---
title: "erroneo.us"
url: https://erroneo.us/
description: "A researched reference to common errors: confused words, grammar mistakes, HTTP status codes, JavaScript and Python errors, cognitive biases and popular myths."
type: home
section: "erroneo.us"
date_modified: 2026-11-05
publisher: erroneo.us
license: All rights reserved. Quote with attribution and a link.
---

# erroneo.us

> A researched, source-linked reference to the mistakes people make most often — in writing, in code, in reasoning, and in what “everybody knows.” Each page shows the wrong version, the right version, and the evidence.

Latest in security · Thursday, November 5, 2026

[Security Digest](https://erroneo.us/security/) · [RSS](https://erroneo.us/security/feed.xml) · [JSON](https://erroneo.us/api/security/today.json)

Patch this week Nov 4, 2026 · CVE-2026-109518 · No known exploitation

## [APT CVE-2026-109518: Package Swap to Root on Debian/Ubuntu](https://erroneo.us/security/briefs/apt-hardlink-retry-package-swap-cve-2026-109518/)

Nobody is known to be exploiting it and the attacker must sit between you and your mirror, but APT is the trust root for every Debian and Ubuntu machine and image you build, so update apt itself this week and rebuild base images.

**Must act:** Anyone running Debian 12 or later, Ubuntu 22.04 LTS or later, or a derivative, especially CI runners, Docker builds and fleets that fetch packages over plain http:// or through shared mirrors and caching proxies.

**Can relax:** Systems on Debian 11 or Ubuntu 20.04 and older that never set Acquire::Retries, and hosts that only install packages from a local, trusted, HTTPS-served mirror, can schedule the update normally.

First steps

1. Update apt itself first: sudo apt-get update && sudo apt-get install --only-upgrade apt, then confirm the version with apt-cache policy apt.
2. Rebuild Docker base images and CI runner images so they ship the fixed apt; do not rely on the next routine rebuild.
3. Until a host is patched, install packages only from HTTPS sources or a mirror you control, and avoid untrusted networks and shared proxies.

[Full brief & sources →](https://erroneo.us/security/briefs/apt-hardlink-retry-package-swap-cve-2026-109518/)

Check exposure Nov 4, 2026 · No known exploitation

## [Rails Active Storage: Upload-to-File-Write via ImageMagick](https://erroneo.us/security/briefs/rails-active-storage-imagemagick-file-write-ghsa-f3w6/)

Only apps that run Active Storage through ImageMagick (:mini_magick) and accept untrusted uploads are exposed, but for them an unauthenticated upload can write files and, with the Disk service, read secret_key_base, so those apps should upgrade today.

**Must act:** Rails apps that accept uploads from untrusted users and use config.active_storage.variant_processor = :mini_magick (the default under load_defaults 6.1 or earlier) on hosts whose ImageMagick policy does not block MSL and Ghostscript coders, including stock Debian and Ubuntu.

**Can relax:** Apps on the :vips processor (the default from load_defaults 7.0), apps that do not use Active Storage, and apps that only accept uploads from trusted staff should still take the release but need not rush.

First steps

1. Check your processor: bin/rails runner 'p Rails.application.config.active_storage.variant_processor'.
2. If it is :mini_magick and users can upload files, upgrade to Rails 8.1.4.1 or 8.0.5.2 and bundle update mini_magick to 5.1 or later.
3. If you cannot upgrade (or are on Rails 7.x or older), copy the shipped policy rules into /etc/ImageMagick-7/policy.xml (or ImageMagick-6) and at minimum deny the MSL coder, Ghostscript coders and the gs delegate.

[Full brief & sources →](https://erroneo.us/security/briefs/rails-active-storage-imagemagick-file-write-ghsa-f3w6/)

[**1** new known-exploited (KEV) · **0** critical advisories on Nov 4, 2026 — open the digest →](https://erroneo.us/security/2026-11-04/)

Error of the Day · Thursday, November 5, 2026

## Today’s error: [Buy now, pay later is "free" until the fourth payment](https://erroneo.us/daily/buy-now-pay-later-mistakes/)

Pay-in-four loans really can cost nothing. The CFPB's research shows where they stop being free: late fees, several loans running at once, and protections thinner than a credit card's. Read this before holiday shopping starts.

From the [Money](https://erroneo.us/myths/money-mistakes/) desk · [All errors of the day](https://erroneo.us/daily/) · [RSS](https://erroneo.us/feed.xml)

[Read today’s error →](https://erroneo.us/daily/buy-now-pay-later-mistakes/)

Earlier this week

1. Nov 4 Thinking[Confirmation bias: checking only the answers you hope are right](https://erroneo.us/daily/confirmation-bias/) Confirmation bias is seeking and reading evidence in ways that favor what you already believe. The fix: ask what would prove you wrong, then go look.
2. Nov 3 Developers[The Year 2038 problem: when 32 bits of seconds run out](https://erroneo.us/daily/year-2038-problem/) A signed 32-bit time_t overflows at 03:14:07 UTC on Jan. 19, 2038 and wraps to 1901. 64-bit systems are mostly fine; old formats and devices aren't.
3. Nov 2 Language[Who vs. whom: one test, one firm rule, and permission to relax](https://erroneo.us/daily/who-vs-whom/) Use who for subjects (he) and whom for objects (him). Always whom right after a preposition. In casual speech, who is fine. Never use whom to sound fancy.

## Play with your errors

Five interactive tools, built on the same cited guides. Free, no sign-up, nothing leaves your browser.

- [Spot the Error Timed rounds of sentences with one mistake. Tap the wrong word before the red pen does.](https://erroneo.us/spot-the-error/)
- [HTTP Status Code Explorer Every registered code, searchable by number, class or keyword, with what to do next.](https://erroneo.us/developers/http-status-codes/#status-code-explorer)
- [Bias or Fallacy? Everyday scenarios. Name the cognitive bias or logical fallacy hiding inside.](https://erroneo.us/bias-or-fallacy-quiz/)
- [Error Message Decoder Paste a JavaScript or Python error. Get the plain-English meaning and the fix.](https://erroneo.us/error-decoder/)
- [Myth or Fact? Swipe through popular claims. Every verdict is backed by a cited source.](https://erroneo.us/myths/#myth-or-fact)

## The guides

Four clusters, 21 guides, every claim linked to a source.

### [Language](https://erroneo.us/language/)

Confused words, grammar slips, misspellings, mispronunciations and mangled idioms.

- [Commonly confused words](https://erroneo.us/language/commonly-confused-words/)
- [Common grammar mistakes](https://erroneo.us/language/common-grammar-mistakes/)
- [Commonly misspelled words](https://erroneo.us/language/commonly-misspelled-words/)
- [Commonly mispronounced words](https://erroneo.us/language/commonly-mispronounced-words/)
- [Misused idioms and phrases](https://erroneo.us/language/misused-idioms-and-phrases/)

[All language guides →](https://erroneo.us/language/)

### [Developers](https://erroneo.us/developers/)

HTTP status codes, JavaScript and Python errors decoded, and the bugs that made history.

- [HTTP status codes, explained properly](https://erroneo.us/developers/http-status-codes/)
- [401 Unauthorized vs 403 Forbidden](https://erroneo.us/developers/http-401-vs-403/)
- [404 Not Found](https://erroneo.us/developers/http-404-not-found/)
- [429 Too Many Requests](https://erroneo.us/developers/http-429-too-many-requests/)
- [500 Internal Server Error](https://erroneo.us/developers/http-500-internal-server-error/)
- [502 Bad Gateway vs 504 Gateway Timeout (and 503)](https://erroneo.us/developers/http-502-vs-504/)
- [418 I'm a teapot](https://erroneo.us/developers/http-418-im-a-teapot/)
- [Common JavaScript errors, explained](https://erroneo.us/developers/javascript-errors/)
- [Common Python errors, explained](https://erroneo.us/developers/python-errors/)
- [Famous software bugs in history](https://erroneo.us/developers/famous-software-bugs/)

[All developers guides →](https://erroneo.us/developers/)

### [Thinking](https://erroneo.us/thinking/)

Cognitive biases and logical fallacies: the errors we make before we say a word.

- [Cognitive biases: the predictable ways good minds go wrong](https://erroneo.us/thinking/cognitive-biases/)
- [Logical fallacies: how arguments break, with examples](https://erroneo.us/thinking/logical-fallacies/)

[All thinking guides →](https://erroneo.us/thinking/)

### [Myths](https://erroneo.us/myths/)

Science, history, nutrition and money misconceptions, checked against primary sources.

- [Science myths that refuse to die](https://erroneo.us/myths/science-myths/)
- [History myths: what really happened](https://erroneo.us/myths/history-myths/)
- [Nutrition myths: what the evidence actually says](https://erroneo.us/myths/nutrition-myths/)
- [Money mistakes and personal-finance myths](https://erroneo.us/myths/money-mistakes/)

[All myths guides →](https://erroneo.us/myths/)

## Most looked-up

- [Language Commonly confused words Affect or effect? Then or than? A skimmable table of 45 commonly confused English words with meanings, examples and memory tricks that actually stick.](https://erroneo.us/language/commonly-confused-words/)
- [Developers HTTP status codes, explained properly Every HTTP status code from 100 to 511 in plain English: what each means per RFC 9110, the usual cause, and the common mistakes with 401, 404, 429 and 5xx.](https://erroneo.us/developers/http-status-codes/)
- [Developers Common JavaScript errors, explained What "Cannot read properties of undefined", "x is not a function", CORS and JSON.parse errors mean, with exact browser messages and fixes.](https://erroneo.us/developers/javascript-errors/)
- [Thinking Cognitive biases: the predictable ways good minds go wrong A sourced guide to 20 common cognitive biases: anchoring, confirmation bias, sunk cost, Dunning-Kruger and more, with examples, fixes and replication caveats.](https://erroneo.us/thinking/cognitive-biases/)
- [Myths Nutrition myths: what the evidence actually says Eggs and cholesterol, MSG, detoxes, eight glasses of water, the five-second rule, best-by dates: 13 food myths, checked against FDA, USDA and research.](https://erroneo.us/myths/nutrition-myths/)
- [Developers Famous software bugs in history Ariane 5, Mars Climate Orbiter, Therac-25, Knight Capital, the Patriot clock, Y2K and CrowdStrike: what went wrong, per official reports, and the lessons.](https://erroneo.us/developers/famous-software-bugs/)

## What this site is

**erroneo.us** (say it “erroneous”) is a field guide to being wrong in predictable ways. Some errors are small and social, like writing *effect* when you meant *affect*. Some are expensive, like a unit mismatch that sends a spacecraft too deep into a planet’s atmosphere. Most sit in between: a confusing `502` on a Friday deploy, a `TypeError` that only appears in production, a nutrition rule you absorbed as a child and never checked.

The common thread is that these mistakes are *patterned*. People confuse the same word pairs, hit the same stack traces and repeat the same myths. That makes them worth documenting once, carefully, with the fix next to the failure.

## How the pages work

- **Wrong next to right.** Red strikethrough for the error, green underline for the correction, and a sentence on *why*.
- **Sources on every claim.** Specifications like RFC 9110 for HTTP, official language docs, investigation reports for historical software failures, and government or peer-reviewed sources for health and money. See [sources & methodology](https://erroneo.us/sources/).
- **Skimmable first, thorough second.** Tables and quick answers up top, the nuance underneath, and an FAQ at the end.
- **Corrections welcome.** A site named after errors has to be strict about its own. Our [corrections policy](https://erroneo.us/about/#corrections) explains how we fix them.

## Start here

Writers and students usually want [commonly confused words](https://erroneo.us/language/commonly-confused-words/) or [common grammar mistakes](https://erroneo.us/language/common-grammar-mistakes/). Developers land on the [HTTP status code reference](https://erroneo.us/developers/http-status-codes/), [JavaScript errors](https://erroneo.us/developers/javascript-errors/) and [Python errors](https://erroneo.us/developers/python-errors/). If you want to argue better, read [logical fallacies](https://erroneo.us/thinking/logical-fallacies/) and [cognitive biases](https://erroneo.us/thinking/cognitive-biases/). And if you suspect something you were taught is wrong, the [myths section](https://erroneo.us/myths/) is for you.

---
Source page: https://erroneo.us/ · More: https://erroneo.us/llms.txt