I think the gimmick makes this worse than if these were presented more traditionally. I think it also encouraged the inclusion of some extremely dubious entries, many of which do not demonstrate a particularly fluent understanding of the language semantics.
Is the implication that these are design mistakes, hidden but necessary knowledge, unavoidable complexities? It's not particularly clear how the entries were selected. (For example, it's surprising that PEP-578 audit hooks are represented more than once—they're a fairly niche feature, and I believe I may have worked on one of the only large-scale attempts to deploy these in a codebase—in fact, the one that motivated the PEP in the first place.)
Some of the entries (e.g., “Assertions disappear with -O”) are documented, expected, desired behaviour, so I suspect that these are intended to represent knowledge one must have to be effective, but the presentation does not encourage us to contextualise that knowledge into any system of meaning (e.g., that assertions are a programmatic documentation mechanism) or connect that knowledge to anything (e.g., that the compiler can perform dead-code elimination on statically-knowable unreachable branches like if __debug__; thus, assert can be used together with if __debug__ to support in-depth programmatic documentation approaches.)
The order in which these are presented should also be revisited. Why are obvious details of the subprocess module (e.g., the behaviour of shell=True) so deep? I'm led to believe that these items were selected without much (human?) thought…
It could be that we need to do a better job documenting what assert is for. It should be for assertions that you know must be true based on the structure of your code. External data should never be a part of an assertion.
I'm not sure the documentation can fix that one, or specifically that class of issues. Asserts exist in other languages and also have a meaning when discussing programming detached from any implementation. There's always going to be someone assuming assert behaviour the same way they assume what + does on two ints without looking into docs.
(To be clear, I'm not saying this should be changed, just that overloaded word meanings are guaranteed to trip up a few people)
I think the gimmick makes this worse than if these were presented more traditionally.
There is some usefulness/usability vs fun trade off, and I picked fun. Did you view it on mobile or desktop and face any particular issues from the presentation?
Is the implication that these are design mistakes, hidden but necessary knowledge, unavoidable complexities?
No implications are made. As for necessity, I think the above the waterline stuff is hard for a python dev to avoid encountering, but below things get obscure and lots of python devs are effective without knowing most of them.
documented, expected, desired behaviour
Correct. All of these are known things, and most of them link back to official documentation.
The order in which these are presented should also be revisited. Why are obvious details of the subprocess module (e.g., the behaviour of shell=True) so deep? I'm led to believe that these items were selected without much (human?) thought…
The shell=True also bothered me, but not enough to investigate until you mentioned it.
I had gpt-5.6-sol, claude-opus-5, and gemini-3.8-flash rank candidate items on obscurity and cursedness. Their scores were averaged and items were bucketed into deciles by obscurity, and top 10 most cursed items from each bucket were selected. Least obscure items are above the waterline and most obscure got placed down in the abyss.
The interesting about the shell=True command injection is that claude-opus-5 and gemini-3.8-flash gave it an obscurity of 2.2 and 2.5 and sol gave it an obscurity of 6.1! Overall, the models judged items with security implications as more cursed, which while is expected and fair, I don't think is what people want to see. Combined these two issues made shell=True more cursed and lower on the iceberg than it should have been.
Thank you for the detailed response! A lot to consider.
… shell=True … and … gave … obscurity of 2.2 and 2.5 and … gave … obscurity of 6.1!
Overall, the models judged items with security implications as more cursed, which while is expected and fair, I don't think is what people want to see.
It is almost as though these numbers (and—as one might suggest—the judgment of the model) mean nothing at all…
I kinda like this "iceberg" format and there'a good stuff here, but I kinda wish it didn't rotate and occlude stuff on the other side. As is, there's no practical way for me to read them all or look for a specific thing.
I went into this wondering where you put logging/multiprocess deadlocks, and i'm not sure if I missed it or you didn't rank it.
I don’t want to be rude to OP, but this link is an object lesson in “less is more.” There are too many entries. The 3D makes it worse to view. Including explanations weakens the iceberg meme format, since the deeper entries typically serve as little puzzles/mysteries even to people who know the topic very well.
If this were a regular iceberg meme photo, it would have been more fun for the viewer but less fun for the maker. So it’s self-indulgent. Often people think that communication that’s more fun to make is more fun to consume, and I see this as an example of that confusion.
Firefox on Windows. Also Chrome on Windows. Usually it's web browsers with inlaid scrollbars that do this, and browsers with floating scrollbars don't show the problem. It's usually using horizontal viewport units that causes it.
In your case, the problem is the <div class="full-bleed"> which is using vw units in its width and margin styles. Viewport units are sized as if the scrollbars don't exist, i.e. a 100vw width element will go under the scrollbar. Usually you want to use percentage-based sizing like 100% which will take the scrollbar existing / not existing into account.
You can also use contain: layout to combat this. Or maybe something with container queries and container query lengths.
After I realized it's not just a gimmick, but a really good library of footguns, my next thought was, "wouldn't it be nice to have it as a text". And then I thought, "but of course the page should have it somewhere in the source". And after a little digging I found it:
dutc | a day ago
I think the gimmick makes this worse than if these were presented more traditionally. I think it also encouraged the inclusion of some extremely dubious entries, many of which do not demonstrate a particularly fluent understanding of the language semantics.
Is the implication that these are design mistakes, hidden but necessary knowledge, unavoidable complexities? It's not particularly clear how the entries were selected. (For example, it's surprising that PEP-578 audit hooks are represented more than once—they're a fairly niche feature, and I believe I may have worked on one of the only large-scale attempts to deploy these in a codebase—in fact, the one that motivated the PEP in the first place.)
Some of the entries (e.g., “Assertions disappear with
-O”) are documented, expected, desired behaviour, so I suspect that these are intended to represent knowledge one must have to be effective, but the presentation does not encourage us to contextualise that knowledge into any system of meaning (e.g., that assertions are a programmatic documentation mechanism) or connect that knowledge to anything (e.g., that the compiler can perform dead-code elimination on statically-knowable unreachable branches likeif __debug__; thus,assertcan be used together withif __debug__to support in-depth programmatic documentation approaches.)The order in which these are presented should also be revisited. Why are obvious details of the
subprocessmodule (e.g., the behaviour ofshell=True) so deep? I'm led to believe that these items were selected without much (human?) thought…retr0id | a day ago
This one absolutely took me by surprise when I first learnt it. I had before that point performed security-relevant checks via asserts.
nedbat | 21 hours ago
It could be that we need to do a better job documenting what assert is for. It should be for assertions that you know must be true based on the structure of your code. External data should never be a part of an assertion.
viraptor | 19 hours ago
I'm not sure the documentation can fix that one, or specifically that class of issues. Asserts exist in other languages and also have a meaning when discussing programming detached from any implementation. There's always going to be someone assuming assert behaviour the same way they assume what + does on two ints without looking into docs.
(To be clear, I'm not saying this should be changed, just that overloaded word meanings are guaranteed to trip up a few people)
majaha | 16 hours ago
I bang on about this a lot
[OP] aleyan | a day ago
There is some usefulness/usability vs fun trade off, and I picked fun. Did you view it on mobile or desktop and face any particular issues from the presentation?
No implications are made. As for necessity, I think the above the waterline stuff is hard for a python dev to avoid encountering, but below things get obscure and lots of python devs are effective without knowing most of them.
Correct. All of these are known things, and most of them link back to official documentation.
The
shell=Truealso bothered me, but not enough to investigate until you mentioned it.I had gpt-5.6-sol, claude-opus-5, and gemini-3.8-flash rank candidate items on obscurity and cursedness. Their scores were averaged and items were bucketed into deciles by obscurity, and top 10 most cursed items from each bucket were selected. Least obscure items are above the waterline and most obscure got placed down in the abyss.
The interesting about the shell=True command injection is that claude-opus-5 and gemini-3.8-flash gave it an obscurity of 2.2 and 2.5 and sol gave it an obscurity of 6.1! Overall, the models judged items with security implications as more cursed, which while is expected and fair, I don't think is what people want to see. Combined these two issues made
shell=Truemore cursed and lower on the iceberg than it should have been.Thank you for the detailed response! A lot to consider.
dutc | 14 hours ago
It is almost as though these numbers (and—as one might suggest—the judgment of the model) mean nothing at all…
besttof | 2 hours ago
I think the gimmick is even worse because it perpetuates a common misconception about the shape of icebergs ;)
retr0id | a day ago
Fun CPython fact: memory safety bugs reachable from pure python code are not considered security bugs by default.
nedbat | a day ago
Do you have an example of the kind of bug you are talking about?
tclancy | a day ago
Well sure, but other than that, how was the play, Mrs. Van Rossum?
landon | a day ago
I kinda like this "iceberg" format and there'a good stuff here, but I kinda wish it didn't rotate and occlude stuff on the other side. As is, there's no practical way for me to read them all or look for a specific thing.
I went into this wondering where you put logging/multiprocess deadlocks, and i'm not sure if I missed it or you didn't rank it.
markos | 23 hours ago
You can rotate the iceberg yourself.
landon | 15 hours ago
I know. That doesn't solve the issue?
abeyer | a day ago
Is "iceberg" the new listicle?
wmurra | 16 hours ago
I don’t want to be rude to OP, but this link is an object lesson in “less is more.” There are too many entries. The 3D makes it worse to view. Including explanations weakens the iceberg meme format, since the deeper entries typically serve as little puzzles/mysteries even to people who know the topic very well.
If this were a regular iceberg meme photo, it would have been more fun for the viewer but less fun for the maker. So it’s self-indulgent. Often people think that communication that’s more fun to make is more fun to consume, and I see this as an example of that confusion.
majaha | 16 hours ago
Urgh, whatever design point makes every other web page have that tiny bit of horizontal scroll is the bane of the whole web.
[OP] aleyan | 15 hours ago
What device/browser do you have a tiny horizontal scroll bar on? It shouldn't be there and I would be happy to fix it.
spc476 | 14 hours ago
For me, it was Firefox 154 on a Linux desktop system. Also, I couldn't scroll down, presumably because my mouse lacks a scroll wheel.
Edit to add: Oh, it does scroll, but I have to continuously hit the down arrow/page down key to get it to scroll slowly down.
majaha | 13 hours ago
Firefox on Windows. Also Chrome on Windows. Usually it's web browsers with inlaid scrollbars that do this, and browsers with floating scrollbars don't show the problem. It's usually using horizontal viewport units that causes it.
majaha | 13 hours ago
In your case, the problem is the <div class="full-bleed"> which is using vw units in its width and margin styles. Viewport units are sized as if the scrollbars don't exist, i.e. a 100vw width element will go under the scrollbar. Usually you want to use percentage-based sizing like 100% which will take the scrollbar existing / not existing into account.
You can also use
contain: layoutto combat this. Or maybe something with container queries and container query lengths.https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Values/length#relative_length_units_based_on_viewport
isagalaev | 15 hours ago
After I realized it's not just a gimmick, but a really good library of footguns, my next thought was, "wouldn't it be nice to have it as a text". And then I thought, "but of course the page should have it somewhere in the source". And after a little digging I found it:
https://pastebin.com/g2KgTnd9
coleifer | 17 hours ago
2vs3 should be somewhere in the Abyss. Fuck those early 3s were brutal.