The Whiteboard

12:01 AM

Wow! :O Now I feel like I have not learnt anything for these last 10 months! I can't even remember half of the syntaxs in one language.

Lightness Races in Orbit

ahem syntaces

user55340

It becomes easier as you learn more.

Lightness Races in Orbit

(he says, making it up)

user55340

syntax

Noun: syntax ‎(plural syntaxes)

A set of rules that govern how words are combined to form phrases and sentences.
The incorporation of a rule of V MOVEMENT into our description of English Syntax turns out to have fundamental theoretical implications for our overall Theory of Grammar: it means that we are no longer able to posit that the syntactic structure of a sentence can be described in terms of a single Phrase-marker representing its S-structure. For, the postulation of a rule of V-MOVEMENT means that …
(computing, countable) The formal rules of formulating the statements of a computer language.
syntax f
syntax f ‎(genitive singular syntaxe, declension pattern of dlaň)
syntax c

Lightness Races in Orbit

25 secs ago, by Lightness Races in Orbit

(he says, making it up)

Elizabeth

12:02 AM

@MichaelT I guess that's true because a lot of the syntax are similar.

user55340

I'd wonder about how to use syntaxe in a sentence, but I'd have to ask it over on EL&U.

user55340

@Elizabeth Syntax is not the problem... its thinking in the new language the right / idiomatic way.

Lightness Races in Orbit

@MichaelT hello, that's a lovely syntaxe

user55340

After the first few languages, you stop thinking about the problem in the language and start thinking about it in your own internal "this is how it needs to work." - then it becomes a "trivial" matter of mapping the internal "this is how it needs to work" into the language.

Lightness Races in Orbit

synonym of syntax and of tnettenba

user55340

12:05 AM

Eye-Tracking Code Experiment (Novice)

►

user55340

Code Comprehension with Eye Tracking

►

Elizabeth

@MichaelT Okay. So like system engineering your app and engineering into your language?

@MichaelT Where do you get all these resources? I have lots to read and watch!

Jörg W Mittag

@MichaelT Vala and Genie are a good example here: vastly different syntaxes (Vala C#-based, Genie Python-based), yet exact identical semantics and type system. In fact, they are implemented as different parsers sharing the same compiler, AFAIK.

user55340

@Elizabeth thats a question many people ask. I read quite a bit myself and know how to search for it again.

Jörg W Mittag

Some PLT diehards like to say that Type Theory is the Grand Unifying Theory of PLT, syntax and even semantics don't matter, the types tell you all that you need to know.

I disagree, but it's worth thinking about.

Lightness Races in Orbit

12:09 AM

you lot care about this stuff way more than I do. it's a little disheartening

user55340

Btw, since you're here... @JörgWMittag I've played with implementing a DFA in the type system in Java. I haven't tried putting a PDA in there yet... though I suspect its possible. Have you thought about the power of the type system itself?

user55340

One example:

user55340

Oct 5 at 3:03, by MichaelT

Ok... that mod 3 thing. Got it working. Its kind of neat.

user55340

And start reading from there.

Jörg W Mittag

Ugly syntax is … well … ugly. Semantics that don't match the problem domain, that's a showstopper.

user55340

12:12 AM

Its more a "can you do it" - just a proof of concept there.

user55340

I am curious what type of language I can write as a DSL within the type system of Java and the chained calls.

Elizabeth

@MichaelT I read quite a bit too but if you needed me to search for it again ... that would take some. So through your experience ... what language do you suggest I should jump into first? I knew html and css because I'm a designer but got into php, js and mysql when I wanted to challenge myself by creating a web app for the first time.

user55340

@Elizabeth Sticking with the web app world? You might try Scala (Play framework) as a way to get some new ways of thinking of code: playframework.com

user55340

If you're looking to pivot to "enterprise" code, Java or C# has fairly good "we use this" at big companies.

user55340

If you're more into startups, I hear ruby is the thing... though I didn't paticuarlly enjoy my experiences with undisciplined "get it out the door" ruby code. Pro: lets you do neat things. Con: lets you do neat things.

user55340

12:18 AM

For "get stuff done" perl or python.

user55340

Given a php background, perl would probably be a more natural fit, but not as challenging in new thoughts.

enderland

enderland is writing python currently

user55340

> A language that doesn't affect the way you think about programming, is not worth knowing. -- Alan Perlis

Jörg W Mittag

@MichaelT I've seen some really cool stuff done with Scala's type system, Haskell's and OCaml's. E.g. a HTML templating engine for OCaml that cannot produce malformed HTML (it would be a type error). Galois does some amazing stuff with the Haskell type system. They're a defense, CIA, NSA, government, … contractor and they encode their client's document classification rules into the type system, so that you cannot compile a program that will leak classified data.

Lightness Races in Orbit

nn

Jörg W Mittag

12:20 AM

Scalaz, Shapeless and friends do some mind-bending stuff in Scala's type system.

user55340

@JörgWMittag I know scala's is really powerful. Haven't gotten my head around Haskel nor OCaml.

user55340

I like this one:

Jörg W Mittag

I'm scared of Java, though. Martin Odersky, Scala's designer also designed Java Generics, and he says he doesn't understand them.

user55340

> A programming language is low level when its programs require attention to the irrelevant.

user55340

@JörgWMittag I'm fairly sure I could get a pushdown grammar with the generics... though I'd probably go deeper than safe for sanity.

Jörg W Mittag

12:22 AM

Haskell's (at least with some extensions enabled) and Scala's are Turing-complete.

I think OCaml's isn't, they don't want to give up global type inference.

To be fair, though: in that case, Odersky was talking about Wildcards and Use-Site Variance, both of which were shoehorned in without his input.

user55340

There are some counter intuitive things that happen withs with generics and its kin... the classic List<? extends Animal> cage; cage.put(new Lion()); not working (not sure if I remembered that correctly).

user55340

@Elizabeth some more fun reading: thecodelesscode.com/contents (start at case 1)

ratchet freak

because ? could be Chicken and you don't want to add a Fox to that

Jörg W Mittag

A cool (although controversial) example which doesn't use much of the "computational" power of the type system, are Scala's type-preserving collection algorithms. Most collections frameworks are not type-preserving (e.g. in Ruby, all Enumerable methods return Array, in Java, it's all Streams, in .NET, it's all IEnumerable). If they are type-preserving, they achieve this with copy&paste (Smalltalk has duplicate versions of all the collection operations in all the collection classes).

Elizabeth

@MichaelT Yes, if I do this well ... I definitely want invest it into a startup. Though I don't like ruby either. Haven't heard much good comments on them.

Was thinking of focusing on js because that seems to be where the web is heading.

user55340

12:28 AM

@Elizabeth I'm biased... my "natural" language is perl, though I've been Java for a very long time.

user55340

Ruby just rubs my perl sensibilities wrong in some places.

Jörg W Mittag

Scala has type-preserving operations without duplication, mapping a Set will return a Set, even though it doesn't (necessarily) have its own implementation of map. And it figures all this out at compile time.

Elizabeth

C and Java is my next language to learn

user55340

Front end, yes. Back end... you'll still find a lot of JVM and CLR languages there.

user55340

C is a very good one to learn in that you learn the behind and before of what is actually going on in many spots.

user55340

12:29 AM

Until you've tracked down a memory leak from a malloc, you don't always appreciate a garbage collector.

user55340

> A programming language is low level when its programs require attention to the irrelevant.

user55340

That quote is one that actually does a good job of describing why C moved from being high level, to what many consider now to be low level.

Jörg W Mittag

@MichaelT That's a double-edged sword, though. C only teaches you about "what the machine does" because our current machines have been designed to do what C expects them to do. A significant portion of code nowadays is written in languages for whose performance our current mainstream CPUs and OSs are actively harmful, but we cannot change that, because of all the C code out there that assumes that all machines always behave like x86/ARM/POWER.

user55340

Its more a "I agree with this bit": williamedwardscoder.tumblr.com/post/43394068341/…

Jörg W Mittag

For example: virtual memory can slow down GC performance, yet, garbage collected languages don't need virtual memory, memory protection is guaranteed by the language anyway. A lot of the cache optimizations don't work for objects, only for ADTs. The better strategy for bringing down the total cost of cache misses for OO languages is to reduce the cost of a single cache miss, not to reduce the number of cache misses. (The latter won't work.)

user55340

12:35 AM

> The aim is to be so declarative, so high-level as to no longer see nor understand what is happening beneath and before.” What really happens is that most people that work with ruby are simply not educated enough to understand what is happening “beneath and before.” Ruby tries to go the extra step to make programming seem closer to a normal language. This means that more people will be able to become sufficiently proficient in it to think they actually understand what they are actually doing, and will proceed to try their hand at writing complex systems. Unfortunately without some very sol…

user55340

@JörgWMittag Have you seen Uncle Bob's "Clojure is the new C"? infoq.com/presentations/clojure-c

user55340

Its interesting, though there's a lot of rambling in there too.

Jörg W Mittag

In the Singularity OS, Microsoft measured an increase in context switching latency of over 30% by using the MMU for memory isolation, which is completely unnecessary because the language already guarantees memory safety, pointer safety, type safety and process isolation.

Isn't "Uncle Bob rambling" a tautology? :-D

user55340

@JörgWMittag at about 30 minutes in he is talking about how technology has changed. Comparing a PDP-8 to his phone.

user55340

The difference between computers today and the PDP-8 is on the order of 10^22 (size, power, speed, power consumption...) which is the number of angstroms between here and alpha centauri.

Elizabeth

12:43 AM

@MichaelT I need a bit of time to wrap my head around all these information. I'm really learning all this on my own. So do you think I should hold back on the startup idea until I learn more about how everything in the computer world works? Because I have to admit I know very little about the history of computer... the behind ... the hardware ... networks ... etc. But how many of the college startup founders in the first year of their studying really knows everything?

Jörg W Mittag

My opinion of C is that for a language that was specifically designed for writing operating systems, it is uniquely unsuited for writing operating systems. OSs are highly reactive, asynchronous, concurrent, parallel. C has no facilities for any of those. OSs need to be highly reliable, safe, secure, dependable. C has no facilities for any of those. It's not type safe, memory safe or pointer safe. OSs need to communicate. A lot. C has no facilities for defining protocols or parsing messages.

Elizabeth

@JörgWMittag But isn't C what people use for the os anyhow. If it works ... that means something right?

user55340

@Elizabeth Give paulgraham.com/before.html and paulgraham.com/start.html a read. There is a lot more to a startup than the idea, the execution, or even the company.

user55340

C isn't wrong, its just that it was built for a problem decades ago. There are new problems today that C doesn't tackle so well.

user55340

12

Q: How much is an idea worth?

Assume: Person A supplies an idea for an app. Person B builds the app. Question: In percentage terms, how much is the idea worth in the marketplace? What percentages should A and B receive, respectively? Clarification: Please don't respond with "It depends on what A and B agree...

Jörg W Mittag

12:50 AM

@Elizabeth Sure, you can build OSs in C. But, take Linux for example. Linux has on the order of 10 million lines of code. 90% of that is drivers, so 1 million lines for the OS. 90% of that is architecture support code. The core OS kernel has about 100000 lines. What can it do? Well, basically allocate memory and switch threads. That's about it.

The original Smalltalk system in the 1970s was written mostly in Smalltalk with a little bit of Mesa and some assembly. It had 60000 lines, so a bit more than half of Linux. What could it do? It had a full operating system, drivers, a graphics system, a VM, a compiler, an interpreter, text editor, office suite, distributed collaborative document creation, a graphical IDE with editor, debugger, etc.

user55340

@JörgWMittag and that operating system known as emacs has how many lines of code?

Jörg W Mittag

The same people are currently working on a new system and new languages and think they can bring it down to under 20000 lines. That's about the size of a college textbook.

Which means that a single determined person can read and understand the entire computing system.

Oh, and BTW that 20000 lines includes the hardware description language for the CPU, too.

user55340

Note that Unix back in the day was understandable by a single person.

Jörg W Mittag

Well, Smalltalk's goal was to be understandable by non-programmers, though, I'm not sure that's true for Unix. (Although myself being a programmer, I cannot speak to how understandable Smalltalk is to non-programmers. I know that it is being used successfully in schools down to the ages of about 6-8.)

user55340

Logo was been there too... and its a powerful language when you get under the covers.

Jörg W Mittag

1:00 AM

Yeah, Alan Kay was heavily inspired by Logo, he cites it all the time.

user55340

However, using the very basic functions of a language without going too deep? We could do that with pascal, basic, excel spreadsheet functions...

Jörg W Mittag

Totally off-topic: I recently learned that there is a JRuby-framework for building Minecraft plugins, and one of the plugins is a 3D Logo in Minecraft :-D

github.com/enebo/Purugin/wiki/Purogo-Introduction

user55340

Interesting.

user55340

c2.com/cgi/wiki?LogoLanguage

user55340

> Logo also had an important influence on SmalltalkLanguage via AlanKay and SmalltalkSeventyTwo (see EarlyHistoryOfSmalltalk).

user55340

1:05 AM

>
Part of Logo's low esteem amongst programmers is that they simply aren't aware of its full power; they learned Logo at school, from teachers who didn't know about it (because it's too 'advanced'); most of the schoolkids who learned Logo hit the ceiling of their instructors' knowledge before they reached any limit of the language's capabilities. Ironically, this means that Logo doesn't get a chance to show its real strength, which could be described as LowFloorHighCeiling?: a six-year-old can learn the basics of turtle control in a matter of minutes, but can continue building on those fund…

Elizabeth

@MichaelT Thank you for all the valuable resources. At first I just wanted to try out programming but found out that I loved it and was fascinated by the fact that we could "talk" to our devices with logic to create something that could help and impact the lives of others all over the world. Before I dived into this I did a lot of research myself too. I know it won't be easy but nothing in life worth having or giving is easy.

I guess I'm just going to pick a language, stick with it and utilize technologies we have to develop upon it.

Because I have to do it inorder to really learn something.

user55340

Just remember to keep learning new languages that challenge how you think.

user55340

Pick a different language philosophy each time.

user55340

(and then come back to your old stand by languages)

Elizabeth

@MichaelT Yes. Though I have to learn one first, right?

To get me started.

user55340

1:09 AM

@Elizabeth Yep. Pick up some scala (my suggestion for an easy "big jump in thinking" language) and give it a go.

Elizabeth

@MichaelT Good Idea. Hope one day I would be as experience and impressive as you and everyone else in these communities. Just seems a bit overwhelming now. :P

user55340

I've been a professional in the industry for about 2 decades... its something experience with all sorts of bugs and problems brings.

Jörg W Mittag

Some old thoughts of mine for interesting languages to learn: stackoverflow.com/a/2427021/2988

user55340

I assure you, trying to understand I got in 20 years in a night would be problematic.

Jörg W Mittag

11

A: Differences & Similarities Between Programming Paradigms

By far the best explanations of programming paradigms are found in Peter van Roy's works. Especially in the book Concepts, Techniques, and Models of Computer Programming by Peter Van Roy and Seif Haridi. (Here's the companion wiki.) CTM uses the multi-paradigm Distributed Oz programming language ...

Elizabeth

1:14 AM

OOP is the current paradigm I have been trying to pick up.

Jörg W Mittag

I notice it's missing a dependently-typed language in there. Although I wouldn't know what to recommend there. I'm thinking about toying with Idris.

Elizabeth

@MichaelT Definitely. Is there any big falls that I should be aware of?

user55340

@Elizabeth If the paycheck bounces, make sure the resume is up to date.

2

user55340

Though, more seriously - give web.archive.org/web/20150221071347/http://samizdat.mines.edu/… a read.

user15026

I finished the cookies, they look so cute :D

Elizabeth

1:19 AM

@MichaelT Haha. Sure thing. I guess I could always go back to designing and photography.

user55340

Many of the problems in programming isn't the code - thats easy. It does exactly what it says. Its what comes before writing the code, and after that is hard.

Elizabeth

@MichaelT Well do.

@MichaelT Like planning?

Jörg W Mittag

@Elizabeth Talking to people. That's basically the most important thing.

user55340

Planning, estimation, working with co-workers, support, maintenance, meetings, architectural decisions, requirements gathering...

Jörg W Mittag

No, let me rephrase that: the second most important thing.

The most important: listening to people.

Elizabeth

1:21 AM

@JörgWMittag Talking, yes, but it's not easy when you're new and you don't understand them ... they don't understand you. Listening is no problem for me.

Kind of embarrassing to have them describe things to you ... that's why I appreciate your guys patience in helping me out.

enderland

if you hang out here, you will ~~become assimilated~~ learn a lot

Even if you don't understand much of it initially, you will learn

user55340

For me, I look at my job - wherever I've been - as at its very core: make people's lives easier through the use of technology. Working people through the process of using that technology is a key part of it.

Elizabeth

@MichaelT Really? I think I would be more intelligent in those area of job descriptions.

Other than decisions .. because I always debate on a lot of things.

user55340

Note to self: on reddit, /r/food the "game" tag isn't about playing games.

Elizabeth

Since everything ... like every language has it's pros and cons.

user55340

1:26 AM

@Elizabeth That isn't want interviewers hire for though. They hire for code ability. This can cause a mismatch between what you actually have to do and the corresponding skills.

Elizabeth

@enderland You saw right through me. But yes, I think I should hang out here more.

@MichaelT I know. That's why I'm focusing on my code skills right now.

Anyhow, I am doing some mapping and planning for the app right now. Trying to visualize how to develop the restful api and which functions to create ... how to do it ... etc.

So if I'm understanding this right. The preferences could be saved when the user changes the settings by sending it to a nosql db and store it in json ... inside a folder? that belongs to the user? Please correct me if I'm wrong

user55340

In Couch, I'd have a 'preferences' database. Each user would have a document in that database. The contents of the document would be the json for the actual values you want.

user55340

Not 100% certain of the mongo comparison.

Elizabeth

@MichaelT Perfect! I could do just that. Since we could have however many dbs we want right. I'm going to look into couch but if I were to use another kind of stack and people were to know what it is... would this cause any security problems like couch would?

Jörg W Mittag

@MichaelT haha Apparently, my connection just broke. I see the buffering circle of death, the video stopped at exactly 30:04 minutes, I can even see him reaching into his pocket for his phone … but the stream just died :-D

user55340

1:40 AM

@Elizabeth If its internal, and you've got things properly checked so you're not doing any sort of injection... not a security issue.

Robert Harvey

Way Too Broad.

user55340

If you start sticking the NoSQL database externally accessible, thats a problem. If your client side code is fetching the data from the database, thats a problem no matter what the database.

Elizabeth

Got to run and pick brothers. Could I ping you later?

user55340

We're often here.

enderland

way, way too often... :)

user55340

1:49 AM

Having come from the land of Enterprise Architecture and annotations and transactions... thecodelesscode.com/case/211 is terrifying.

Robert Harvey

2:41 AM

@MichaelT Aren't you one of the biggest advocates of such elaborate incantations? Or is that @ThomasOwens?

Surely one must have reams of parchment to harness all that ceremony, so that the hordes of junior Java programmers can find enlightenment through the study of its pages.

daOnlyBG

hey guys

Robert Harvey

Well, some of us are guys anyway.

daOnlyBG

my computer won't detect the built in wireless adaptor, and I can't figure out why

(the computer I'm setting up to install; not the one through which I'm in this chat)

Robert Harvey

Bummer.

daOnlyBG

Totally. I tried updating the BIOS, tried installing the wireless driver software, etc

Well, there's always whisky

user55340

2:59 AM

@RobertHarvey I am an advocate of it when appropriate, and when I do mostly enterprise type things, yes, its often appropriate. I also have a healthy awe and fear of the power of annotations and the xml that glues them together.

user55340

The idea that a misconfiguration in an xml file instantiates the real class and the transaction logic in the wrapper that isn't there... thats a real thing that can happen. And is all too scary in that respect.

StackExchange

3:25 AM

-1

Q: I have a variable that is not defined in python GUI even though it is in the function

I am creating a GUI application to run a calculator using Python. I've followed the majority of programming from the book. When I execute this code, it gives me the name error that self is not defined. This is confusing this it was introduced in the functions. Below is my code. This has been puzz...

support code programmers-se

user55340

@StackExchange Yep, a person doubly lost there.

user55340

Fortunately, they're not complaining about us.

user55340

4:06 AM

Podcast #69 - It's Too Rainy For A Parade

Abby T. Miller on November 23, 2015

Welcome to Stack Exchange Podcast episode #69, brought to you by The Lake Erie Soda Water Company. Your host is Joel Spolsky, joined by First Deputy of Community And So Forth Jay Hanlon and Lord High King of Nerds David Fullerton. Fortunately, the beer arrived shortly after the podcast began, so this one should be pretty good.

user55340

At 35 minutes its some of the lessons learned from P.SE of old.

FizzledOut

I'm reworking my c# audio synthesizer project to incorporate better design patterns. I've got a Wav object with a List<float> for the left and right channels, and I'm really tempted to leave it as a public variable. It lets the client use the rich functionality of the List class, to no detriment I can see, so why not? I know it's a big sin, but I'm not sure because my Wav is basically a glorified struct.

TL;DR: I'm questioning the rule of OOP encapsulation for struct-like objects (that aren't structs.)

user55340

What happens when you had surround sound? And people are still accessing the raw lists you provide?

user55340

Are the lists read only for the calling? or can they go in and tinker with the values in it?

FizzledOut

@MichaelT I have an abstract Wav with two concrete classes: One is stereo and one is surround (any number of channels, stored internally as lists for the moment)

The lists are fully mutable since it's meant to be tinkered with

user55340

4:13 AM

Here's the thing... you can do it. But it means that you can NEVER change it in the future or you will break things.

user55340

Decide you want to make it an int list instead? sorry.

FizzledOut

@MichaelT fair enough, fair enough :) Should I wrap all of the useful functionality for the list, then?

(Sorry about all the questions; I just finished the Design Patterns book and I'm trying to get a feel for best habits.)

user55340

29

A: Choosing the right Design Pattern

A key misconception in today's coding world is that patterns are building blocks. You take an AbstractFactory here and a Flyweight there and maybe a Singleton over there and connect them together with XML and presto, you've got a working application. They're not. Hmm, that wasn't big enough. ...

user55340

Design patterns are tools to fix problems. Don't go around looking for specific places to put them. Its like walking around your bed room looking for things to hit with a Hammer Pattern.

user55340

You might be interested in reading the book that inspired the design pattern book:

user55340

4:22 AM

amazon.com/…

FizzledOut

Duly noted. So I guess I should my private variables with the goal in mind that if I change them, only the defining class needs to change (hopefully, anyway). I might look into that book; thanks.

user55340

@FizzledOut Yep. Thats the essence of the why of encapsulation.

user55340

Coupling (computer programming)

In software engineering, coupling is the manner and degree of interdependence between software modules; a measure of how closely connected two routines or modules are; the strength of the relationships between modules. Coupling is usually contrasted with cohesion. Low coupling often correlates with high cohesion, and vice versa. Low coupling is often a sign of a well-structured computer system and a good design, and when combined with high cohesion, supports the general goals of high readability and maintainability. == HistoryEdit == The software quality metrics of coupling and cohesion w...

FizzledOut

4:43 AM

@MichaelT Thanks for the tips. I'm going to get back to my synthesis stuff. Before I do, though, I was wondering if, uh, you knew anything about FFT and how to implement it in C#. (I've got something written by a "Chris Lomont" person that I found online, but I can't configure it, I guess.)

user55340

@FizzledOut Nope. That said, check out dsp.stackexchange.com/questions/tagged/fft

FizzledOut

Okay. See you around.

Elizabeth

@MichaelT What do you mean "start sticking the NoSQL database externally accessible"? The restful api I have in mind is to fetch the data from the database and make changes to the page accordingly.

Using GET.

Is this not safe?

Duga

6:45 AM

Welcome @Kamlesh . Your question is not a good question for Stackoverflow. You should post it on programmers.stackexchange.com . See here> stackoverflow.com/help , what type of questions are a good fit for SO. — Louis van Tonder 12 secs ago

Robert Harvey

7:03 AM

@Elizabeth What do you mean by "safe?"

Elizabeth

@RobertHarvey As in security and it's vulnerability?.

In terms of our db and app.

Ixrec

7:31 AM

@Elizabeth I think what Michael meant is client side code should not have the power to send arbitrary SQL queries to the server or anything like that

Elizabeth

@Ixrec Oh okay, that makes perfect sense. There shouldn't be any issues if I use php or any backend languages. I assume not even node.js right ... since it is js?.

Ixrec

There's nothing evil about Javascript. Node.js is a server-side framework. The important part is that the client-side request is being translated to SQL by server-side code.

so the client is only capable of (indirectly) executing those queries you go out of your way to support

Elizabeth

@Ixrec Need to keep this in mind for sure. This also applies to nosql dbs right?

Ixrec

yeah

security-wise it doesn't matter which implementation technology you use as long as the authorization, db access and other sensitive stuff is done server-side where you are in control of what's getting executed, and all access from the outside is going through some kind of API that restricts the operations clients can perform

Elizabeth

7:51 AM

@Ixrec Understood. Server-side code stay with the server ... client side code stay on the client.

Robert Harvey

More or less.

Elizabeth

Now what exactly does MichealT mean when he said "If its internal, and you've got things properly checked so you're not doing any sort of injection."? Any examples?

Robert Harvey

Do a Google search for "SQL Injection Attack"

Ixrec

I assume that's referring to building your SQL queries to prevent injection, typically with parameterization

Robert Harvey

A.K.A. Little Bobby Tables.

Ixrec

7:55 AM

e.g., this is very very bad:
`var query = "SELECT status FROM userData WHERE userName = " + nameTheUserTypedIn;`
but most databases will support some kind of parameterization API vaguely resembling this:
`var query = "SELECT status FROM userData WHERE userName = @name";`
`sqlConnection.bindStringParameter("name", nameTheUserTypedIn);`
which largely solves the injection problem, since what the user typed in will be treated as a single string literal by the query no matter what SQL metacharacters were in it.

markdown is hard

Elizabeth

This is dangerous. Scary. I had no idea that if we just wrote sql queries ... it would be so insecure. I've practice writing sql queries before and was never told to use parameters .. nor when I ask others what are some best practices I should take in order to secure my db were I told.

Thank you for pointing this out. What if I decided not to use mysql?

Using a nosql db how does this apply into preventing injection internally?

Ixrec

come to think of it I have no idea how nosql databases protect against injection

stackoverflow.com/questions/1203071/… seems relevant

as does stackoverflow.com/questions/10646098/…

if a mongo db query consists of a JSON object then I guess it would be fairly simple to build such a "query object" in code with no risk of injection, you just never call JSON.parse() on the inputs themselves...

speaking of scary attack vectors that everyone should know about

once you've got your API sorted and prevented basic SQL injection, the other really big one for many sites is XSS (cross-site scripting)

tl;dr if your site ever takes content submitted by user A and shows it to user B, then you have to worry about the possibility that user A wrote some HTML/Javascript/etc that user B's browser will execute

"Content Security Policy" is a huge help with the Javascript case (it's basically a way of telling the browser "only execute JS from X, Y, Z sources"), but here's a classic list of post-CSP injection tricks to scare you: lcamtuf.coredump.cx/postxss

and now I must go

Elizabeth

8:15 AM

@Ixrec Thank you very much and hope to chat again! :D

Lightness Races in Orbit

8:44 AM

gods are you still going

lol

I've had an entire night's sleep over the course of this conversation

StackExchange

2

Q: Favorite questions and answers of 2015

I think we spend a bit too much time talking about what's wrong with Programmers.SE, and who is or is not to blame for it. In particular, it's probably fair to say that some of the curmudgeons active close voters like me have a better understanding of what's off-topic here than we do of what's on...

discussion featured polling

Oxinabox

9:29 AM

I'm blanking on a word.
If I have a greedy algorithm, and I make a modification to it so that it is in some sense less greedy, what have I done to it?
Eg Beam Search is a _______ of normal greedy search.

Currently it is written in my work as "Beam Search is a TULIP of normal greedy search."

Thomas Owens

11:44 AM

@MichaelT (and I think @JimmyHoffa) - you guys know your licenses. Want to pop over to Open Source and answer my question?

2

Q: What software licenses are compatible with Creative Commons Attribution 4.0 International (CC BY)?

I found a page on the Creative Commons website that addresses software license compatibility with CC-BY-SA and CC-BY-NC-SA. It doesn't seem very complete to me, and it also doesn't address the other CC licenses. I'm interested in licensing text, image, and audio content CC-BY 4.0 to allow people...

creative-commons license-compatibility license-recommendation software

Duga

Questions that ask "where do I start" are typically too broad and are not a good fit for this site. People have their own method for approaching the problem and because of this there cannot be a correct answer. Give a good read over Where to Start, then address your post. — DavidG 58 secs ago

StackExchange

12:09 PM

How to Be Awesome (Part 2)

Alex Warren on November 24, 2015

How do you describe yourself to potential employers? Many developers get this terribly wrong.

Jimmy Hoffa

1:44 PM

@ThomasOwens nah, @GlenH7 knows licenses, not me.

Happy Coffee Day

Thomas Owens

@GlenH7 ping ping ^^^^

user55340

2:16 PM

@Ixrec There are different injections for each - depends on how you are sending your data to it.

user55340

For example, in couch, I could imagine an injection where you didn't url encode your data and are doing GET /db/$arg and $arg is expanded to blah\nDELETE /db/realdata - and that could be messy.

user55340

How do you protect against that? Well, you make sure you've properly URI encoded your $arg before making a request with it. Though I'd point out thats true of doing any rest request somewhere.

user55340

Its a bit harder with KVP style because you can inject in those just as 'easily' as you can into your own dictionary/map structure.

user41796

@ThomasOwens BSD-3 clause is the first one I can think of

user55340

@Elizabeth (see above). Also, any time you put a service externally accessible by the world (even if its just "can I log in") you've got to make sure it is properly secure.

user41796

2:21 PM

Reasonably certain one of the apache licenses requests attribution

user55340

There are nightmare stories about people putting a MySQL database accessible without any restrictions out there for an android app.

user55340

And someone sniffs the traffic sees a raw sql going to another server, and well, they can do that too without the app.

user41796

At the conference, I saw too many people indicating that direct access to the DB was an "okay thing to do."

user55340

Direct database also has the problem that you can't throttle it nicely... its there.

user55340

I don't know if you can say "After an IP makes 1000 login connections in the past minute, block it" in MySQL.

user55340

2:24 PM

You can with the web server and load balancer as thats what they're intended to be able to handle.

user41796

@ThomasOwens - I have to prep for some interviews today, but this link should let you figure out what you want.

user55340

Couch, I'd be a bit more comfortable with externally accessible - though I still have huge reservations on that.

user55340

there is the "make sure the data for the user is properly restricted" - something people forget to do on databases in general.

user41796

@MichaelT Fundamentally, the problem is that you're relying on a persistence mechanism in order to provide authentication

user55340

Also with couch the "query language" is JavaScript. I could easily do a DOS of it by finding a complicated 'view' and saying MapReduce everything over and over again.

user41796

2:30 PM

-1 for trying to be positive instead of focusing on the negative. Bah Humbug! — GlenH7 9 secs ago

user55340

There's just too many issues about giving the world direct database access. The database isn't designed for world access.

user41796

It really isn't, I would agree

user41796

tbh. I don't like direct access to the DB for reporting tools either

user55340

Some NoSQL databases may mitigate some of that, but there are still other parts to the database that you've got to worry about.

user41796

I'd rather spin up a mirror, regularly dump data to there, and let the reporting tools poke against that

Thomas Owens

2:35 PM

@GlenH7 Thanks. I'm looking at the TDLR legal for the common OSI licenses.

It seems like Apache, BSD, and MIT are closest. None have really strong attribution.

Apache has the strongest, though. I'm not sure what the patent stuff means.

user41796

@ThomasOwens Usually, the patent stuff basically allows anyone to use the software without paying royalties on any patents that may be on the software.

user55340

Its to avoid submarine patent issues.

user41796

And I think it creates a "chain of permission" so that downstream users don't get whammied with claims later

Thomas Owens

@GlenH7 Oh. So it's if I have a patent on software but implement it and contribute it under Apache, then I give up my patent rights to anyone using that library?

user55340

Say I release some software under BSD that I hold a patent to. And then you use it. And then I sue you for patent infringement.

user41796

2:37 PM

@ThomasOwens Not give up rights, but rather grant permission to use

Thomas Owens

I see. YEah.

So that part is only relevant if a contributor holds a software patent.

user41796

arguably two sides of the same coin, but there is a difference

Thomas Owens

If I release something under Apache that's patented and I don't hold the patent, then I'm still as screwed.

user55340

@ThomasOwens do you see companies like IBM and Microsoft not having patents on relevant parts of the code they release?

user41796

@ThomasOwens Correct, because you don't own rights to that invention

user41796

2:38 PM

but that's true regardless of what license you pick

Thomas Owens

The only thing I don't like about the four I'm down to is the lack of attribution.

user55340

@ThomasOwens Patents get funny... you might not get sued... the people who use or distribute your software might get sued.

Thomas Owens

Apache only requires that "any modified files to carry prominent notices stating that You changed the files".

Unless there's something else, I'd like to say "this is based on X by him"

user41796

@ThomasOwens You can still put that in the readme

Thomas Owens

@GlenH7 I can require that beyond the license?

user55340

2:40 PM

If I write a library that implements LZW compression (in days of old with the .gif wars), I don't get sued for just implementing it - its using it that is the problem.

Thomas Owens

Like add a rule for what I expect the attribution to be?

user41796

@ThomasOwens That's what BSD 3-clause does, yes

user41796

But it gets ugly when you start looking at the long tail that creates

user55340

@ThomasOwens when you start tweaking with the license, you lose some of the help of the license creator in (maybe) defending you.

user41796

It's like the opening of some of the books in the old testament from the bible where you get so-and-so the son of so-and-so who was begotten by so-and-so and on and on and on....

user55340

2:42 PM

If its straight up Apache you can have some expectation that the Apache foundation would help you out if there was a challenge of the license that their software is being distributed under.

Thomas Owens

I'd prefer the straight-up license. For personal use, I don't really see patents being an issue.

So it's down to Apache, BSD 2 and 3, and MIT.

user41796

And you can always request that people provide attribution without making that part of the license

user55340

If you add something that isn't legally feasible, they're under much less incentive to help because if your modification of the license is struck down it doesn't impact them as much.

Thomas Owens

True.

user41796

@MichaelT and those licenses are small enough that they don't have clauses indicating that if one paragraph is invalidated then the others still hold true

Thomas Owens

2:44 PM

I'm not sure I'll have a trademark. But doesn't that clause also protect you from saying that the author as a person endorses a derivative work? That could be handy.

user41796

Trademarks are completely different beasts

Thomas Owens

Yeah, I'm talking about the trademark clause in Apache and BSD3.

user41796

ah, ok

user41796

apache handles the "no endorsement" bit well

Thomas Owens

It doesn't mention contributor names. BSD 3 does.

I think that BSD 3 clause is probably the closest to what I'm looking for.

Jimmy Hoffa

2:47 PM

time for testing...

Thomas Owens

Thanks for your help.

Jimmy Hoffa

blech, I hate test days

user55340

A test day at Employer^^ was "pee in a cup". They didn't want people driving fork lifts to be under the influence... and that policy (like all policies) applied to the entire company. They were also chosen tactically at times - had an intern who was habitually drowsy (he was playing WoW all night) pee in a cup the Wednesday after Mardi Gras.

ratchet freak

looking for the "excuse"?

user55340

@ratchetfreak yep.

user41796

2:55 PM

@ThomasOwens yw

user55340

Then there was the Point of Sales team. Each team needed to have someone tested each month as part of random testing. For PoS, someone higher up making the "who gets tested this month 'random'" selection always picked the team lead - a mid 60s former military guy who was as straight laced as could be. He found it kind of funny.

overexchange

-1

Q: Query on Responsive Imaging

Below is the code for a form element, where I need to set a background image(like .png or .gif etc..) <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Form using css</title> <style type="text/css"> ...

html5 browser image responsive-design css3

user41796

@overexchange Please don't ask implementation questions on Programmers.

overexchange

This question is very crucial for my current assignment, Is this question still broad?

user55340

At some point there was a management shuffle (the director who was there and trying to get some changes in how devs were treated) was demoted to a manager, and another manager (who was friends with the owner) was made a manager. And put in the PoS area... and the next week every person on the team was tested within the span of two days.

user41796

2:58 PM

@overexchange It should be asked on SO, not on Programmers

overexchange

@GlenH7 This is not implementation question. For any given element targeted for any viewport, how do we decide the image size?

user55340

@overexchange the crucial / urgentness isn't a consideration about how appropriate the question is for the site.

user41796

@overexchange assign a size and be done with it

overexchange

If an answer is given for my query, do you think that is html/css code? no. am asking for, how to handle images?

user41796

@MichaelT yeah, because nothing boosts morale like invasions of privacy

user55340

3:00 PM

@overexchange That is implementation. And the question still feels too broad.

overexchange

Broad in the sense?

user55340

@GlenH7 that was about 1/4 or so into the diaspora of the point of sales team... it accelerated the rate.

user55340

@overexchange It just feels that way. That said:

user55340

> How do I decide the dimension and resolution of back ground image for this form element?

user55340

Isn't so much a design question, but implementation.

user55340

3:01 PM

Though we are hesitant to migrate questions that would likely get closed on Stack Overflow.

Thomas Owens

I think my attribution issue can be solved with the NOTICE file in Apache...

overexchange

deciding the dimension is to make it more responsive

user41796

@ThomasOwens quite likely, yes

Thomas Owens

Since NOTICE has to be redistributed.

I can also use NOTICE to ask for documentation of changes.

amon

@overexchange responsive images are simply not a solved problem. The most reasonable approach is to use a sensibly-dimensioned image by default even if its too large, then use JS to figure out the actual dimensions and substitute the image if necessary. You could also defer image loading until the page has been layouted, but that extra latency would be very noticeable to users.

Jimmy Hoffa

3:27 PM

@amon I'm not sure I agree? Why do you say responsive images should be handled in JS?

I mean, what's wrong with using CSS rules to swap them about?

Or resize them for that matter with a max-size they won't go above?

user41796

Hence: "responsive images are simply not a solved problem."

Jimmy Hoffa

@GlenH7 ?? Why do you say that? I must be missing something because it seems rather solved to me..

amon

@JimmyHoffa responsive images are about downloading an image with appropriate resolution – large enough to look nice, small enough to be fast. I can't use CSS to construct an URL with the actual dimensions, which leaves me to hacks such as media queries, of which I have a strong distaste. They are incredibly fragile, and only an approximate solution.

Jimmy Hoffa

@amon ooo you're referring to optimizing network bandwidth for it

user41796

@JimmyHoffa That was amon's opening statement about the matter

Jimmy Hoffa

3:32 PM

I was just thinking of optimizing the look, yeah, if bandwidth is of real concern then JS is going to be your winner

amon

Notably, a media query can only switch over device parameters such as viewport size, not over element dimensions (makes sense, because that would make CSS unsolvable for a layout engine)

Jimmy Hoffa

@amon true, but for different viewports you can turn on or off styles that resize or replace images. Though as you mentioned above, you can't stop the browser from demanding download of said graphics with CSS, so it is inefficient on the network resource to download multiple images that won't be displayed.

Jimmy Hoffa

3:45 PM

After a few days in Coding Font Tobi - I really like it. I had broken my terminus font install and just fixed it but think I might just go back to Tobi...

Ampt

@JimmyHoffa I prefer to not see my pixels but to each his own I suppose

Jimmy Hoffa

@Ampt eh?

Ampt

thfonts.com/coding-font-tobi

Jimmy Hoffa

@Ampt did you open terminus in the font-preview thing in windows and it looked super pixely?

Ampt

looks like that, no?

Jimmy Hoffa

3:49 PM

not at all

a lot of those preview things really don't look like the font in use

the terminus preview in windows font preview looks horrible - but when I loaded it into emacs I realized it looks awesome. Tobi same.

user41796

@Ampt GAH! My eyes!

user41796

@Rachel - I thought the question was click-bait, off-topic, excessively broad, and definitely not the kind of question I'd want to see on this site. Notice what I did there? — GlenH7 1 min ago

Jimmy Hoffa

^-- red is tobi, blue is terminus

they're very similar, tobi is a little smaller and less descript (note the J) - those are both "12" font size so with these custom fonts you have to play with the sizes to get them right. anything other than 12 in either looks terrible though so you don't get much options on sizing..

user41796

blue looks a bit scrunched

Jimmy Hoffa

they're both very similar; note the 'r' and 's' as well as [] and {}, but I prefer terminus' blockier () and thinner ;

Transcript for