Cursed knowledge

2026/07/29

Nick pointed me towards Marcin who pointed me towards immich's list of cursed knowledge the other day, and it has already become a running joke in the Slack.

Here is a baker's dozen of Buttondown's own cursed knowledge: 1Yes, that's the joke.

---

1. The Python ua-parser library assigns the device family "Other" to every non-Mac desktop browser

2. The HTML accept attribute only filters what the file-picker dialog shows you; drag-and-drop and clipboard paste bypass it entirely.

3. Safari and Chrome re-serialize quoted CSS custom-property strings differently when you read them back via getComputedStyle: Chrome keeps the single quotes, WebKit rewrites them to double quotes.

4. Django emits a CacheKeyWarning — which fails our CI — for any cache key over 250 bytes or containing a space or control character.

5. Python's requests has no default timeout and will, given the opportunity, wait forever.

6. SPF include: directives recursively chain DNS lookups against a hard cap of ten — exceed it and you get a permerror, which can fail authentication for all of your mail.

7. Outlook and Hotmail enforce mandatory TLS but serve a certificate chain rooting at DigiCert Global Root CA (G1) — a root that Ubuntu has since removed from its trust store.

8. Django's JSONField data__key__isnull=True tests whether the key exists, not whether its value is JSON null.

9. UPDATE ... WHERE id IN (...) does not lock rows in the order you listed them — Postgres locks them in executor scan order, which is a wonderful way to deadlock two queries that both thought they were being careful.

10. A postgres tsvector cannot exceed ~1MB.

11. Stripe will send subscription update events for paused subscriptions.