Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »

GenJoe: Sep 15, 2010; Rehabilitated?

That's just a bullshit word.

Suspicious Dish posted:

what's preventing a post-install script from reading ~/.gnupg? how is that locked down?

signed packages *might* be a step up but you have to define your threat model and figure out what each technology helps with.

blindly going "hurr durr signed packages will fix this" isn't how we should be doing security in 2017.

okay, so I've read the private key in ~/.gnupg, but I'll still need the password that the private key was encrypted with if I want to sign anything, and a post-install script has no way of getting at that. I think it's a reasonable assumption ityool 2017 that people are generating private keys with a password.

also, another benefit of signed packages is that now you have an avenue to revoke a particular key if you know you've been owned and need to distance yourself from any haram versions. although, I wonder how much better this is than npm itself just going "hey, this package has been owned, do you really want to use it?" in large red ascii text or whatever whenever you go to install it

# ? Aug 30, 2017 08:34

Adbot: ADBOT LOVES YOU

# ? Jun 7, 2024 21:38

QuarkJets: Sep 8, 2008

nielsm posted:

Yes, the problem is that in Python, any assignment is an implicit declaration that the variable lives in the assignment scope, unless it has been declared nonlocal in the same scope... unless it's a global, I think?
So in Python 1 and 2 you can't reassign a variable that lives in an outer function scope from an inner function, but have to use "tricks" like making the thing you want to reassign a member of something or a dict entry. (This alone is reason enough for me to prefer Python 3.)

So then the issue isn't in declaring where a variable lives, since that's happening implicitly, it's just in being unable to effect the contents of an outer scope variable from within an inner scope without an obtusely-named keyword.

# ? Aug 30, 2017 08:40

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

GenJoe posted:

okay, so I've read the private key in ~/.gnupg, but I'll still need the password that the private key was encrypted with if I want to sign anything, and a post-install script has no way of getting at that. I think it's a reasonable assumption ityool 2017 that people are generating private keys with a password.

also, another benefit of signed packages is that now you have an avenue to revoke a particular key if you know you've been owned and need to distance yourself from any haram versions. although, I wonder how much better this is than npm itself just going "hey, this package has been owned, do you really want to use it?" in large red ascii text or whatever whenever you go to install

Aren't npm accounts authenticated with a password? Why don't they prompt at install time there too? If it's because the system cached a token because entering a password every time is a pain, the same thing happens with the gnupg agent daemon.

Revocation is an interesting case, since there I would assume that a hacked key would need to get rotated out and a new key put in is place. But any attacker could use this same mechanism to swap that key out, no? Any central authority could indeed simply pull a hacked package much easier than trying to update key revocation lists. Short key name collisions happened at my last job and trying to get apt to not trust a key was an exercise in futility.

# ? Aug 30, 2017 08:55

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

Suspicious Dish posted:

Aren't npm accounts authenticated with a password? Why don't they prompt at install time there too? If it's because the system cached a token because entering a password every time is a pain, the same thing happens with the gnupg agent daemon.

How often do you sign things with the key that controls your package releases?

How often are you going to do that shortly before installing a random node package?

# ? Aug 30, 2017 09:02

TheresaJayne: Jul 1, 2011

GenJoe posted:

this post is

Nothing is ever 100% secure.

Take Master locks for instance, They are the worst of the worst

https://www.youtube.com/watch?v=NAcNsdWw_y0

# ? Aug 30, 2017 10:22

Doom Mathematic: Sep 2, 2008

How do other package registries prevent typo squatting?

# ? Aug 30, 2017 11:37

chippy: Aug 16, 2006; OK I DON'T GET IT

Some fuckwit I work with sporadically puts 'css' in his css class names. I presume he only does it sporadically because that would violate his personal rule of never being consistent about anything.

# ? Aug 30, 2017 12:06

MisterZimbu: Mar 13, 2006

chippy posted:

Some fuckwit I work with sporadically puts 'css' in his css class names. I presume he only does it sporadically because that would violate his personal rule of never being consistent about anything.

My #1 pet peeve:

code:

insert into tblUsers (fldUserName, fldFirstName, fldLastName, fldEmail ...)

# ? Aug 30, 2017 16:14

Thermopyle: Jul 1, 2003; ...the stupid are cocksure while the intelligent are full of doubt. �Bertrand Russell

I hate variable names with "meta" information like that. Same reason I dislike most spins on Hungarian notation.

Also why I don't like prefixing interfaces with an I.

It feels like crossing the streams.

# ? Aug 30, 2017 16:37

chippy: Aug 16, 2006; OK I DON'T GET IT

He used to do full-blown Hungarian notation but its been beaten out of him.

# ? Aug 30, 2017 16:48

SupSuper: Apr 8, 2009; At the Heart of the city is an Alien horror, so vile and so powerful that not even death can claim it.

I only use Hungarian notation for UI, eg. btnOk, txtCustomer, dlgConfirmOrder. Just writing "ok" and "cancel" feels wrong and is prone to name conflicts.

# ? Aug 30, 2017 16:54

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

How do you guys feel about mThing in C++. I think it's the one place Hungarian style is actually helpful, especially for debugging.

# ? Aug 30, 2017 16:55

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

You mean as a hack to compensate for lovely tooling that can't syntax-highlight those things in a different colour or w/e? Eh, I guess it's fine. As long as you realize that that's what you're doing and don't think it's actually good.

# ? Aug 30, 2017 16:59

chippy: Aug 16, 2006; OK I DON'T GET IT

SupSuper posted:

I only use Hungarian notation for UI, eg. btnOk, txtCustomer, dlgConfirmOrder. Just writing "ok" and "cancel" feels wrong and is prone to name conflicts.

I've just realised I used to do this when doing Winforms development without it occuring to me that I was basically using my hated hungarian. Although I would use names like okButton, nameTextbox, etc.

# ? Aug 30, 2017 17:05

JawnV6: Jul 4, 2004; So hot ...

Volguus posted:

Ughh ... I'm not sure this is fine, but anyway. Not about github going down (duh, github will be with us forever), but how about taking over repositories, typosquatting or other forms of injecting unknown/unwanted code. I mean, how can one trust what npm has to offer when npm has no way of checking its offerings? In what universe does that make any sense? And that documentation sample that I just posted is a perfect example of "no brain cells were used in the making of this thing". How can it be possible to get things from a 3rd party location without me telling you specifically to do so and say that "it's fine" with a straight face?

I don't have any package maintenance expertise but "GitHub will always be up and accessible" along with "any code up on GH is a huge security threat" seems to be an amazingly fine grained position.

# ? Aug 30, 2017 17:25

canis minor: May 4, 2011

return0 posted:

The why is you, as React is actually pretty good.

Should have put more accent on JSX part; I'm not denying that react.js is nice - I just hate:

code:

var message = "Hello"
var container = (<div>
<span>
{message}
</span>
</div>)

Such notation tugs at something fundamental in me, as opposed to:

code:

var message = "Hello"
var container = "<div>\
<span>\
"+message+"
</span>\
</div>"

I guess when you have to deal with multiple template literals, you don't want to deal with substituting variables and you want something to do that for you, but still, this kind of transpilation seems... wrong to me.

edit: imho, there should be clear separation of presentation layer (JSX) from code (rest of react), preferably in their own files. This way you could use different templating engines as well and get rid of babel that does the assembly of the template

canis minor fucked around with this message at 18:42 on Aug 30, 2017

# ? Aug 30, 2017 17:43

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

Thankfully as JavaScript people have learned over the past year and a half, programming languages can be compiled or interpreted, which has lead to an explosion of React-alikes placed all along the runtime/compile-time gradient.

Some compile to nothing but template strings + innerHTML ( https://svelte.technology/ )

Some compile to JavaScript methods ( React )

And some compile to a custom bytecode language ( https://github.com/glimmerjs/glimmer-vm )

So now you get all the fun of "code is data is code" discovery confused by the fact that it's all being written on top of a platform which has a GC, runtime program evaluation with a good JIT, and a fast native parser for the language you're trying to compile.

# ? Aug 30, 2017 17:57

dougdrums: Feb 25, 2005; CLIENT REQUESTED ELECTRONIC FUNDING RECEIPT (FUNDS NOW)

chippy posted:

I've just realised I used to do this when doing Winforms development without it occuring to me that I was basically using my hated hungarian. Although I would use names like okButton, nameTextbox, etc.

"Visual Basic Concepts
Visual Studio 6.0
Constant and Variable Naming Conventions"

https://msdn.microsoft.com/en-us/library/aa240858(v=vs.60).aspx

# ? Aug 30, 2017 18:26

necrotic: Aug 2, 2005; I owe my brother big time for this!

return0 posted:

The why is you, as React is actually pretty good.

Python pip and Ruby gems are identical in this regard.

Ruby does not let published packages depend on git repos, only other published gemspecs (including to private gem servers). Bundler is for development and allows git references.

necrotic fucked around with this message at 18:32 on Aug 30, 2017

# ? Aug 30, 2017 18:29

MisterZimbu: Mar 13, 2006

SupSuper posted:

I only use Hungarian notation for UI, eg. btnOk, txtCustomer, dlgConfirmOrder. Just writing "ok" and "cancel" feels wrong and is prone to name conflicts.

Well you see this is best practices because how else are you going to keep all the variables you use for your business logic separate from your controls

(I do the same thing)

# ? Aug 30, 2017 18:32

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Zemyla posted:

No, but you can transpile it from Haskell!

You absolutely can. http://pyjs.org/

# ? Aug 30, 2017 19:06

return0: Apr 11, 2007

canis minor posted:

Should have put more accent on JSX part; I'm not denying that react.js is nice - I just hate:
code:
var message = "Hello"
var container = (<div>
<span>
{message}
</span>
</div>)
Such notation tugs at something fundamental in me, as opposed to:
code:
var message = "Hello"
var container = "<div>\
<span>\
"+message+"
</span>\
</div>"
I guess when you have to deal with multiple template literals, you don't want to deal with substituting variables and you want something to do that for you, but still, this kind of transpilation seems... wrong to me.

edit: imho, there should be clear separation of presentation layer (JSX) from code (rest of react), preferably in their own files. This way you could use different templating engines as well and get rid of babel that does the assembly of the template

Yeah fair enough. For balance, another thing that sucks a bit about React is it's halfway-house CSS for inline styling, which is awkward for expressing hover states etc.

necrotic posted:

Ruby does not let published packages depend on git repos, only other published gemspecs (including to private gem servers). Bundler is for development and allows git references.

My bad, I misremembered.

# ? Aug 30, 2017 19:45

redleader: Aug 18, 2005; Engage according to operational parameters

Xarn posted:

Issue just got opened up, apparently our preview release breaks :nsfw:
this :nsfw:

Thats definitely a thing...

Gendered variables

# ? Aug 31, 2017 01:54

CPColin: Sep 9, 2003; Big ol' smile.

Typical programmers, forcing all the data into binary.

# ? Aug 31, 2017 02:19

Sedro: Dec 31, 2008

Doom Mathematic posted:

How do other package registries prevent typo squatting?

Maven has namespaced packages and uses a verification step (e.g. prove that you own the domain) before assigning those namespaces.

# ? Aug 31, 2017 03:19

Sedro: Dec 31, 2008

XML solves typo squatting since everyone will copy and paste it

# ? Aug 31, 2017 03:24

brap: Aug 23, 2004; Grimey Drawer

MisterZimbu posted:

Well you see this is best practices because how else are you going to keep all the variables you use for your business logic separate from your controls

(I do the same thing)

It's very needful in Windows Forms as each form subclass winds up containing a shitload of UI elements as instance variables.

# ? Aug 31, 2017 04:27

QuarkJets: Sep 8, 2008

Thermopyle posted:

I hate variable names with "meta" information like that. Same reason I dislike most spins on Hungarian notation.

Also why I don't like prefixing interfaces with an I.

It feels like crossing the streams.

Didn't crossing the streams wind up being really good and important though?

# ? Aug 31, 2017 07:17

Thermopyle: Jul 1, 2003; ...the stupid are cocksure while the intelligent are full of doubt. �Bertrand Russell

You're thinking about it too much.

But if you want to do that, it was OK in very limited and specific circumstances, no?

# ? Aug 31, 2017 14:03

Doom Mathematic: Sep 2, 2008

Sedro posted:

Maven has namespaced packages and uses a verification step (e.g. prove that you own the domain) before assigning those namespaces.

What about typosquatting the namespaces, though?

# ? Aug 31, 2017 16:49

Pollyanna: Mar 5, 2005; Milk's on them.

http://redux.js.org/docs/recipes/WritingTests.html#middleware

quote:

Middleware functions wrap behavior of dispatch calls in Redux, so to test this modified behavior we need to mock the behavior of the dispatch call.

Example

First, we'll need a middleware function. This is similar to the real redux-thunk.
code:
const thunk = ({ dispatch, getState }) => next => action => { if (typeof action === 'function') { return action(dispatch, getState) } return next(action) } 
We need to create a fake getState, dispatch, and next functions. We use jest.fn() to create stubs, but with other test frameworks you would likely use sinon.

The invoke function runs our middleware in the same way Redux does.
code:
const create = () => { const store = { getState: jest.fn(() => ({})), dispatch: jest.fn(), }; const next = jest.fn()

Groaaan

# ? Aug 31, 2017 18:50

McGlockenshire: Dec 16, 2005; GOLLOCKS!

code:

const thunk = ({ dispatch, getState }) => next => action => { ... }

Can someone explain this to me, please? I already thought arrow functions were abominations of horrifying syntax when they were just one layer deep, but this seems to be multiple layers or something and I have no idea how to even begin mentally parsing it. Are next and action arguments? I thought those were inside the parens. Why are there curlies inside the argument parens?

# ? Aug 31, 2017 19:14

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

Parse it like this:

JavaScript code:

const thunk = ({ dispatch, getState }) => {
    return (next) => {
        return (action) => {
            ...
        };
    };
};

Basically, take the code above, and apply several transformation rules: (foo) => { return bar; } is the same as (foo) => bar is the same as foo => bar if your function only takes one argument. And ({ foo, bar }) is a fun thing called destructuring assignment, allowing you to do const { foo, bar } = { foo: 10, bar: 20 }; to define local variables. Basically, it lets you pull from a property bag. And you can use it in an assignment or a parameter list.

# ? Aug 31, 2017 19:39

Thermopyle: Jul 1, 2003; ...the stupid are cocksure while the intelligent are full of doubt. �Bertrand Russell

Destructuring is cool and good, just like arrow functions.

# ? Aug 31, 2017 20:09

TheresaJayne: Jul 1, 2011

ok the company i work for is rewriting the system in a modernisation program,

They were testing it the other day and for 5 users continually asking for pages they were taking 15-35 seconds per page....

This is using Node, and other modern stuff.

# ? Aug 31, 2017 21:12

TooMuchAbstraction: Oct 14, 2012; I spent four years making
Waves of Steel
Hell yes I'm going to turn my avatar into an ad for it.; Fun Shoe

Look, you're not supposed to prematurely optimize. That means you don't have to care about runtime whatsoever until it becomes a problem, right?

# ? Aug 31, 2017 21:20

McGlockenshire: Dec 16, 2005; GOLLOCKS!

Suspicious Dish posted:

Parse it like this:

Thank you, it makes sense rewritten like that. I just don't understand the necessity of clever terseness, especially combined with the FP circlejerk that's everywhere now. I'm getting old.

# ? Aug 31, 2017 21:34

canis minor: May 4, 2011

I still think arrow notation in ECMA Script was a mistake (as I can't get used to it as well)

Just gotten a new phone - went from iPhone to Android; moved most of my apps just fine appart for Goodreads, which is found as similar app as "Grommr: Gay Gainers & Bellies"

# ? Aug 31, 2017 22:22

Thermopyle: Jul 1, 2003; ...the stupid are cocksure while the intelligent are full of doubt. �Bertrand Russell

Just spend some time getting used to them. Write a bunch of random stuff with them until you got it. That's what I did and I definitely wouldn't want to go back to not having them.

They're great once you're used to them, and they're particularly great for nested functions as the arrows concisely and accurately explain whats happening.

# ? Aug 31, 2017 23:46

Adbot: ADBOT LOVES YOU

# ? Jun 7, 2024 21:38

vOv: Feb 8, 2014

Arrow functions also capture `this` so you don't have to do `let self = this` or `func.bind(this)`.

# ? Aug 31, 2017 23:51

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »