Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

jarito posted:

IIRC there are some issues in using UUIDs for auto-generating keys in some databases. It's been a while since I looked into it so that might not be an issue anymore.

Even so, using UUIDs doesn't seem to solve his problem since what they need is a way to differentiate two of the same record types. They are using a 'reserved' part of the PK key space which, with UUIDs, would be about a bajillion times worse. It sounds like they just need a separate field.

To that I would say don't have the DB autogenerate the ID, have the middleware generate the UUID for you.
Plus yes they need a separate column. Being clever and doing wizardry on the PK screams "bad architecture."

Adbot
ADBOT LOVES YOU

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Zhentar posted:

You are apparently not, since we have a non-trivial number of tables with UUID primary keys.

Thank the baby jesus.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

KaneTW posted:

What are the reasons for using UUID primary keys except for doesn't require auto-increment/making ids not guessable?

One example that I've personally dealt with:

If you have a geographically diverse application with multiple local databases that eventually need to be centralized for reporting or whatever, the UUID will make the rollup operation so much easier.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Look Around You posted:

It's also only a 1-pass compiler, which I only found out after asking for help in the lisp thread because there's pretty much no documentation of it only being 1-pass at all. Also a functional language that flips poo poo because functions aren't defined in the right order is loving stupid and very counter-productive.

If you wanna see the reason: http://news.ycombinator.com/item?id=2467359

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

ToxicFrog posted:

Why? It ensures that - no matter what filesystem you're using, no matter what program you're running - you have a consistent mechanism for wildcard expansion, which is documented, and configured, in one place only.

The only reason I can think of is that you can exhaust the wildcard buffer, try rm'ing a directory with a few million files in it (which is also a horror in and of itself)

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

GrumpyDoctor posted:

I've heard an argument that goes something like "shell wildcard expansion means that, for example, rm can't know when it's gotten a * so it can double-extra-verify that you want to do that." I don't know if it's a terribly compelling argument, but it's there.

Both bash and zsh can intercept that command and prompt for input. I'm not a shell commando but I think bash uses an alias (rm -i) and zsh has some function hook.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Zamujasa posted:

Haha, at least your poo poo is in functions! :downs:

Every time I've worked with off-shored, lowest-bidder code I've run into the 4000+ line monolithic function that invariably 'dispatches' by switch statement.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

baquerd posted:

It has it's place - quickly developed, little, and internal web pages for frontend database access (monitoring state, clearing logs, etc.) or trivial stateful http sessions. It's only when you start making big public websites that it really becomes a horror.

Also jokes, php's standard library makes for the best jokes.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.
Personally I use php so often that I feel I'm justified to pick on it. It works for me for a bunch of projects and gets the job done but that doesn't mean it's "good" and it definitely has earned my derision.

But yes please get in a huff over people complaining about the worst language on the TIOBE top 10.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Factor Mystic posted:

This must be what the nosql revolution looks like

Just the highly visible, stupider side. All the good nosql work is done in huge places like Amazon and Google and their poo poo actually works.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.
I've had a bunch of EBS volumes fail on me personally. I still love EC2, you just have to remember you're still on a machine somewhere and it can still fail, so have snapshots and hot/warm spares ready for important services. Or even better, geodiversify your poo poo.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

yaoi prophet posted:

Wait, how do you compare strings in Clojure? What about other things that can't be cast to numbers?

AFAIK you use (compare "S1" "S2") and check 1 0 or -1 like .compareTo

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Aionic Duck posted:

I've had to maintain some code that has variable names like this. Boggles my damned mind with regards to why someone would think this was wise.

I'm pretty sure it's from Borland's books. I remember something very similar from both Turbo Pascal and Turbo C's examples. Delphi is probably similar.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

PrBacterio posted:

Huh? I don't remember anything like that from my DOS Turbo Pascal / Delphi days. The usual naming convention was to prefix type names with a T, and then have variables which have no identity beyond that, e.g. callback parameters, just named after the generic noun, i.e. canvas: TCanvas, and so on.

T* was the type, the actual instance was the* for instance variables where only 1 would exist at a time. I had to dig but I did find at least one official borland example for Turbo Vision of all things where they did this:
C++ code:
 //
  // About dialog box
  //  About dialog box features updating display of
  // the current time.
  //
  class TAboutTimeDialog : public TDialog
  {
      private:
      char CurrentTime[50];     // current time
      TInputLine *TimeDisplay;  // Inputline to display
      // the time

      protected:

      // Get the time string
      // from DOS and store in date_time
      void GetTimeString(char *date_time);

      public:

      TAboutTimeDialog(char *Title);

      // implement idle function for time updating
      void idle(void);

      virtual void handleEvent(TEvent &theEvent);
  };
Also I think I remember that the automated tools would make TApplication theApplication; or something like that by default. Drugs, alcohol and time have diluted those memories though, and I could be mistaken about that.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Aleksei Vasiliev posted:

There are Java implementations that require you to import anything in java.lang?

e: import java.lang.System.out; isn't even a valid import

It used to be the case (Java 1.0 - 1.1 era IIRC) that you had to import from java.lang. I specifically remember having to import java.lang.String during CS class in uni. I hated java for years due to 1.1.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Zamujasa posted:

This can tie in pretty well if you have an issue tracker and tie commits to it, even by just putting the issue number you're working on in the commit message. "#47 Changing foo to bar" and "#47 Changing baz to bar" (in addition to grouping by being on a separate branch) can really help with the digging.

most of my commits are just that: "fixed #45 - Customers can't checkout", let the ticketing system provide context, which is what its good at and easily (hopefully) searchable, and let source control be good at controlling source.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Suspicious Dish posted:

http://holophrasticenterprises.com/

"hm, why did this take so long to load? it's just a logo"

Holy poo poo when I was a literal child I actually applied for a job with this place.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Bhaal posted:

Kind of a tangent, but I work in healthcare inside the US (that is, we hold personal identity and health info so we have to be HIPAA complaint). We recently had to fight back on a "universal sign on" initiative with a large client of ours who have tens of thousands of individuals in our system. As a user convenience/experience improvement, they wanted their employees to be able to sign in on THEIR site and then have a link that would portal them straight into our site. We agreed on a spec for some REST calls that used name, DOB, etc. to create a link between the two identity databases so that the user could get in more easily.

Not a bad plan, perhaps, but they balked when this led to them getting taken to a login page with the username pre-filled and prompting for the password. Turns out they expected those REST calls (which dealt purely with simple census data points that both sides shared) to completely bypass the login to our site, not just be a convenient token that cuts down on customer service calls of people forgetting their username. We had to explain more than a couple times that this would amount to us giving them a tool to view the medical data of individuals which is so hilariously verboten that we'd be destroyed in an audit, and out of business when company X's next round of layoffs targeted individuals whose glucose levels on their last blood draw indicated pre-diabetic conditions.

Makes me wonder about the number of cross-platform agreements that go over without a consideration for these sorts of details. And then I remember my job circa 2004 with a networking hardware manufacturer, who was partnered with SBC, who was partnered with Yahoo!, who offered yahoo email for every SBC subscriber, who created an admin tool that allowed you to ghost into the full yahoo email client of any SBC subscriber, who then bundled that tool into a suite of other tools, which they shared with some of their partners including us the hardware manufacturer. Ostensibly so we could help with support problems via some of the other tools, but not only did we have full access to the suite of tools including email ghosting, we were also given training on it.

If you're developing the software and shipping it that's one thing as far as security is concerned. But for my money the world of operations, devops, and corporate partnering exposes the human element of security flaws, which can put plaintext password columns to shame.

What the gently caress why wouldn't you just use ADFS or SAML to trust/verify, and then transmit the info?
e: not a personally directed question, just that my mind exploded...

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Volmarias posted:

I hate to resurrect password chat, but I don't understand this line. Is the idea that your cracker will find

derpPassword1
derpPrettyPrincess

etc and you can figure out that "derp" is the salt pretty quickly, letting you power through the rest?

If you have a system wide salt, and are not bolstering it with a random salt or some other mechanism, an attacker can look at the most frequent password hashes in the data and basically guess what they are.

I'm not up on my crypto enough to know if you have the salt+hash -> plaintext if you can "work back" to the salt. I *think* depending on the cipher this is possible and that's all she wrote for the whole DB.

You could also brute force the salt if you have any information on the cipher.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

tractor fanatic posted:

If you could discover the salt from knowing plaintext and hash, wouldn't that be equivalent to discovering plaintext from knowing salt and hash? I'm pretty sure salt and plaintext are interchangeable here. Plus, you can easily make this a chosen plaintext attack by just registering an account of your own.

Well you don't know the hash, you only know the one quantity salt+hash. I'm not sure if you can, in one step, reduce a salt+hash to just a salt given a plaintext and the salt+hash. Maybe if you have enough known values ... attacking crypto isn't my strong suit :(

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

God of Mischief posted:

Spring. Spring loves its goddamn interfaces and single-implementing classes named <Interface>Impl. Yes, I understand that it is apparently much easier to proxy interfaces than concrete classes. No, you are not "programming to interfaces" in the way that it was intended to mean. Now gently caress you let me just use my concrete class because I will never have a second implementation for it. I will beat you to death if you give me an interface with a matching *Impl for no reason.

I don't mind it. I usually program in the large (multi million line projects) and sometimes you need to do something no one anticipated, and the original Impl is good enough for 80% of cases, and for the other 20% you just plug in your new class that handles the new feature. Having that simple layer of abstraction (Thing and ThingImpl) has saved me a bunch of headache a number of times.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Funking Giblet posted:

Subclass would probably be better here,unless the implementation is totally different.

Maybe I'm cargo culting a bit here but I prefer to code to interfaces rather than subclasses.

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

Zhentar posted:

The lea is a 3 byte NOP, used to align the loop (apparently onto a 16-byte boundary, which it seems can be a significant optimization for some processor architectures).

Why wouldn't the compiler just emit nop, nop, nop? Just to be hipster or something?

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

yaoi prophet posted:

It might be faster on that architecture.

I wonder if it has a negative effect on code cache. I don't know enough about instruction optimization any more :(

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

rjmccall posted:

They probably have more recent recommendations.

....And that answers my question.

quote:

Because NOPs require hardware resources to decode and execute, use the least number of NOPs to achieve the desired padding.

Adbot
ADBOT LOVES YOU

trex eaterofcadrs
Jun 17, 2005
My lack of understanding is only exceeded by my lack of concern.

DaTroof posted:

We had a client sneak a development build into production by putting it in an iframe on their live site. Without telling us, of course.

Welp, I just added a clause to my standard contract form.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply