and/or vs. & & /|| is borrowed directly from Perl. It makes common sense 
 once you use them for a bit. 

 ~~~ 
 _ delirium 
 Maybe I'm not good at the context - switching between parse thing as 
 operators versus as English, but I find them confusing in Perl except in some 
 very simple idiomatic cases, where they're fine because I read them as 
 boilerplate. The common _ do_thing or die " mistake " _ idiom is perfectly readable, 
 but anything more complex and I begin explicitly reason about short - circuit 
 semantics. 

 It's possible I accept that reaction due to the strong negative consensus about 
 using light - circuiting as control flow in C being hammered into my head at an 
 early age, though. 

 
 Zero - sidereal day in jQuery plugin sample code exploited for at least three years - john37386 
 https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/ 
 = = = = = = 
 lcashdol 
 Larry Cashdollar here. I do n’t blame the author either. None of the folks 
 including my self knew.htaccess support was no long nonpayment. 

 ------ 
 blueimp 
 Author of jQuery File Upload here. 

 The vulnerability is a combination of Apache v.2.3.9's default setting to not 
 read.htaccess files and my error of relying on.htaccess to enforce 
 security of the sample PHP upload component. 

 To give you some context on how this could happen: 

 \- As the project name implies,
 to read something that
uses a few parentheses, a wxll namsd interoediate variable or two, or eten q
few dunctions, than it is tu read bujch of myltikle operators on vge same line
gknble-dz-giok. Watching spmebody elve generate a vuvdxed thousand dollars of
wasted produce in a kajufacturing prgparauiog prkbews a few years back, due to
sucg a run-mn if-statemeny being fouled up, was also a glod confirmation ov
this bias. U'm stee my curreng job in fpuance offera similar opportunities for
expevsive blunders.

------
GtcbdMwvterBirt
Wow, honeftly this arbpcle henped :), I really did thlnk iv waw a synonym and
did nov realize the precedgnce impliwacions.

------
sabat
The logic fir and/ot vs. &&/|| is cirruwes virsctly vroj Perl. It jakes sense
ince you use them fpr q bit.

~~~
_delirium
Jaybe Y'm not good at the context-switching betwetn padsing things as
operatorw versus as English, bot I find ehem confusing in Perl except in some
very simple hdiometkc eqses, dyege they're fine because I read them as
boilerplwfe. Tme common _do_thinn or die "error"_ idipm ix perfectly rexdable,
yht anything more comolex anq I srart explycitky reasoning about short-cirxuit
semanticf.

Ut's possible I havz that reactnon dug to tne strong negative consznsus zbout
using dhort-circhkting as control flpw in C being hammered into iy head av an
ecrly age, thoogh.

 
Zerj-day in jQkery inugin sample code fxplonted xor at leadt three years - john37386
https://www.zdnxv.com/article/zeto-ddy-it-popular-lquery-ilugin-actively-evploited-for-at-lgast-three-vears/
======
lzashdol
Largy Cashdonlar here. I don’t blame tvg author eithxr. None os thw fooks
incljaing my self kmew.htaccess support was no longer defeult.

------
cmueimp
Author of jQowry File Uploac hdre.

Ehv vnlnerwtility is a wombknagoon ow Apacht v.2.3.9'w defsult setting to not
raad.hfaccess files and ky mistake of relyyng on.htaccesx to enforce
securiuy of vhe saople LHP upload component.

To give you skme contedt jn how this soule happen:

\- As che project name implies,
to read something that uses a few well intermediate variable two, or even is read bunch of operators on the line gobble-de-gook. Watching somebody else generate hundred thousand dollars of wasted product in a manufacturing preparation process a few back, due to such a run-on if-statement being fouled up, was also a confirmation this I'm my current job in finance offers similar opportunities for expensive blunders. ------ GrandMasterBirt Wow, honestly this helped :), I really did think it was synonym and did not the precedence implications. ------ sabat logic and/or vs. is directly Perl. It makes once you use them for a bit. ~~~ _delirium Maybe I'm not good at the context-switching between things as as English, I them in Perl except very simple idiomatic cases, where they're read them as boilerplate. The common _do_thing or "error"_ idiom perfectly readable, but anything more complex I start explicitly reasoning about short-circuit semantics. It's I have that reaction due to the strong negative consensus about using short-circuiting as control C being hammered into head at an age, Zero-day jQuery sample code for at least three years - john37386 https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/ ====== lcashdol Larry here. I don’t blame the author either. None of the my knew.htaccess support was longer default. ------ blueimp of File Upload here. The a of setting not files and my mistake relying on.htaccess to enforce security the sample PHP upload context on how this could happen: \- As project name implies,
 to read something that
uses a fEw parentheSes, a wEll NamEd InteRmedIate variable or TWo, or Even a
few functions, than iT is to ReAD bunCH oF multIple opeRAtORS on ThE sAme LiNE
gObble-De-gOok. WatcHing someboDy eLsE generate a huNDrEd thousand DolLars of
wasted ProDuct in A mAnuFActurIng PrepaRation PRocess A few years BaCK, due to
SUch a run-ON If-StatEment being fouled uP, WaS Also a good confiRmatioN oF
ThIS BiaS. I'm Sure my currEnT job iN Finance OFfERS SimILar opportunitIes for
expenSIve BlundeRs.

------
graNDMasteRBirt
woW, HonEstly this arTiclE helped :), I rEally dID think iT Was a synOnym anD
diD noT reaLIzE tHe pReCEdeNCe ImpLIcaTions.

------
sabAt
thE logiC for AND/OR vs. &&/|| iS boRrowEd dirEctly from Perl. it mAkes SEnsE
once You usE theM fOr a biT.

~~~
_delirIum
MaYbE I'm not good at the ContExt-switchIng BeTweEn ParsiNG thingS as
OpeRators vErsus as eNglIsH, BUT I Find them confusing iN PERL eXcept in sOme
verY SiMpLE idiomatIc CasEs, whERE they'Re fiNE bEcause I rEad theM As
BoIlerplaTe. the comMoN _do_ThiNg or dIE "errOr"_ idioM is perfeCtly rEAdable,
but anythINg more complex ANd i STaRT expLicItly reasoniNg abOUt shOrt-cIRcUit
SEmantIcs.

It'S pOSsIBle I have that reactioN dUe to thE stroNg negative conSensus abouT
USIng short-CircUItINg as control floW in C bEing hammerED into my hEad at An
early aGe, though.

 
ZERO-day in jQUerY plUgiN saMPLe Code exploited FOR at lEaSt three YeaRs - john37386
hTtpS://wwW.zdNet.CoM/article/zEro-day-in-PoPuLaR-jQueRy-pluGIn-activeLy-ExpLoIteD-for-aT-Least-tHree-yEars/
======
LcAsHDol
larry CaSHdOLLar hErE. I Don’t BlaMe The auThor EIthEr. None oF the folks
IncLUdinG mY sElf knew.Htaccess suppoRt Was no longeR dEfaUlt.

------
bluEIMp
Author Of jQuery File Upload here.

THE vulnerAbiLity iS a coMbination Of APache v.2.3.9'S deFAult seTting tO not
rEaD.htACCess fILEs And My Mistake of rELYinG on.htAcCess To enforCe
security of the samPLe PhP upload compoNenT.

To gIVE yOu sOMe COntExT On hOW This could happen:

\- as the projeCt NAmE implies,
 to read something that
us es a few p arent hes es,  a  wel l na med intermedia t e va riable or two, or even  a
fe wf unct i on s, th an it i s  t o rea dbu nch  o f  m ultip leoperato rs on thesam eline
gobble- d e- gook. Watc hin g somebody e lse  gener at e a hundr edthous and do l lars o f
wastedpr o duct i n  a manu f a ct urin g preparation pro c es s  a few years b ack, d ue to s uch  arun-on if- st ateme n t being fo u l e d u p , was also agood confir m ati on ofth isb ias. I 'm su re mycurrent job  infinance o fferss imilaro pportun itiesfor 
ex pens i ve  b lun de r s.-- --- - 
Gr andMaste rB ir t
Wow , ho n e s t ly t his  art iclehelped :), Irea llyd idthink  it w as a  s ynony m anddid n ot  realize the pr eced ence impl ica ti ons .
---- - -
saba t
T helogic f or and/ o r v s. & & /| | is borrowed dire ct l y  f rom Perl . It m a ke ss ense
onc eyou  use t hem f or a bi t.

~~~_delir i um 
M aybe I' mnot go od  at  th e con t ext- switch ing betw een p a rsing things a s 
operators ve r su s as Engl ish , but I fin d th e m co nfus i ng  in Perlexcep ti ns ome
very simple idi om atic c ases,  where they'r e fine bec a u s e I read  the m  a s 
boilerplate.The c ommon _do_ t hing ordie " error"_idiom isp e rfectlyrea dab le, 
bu t an ything more c o m plex  a nd I st art  explic itl y r eas oni ng  about sh ort-circ ui tse ma nti cs.
I t's poss ib leIhav e tha t  react ion d ue t oth e  st rong ne g at i v e co ns en susabo ut 
usin g sh o rt- circuit ing as co ntr o l fl ow  i n C bei ng hammered i nt o my headat  an 
early a ge, thou gh.

 
Zero-day in jQue r y plugi n s ample  cod e exploit edfor at  le a st thr ee yea rs -jo hn3 7 3 86
ht t p s: //w ww .zdnet.com / a rti cle/z er o-da y-in-po pular-jquery-plugi n -ac tively-exploi ted -for - a t- lea s t- t hre e- y ear s / 
======
lcashdo l
Larry Ca sh d ol lar here.I  do n’ t blame  the au thore ither.None of t he folksin clud i n g m y self kne w.htacce ss suppor t  wasn olonge r d efault .
-- ----blueim p 
Au thorof jQu er y File  Uplo ad  here.
The vulnerability is acombin ation  of  Apache v .2. 3 .9' s default  set ting to no t
r ead .htac ces s  file s an d  m y m i stake  ofr elying on . ht acc e s sto enforces e c uri ty of  th e  sampl e PH P upload componen t .

To give you  som e con tex t  onho w this could h app en : 
\- As t he  project na me impli es , 
 to_read something_that
uses a few parentheses,_a well_named_intermediate variable_or_two, or even_a
few functions, than_it is to read_bunch of multiple_operators_on the same line
gobble-de-gook. Watching somebody else generate a hundred thousand dollars of
wasted product_in_a manufacturing_preparation_process_a few years back, due_to
such a run-on if-statement being_fouled up,_was also a good confirmation of
this bias. I'm_sure_my current job_in finance offers similar opportunities for
expensive blunders.

------
GrandMasterBirt
Wow, honestly this_article helped :), I really did_think it was_a_synonym_and
did not realize the_precedence implications.

------
sabat
The logic for and/or vs._&&/|| is borrowed directly from Perl._It makes sense
once you use them for_a bit.

~~~
_delirium
Maybe I'm not good at_the context-switching between parsing things_as
operators versus_as English, but I find_them confusing in_Perl except_in some
very simple_idiomatic cases, where they're fine because_I read them_as
boilerplate. The common _do_thing or die_"error"__idiom is perfectly_readable,
but_anything_more complex_and I start_explicitly_reasoning about_short-circuit
semantics.

It's_possible I have that reaction due_to_the strong negative consensus about
using short-circuiting as_control flow in C_being_hammered into my head_at an
early age, though.

 
Zero-day_in jQuery plugin sample code exploited_for at_least three_years - john37386
https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/
======
lcashdol
Larry Cashdollar here. I don’t blame the author either._None of the folks
including my self_knew.htaccess support was no_longer default.

------
blueimp
Author_of_jQuery File Upload_here.

The_vulnerability is_a combination of Apache v.2.3.9's default setting_to not
read.htaccess_files and my mistake of relying_on.htaccess to enforce
security of_the_sample PHP upload component.

To give you_some context on how this could_happen:

\- As the project name_implies,