---
title: Cursed knowledge
date: 2026-07-29
tags: post
---

Nick pointed me towards Marcin who pointed me towards [immich's list of _cursed knowledge_](https://immich.app/cursed-knowledge/) the other day, and it has already become a running joke in the Slack.

Here is a baker's dozen of Buttondown's own cursed knowledge: [^1]

---

1. The Python `ua-parser` library assigns the device family `"Other"` to _every_ non-Mac desktop browser

2. The HTML `accept` attribute only filters what the file-picker dialog _shows_ you; drag-and-drop and clipboard paste bypass it entirely.

3. Safari and Chrome re-serialize quoted CSS custom-property strings differently when you read them back via `getComputedStyle`: Chrome keeps the single quotes, WebKit rewrites them to double quotes. 

4. Django emits a `CacheKeyWarning` — which fails our CI — for any cache key over 250 bytes or containing a space or control character.

5. Python's `requests` has no default timeout and will, given the opportunity, wait forever.

6. SPF `include:` directives recursively chain DNS lookups against a hard cap of ten — exceed it and you get a `permerror`, which can fail authentication for _all_ of your mail.

7. Outlook and Hotmail enforce mandatory TLS but serve a certificate chain rooting at DigiCert Global Root CA (G1) — a root that Ubuntu has since removed from its trust store.

8. Django's `JSONField` `data__key__isnull=True` tests whether the _key exists_, not whether its value is JSON `null`.

9. `UPDATE ... WHERE id IN (...)` does _not_ lock rows in the order you listed them — Postgres locks them in executor scan order, which is a wonderful way to deadlock two queries that both thought they were being careful.

10. A postgres `tsvector` cannot exceed ~1MB.

11. Stripe will send subscription update events for paused subscriptions.

[^1]: Yes, that's the joke.