The Nineteenth Byte

Themoonisacheese

08:00

mousetail's idea is sound:
by default, store what you need in a session.
have some way of exposing the user to their session cookie value
have some way on the client of pasting a session cookie value and that becomes their session cookie for that browser as well

192927376337929292283737373773

Wait.

We can hash the session cookie's content

And do that.

It is really really really rare that two session cookie's would equalize.

mousetail

...what purpose would that serve?

Themoonisacheese

the hash isn't more secure than the cookie itself

mousetail

^

192927376337929292283737373773

Oh.

But the hash is more sehre.

mousetail

08:01

The session cookie value is just a randomly generated ID

Themoonisacheese

and session cookies should be guaranteed to be unique by your platform

mousetail

Hashing a random number just creates another equally random number

192927376337929292283737373773

But more RANDOM!

mousetail

Technically less random since there is a possibility of collisions but for practical purposes about the same

192927376337929292283737373773

Okay

I am gonna go with the session cookie idea.

Themoonisacheese

08:03

@192927376337929292283737373773 note that the session cookie just contains an identifier, that the server uses to find what data it should load. the client never holds any information beyond this identifier

mousetail

Another option is to create long random account IDs and use those instead. Actual user data is in the database. Then the users session data just stores what their account number is. This would require less abuse of the session system while being equally secure

From a users perspective it's exactly the same

Themoonisacheese

where is session data stored when you use PA anyway?

mousetail

Flask has different backends, but I think by default it creates a folder with a file per session

Themoonisacheese

oh

mousetail

And occasionally deletes old ones

So it might be better to use the DB instead

Themoonisacheese

08:06

it dumps a signed cookie on the user?
https://stackoverflow.com/questions/52677755/where-does-flask-store-the-sessions

192927376337929292283737373773

@mousetail that's just accounts. But instead of usernames we have account IDs.

And actually works.

mousetail

Yes

And no passwords so it's more convenient

Or actually no usernames, only passwords is more accurate

Themoonisacheese

^

192927376337929292283737373773

And what happens when someone changes browsers or devices?

Do they just use the account ID?

To get back?

mousetail

Yes

192927376337929292283737373773

08:07

I see.

Themoonisacheese

either they stored their ID or they get a new account

192927376337929292283737373773

Will implement.

There is a thing.

mousetail

Since the passwords are randomly generated they can't be insecure

192927376337929292283737373773

Where someone might try to login.

But when they enter a new account is created.

Before they login.

So we get these unique dead accounts.

But adding another prompt at the start might be egregious to new players.

mousetail

You can have a scheduled task or something to occasionally delete accounts that have 0 points

192927376337929292283737373773

08:08

That was exactly what I was going to say.

mousetail

In practice there won't be that many, it's very rare for people to switch browsers

192927376337929292283737373773

If they have contributed zero points in like a day delete.

mousetail

A prompt seems unnececairy

192927376337929292283737373773

That works.

lyxal

What if you have a dead account with >0 points?

192927376337929292283737373773

08:09

@mousetail YEP.

lyxal

Or if you want to sync across computers/devices?

192927376337929292283737373773

Well on syncing,

just use your account ID.

mousetail

You can sync by just copying your user ID to the other device

192927376337929292283737373773

And on other dead accounts,

Themoonisacheese

@lyxal realistically just let them be there will be less than 1k

192927376337929292283737373773

08:10

I think we can upper it.

mousetail

I wouldn't worry about dead accounts with points, there probably won't be that many of them

192927376337929292283737373773

So your account is deleted if you go inactive.

But the actual points are global.

So nothing effects the point.

Themoonisacheese

if it were me i'd jsut not care

192927376337929292283737373773

Just that you need a new account ID.

mousetail

You want people to be able to come back after months

Themoonisacheese

08:11

we're talking less than 1kb/user

192927376337929292283737373773

@Themoonisacheese it's good to think of these,

because it creates helpful practices.

This is a learning project afterall.

Themoonisacheese

fair enough

lyxal

What if I use private mode and no cookies are saved, and I don't copy my user id?

Themoonisacheese

that's kind of on you, no?

192927376337929292283737373773

Well.

mousetail

08:12

I wouldn't worry about that case

lyxal

@Themoonisacheese not if I'm new to the site and it's my first time

192927376337929292283737373773

That's really rare.

mousetail

You can't expect your data to be saved if you explicitly do everything to prevent saving of data

8

192927376337929292283737373773

And wait.

When you enter the first time you automatically get the account ID.

It won't get saved to cookies.

So that means if you refresh or something you would lose it.

Does that work?

Themoonisacheese

so you don't get an account until yo uactually do something?

192927376337929292283737373773

08:13

Because then you can copy it and not lose your account.

mousetail

Won't you generate an account ID and cookie during the first page load?

192927376337929292283737373773

Yeah.

But the account ID still generates even if the cookie doesn't.

Themoonisacheese

i fail to see what that achieves

192927376337929292283737373773

Actually better thing would be.

To stop influxes of thousands of new visitors who don't even play,

we can just require you to at least get one point to register an account ID.

That way we automatically eliminate a lot of dead accounts.

Themoonisacheese

on the surface this works

192927376337929292283737373773

08:15

@lyxal well the thing here is you explicitly said you don't copy it

So that's on you.

Themoonisacheese

but now you've moved account creation to after a specific thing happens, which is you know, fine, except that if you ever create something else that requires you hold state about a user, you also have to create an account there

lyxal

@192927376337929292283737373773 I might not know to copy it

By accident

192927376337929292283737373773

@Themoonisacheese you're not getting it,

Themoonisacheese

this is fine as there isn't much you can do without clicking the main button at least once, but this is now a thing you have to think about

192927376337929292283737373773

it auto creates you account when you do any action.

And the only (and when I get further dev first) action is harvesting points.

mousetail

08:17

I remember when I worked at Colonist.io we banned a few random cities in Canada because they where generating too many temporary accounts

There was some scrapping company there but we banned the whole city

192927376337929292283737373773

Woah.

Themoonisacheese

yes, what i'm saying is "do you think you can keep track of what every action is, to remember to create an account on each of them"?

192927376337929292283737373773

Well there is only one first possible action.

Which is harvesting a point.

Themoonisacheese

yes, currently

192927376337929292283737373773

I don't plan to change the start game.

They say if it isn't broken, don't fix it for a reason.

mousetail

08:18

@Themoonisacheese Every action requires an account right? So you can have a function like get_or_create_account() that you use every time you need the account object

Themoonisacheese

mmh that's fair enough

mousetail

That way it will scale easily to every possible action

Something like changing your username or something like that could also count as a first action

192927376337929292283737373773

@lyxal that's just on you.

Themoonisacheese

incidentally this is how sessions work in php

192927376337929292283737373773

It would be on the FRONT PAGE.

@mousetail yeah.

But again.

Okay.

I guess if you do anything that makes your account "public",

you need to register a nickname.

Oh I have an idea.

Basically in the planned activity log,

by default we could have "anonymous player".

And if you choose a nickname,

it will display that instead.

mousetail

08:21

Or just generate a random name for them

So you don't have a million anonymous players

192927376337929292283737373773

Hmm.

I honestly just favor the anonymous player method more.

That seems unnecessary sort of.

Themoonisacheese

i agree that it's not necessary

but it's also fun to have default names from adjective+noun lists

192927376337929292283737373773

Well.

I'll see.

So,

I'll be storing this in MySQL.

So the database schema is sort of like,

each Account has an ID and Contributed Points.

And when we display the global,

we would sum all contributed points.

Though that seems sort of memory intensive.

We could have a separate value too,

which is also added to when contributed points are added to.

To minimize server usage.

Well fun fact I have used 0% of my CPU seconds so far.

But it's going to get more complex I imagine.

@lyxal hey can I request something?

mousetail

Why do the points have a decimal point?

192927376337929292283737373773

Oh formatting thing.

I can fix it now

Let me see.

Themoonisacheese

08:30

@192927376337929292283737373773 this is the correct way of doing it as far as i can tell

192927376337929292283737373773

Yeah.

Much easier than doing sum calculations.

Each time you need to fetch.

Wait.

Themoonisacheese

yes. the alternative would be to say, every day at midnight, sum the total and use that for future sums but that's added complexity that won't help you much

192927376337929292283737373773

Yeah.

Much easier to just do one more addition.

mousetail

You could take the sum on startup and then increment the value in memory potentially, but yea just storing in DB is probably easier and less error prone

192927376337929292283737373773

Yeah.

Okay the formatting thing is fixed.

Now I just need to migrate schema.

mousetail

08:35

You using Alembic?

192927376337929292283737373773

That seems unnecessarily complex.

I am just going to drop the existing DB.

mousetail

At least you don't need to deal with migrating the schema manually again

You can test your migrations locally then apply them in prod

192927376337929292283737373773

So I am going to disable the game for a while.

Yeah

So on account IDs.

Is there any specific way I should generate one or anything?

It should be secure I guess.

Any builtin functions or anything?

Themoonisacheese

docs.python.org/3/library/uuid.html

mousetail

4

Q: How do I generate a cryptographically secure alphanumeric string in Python?

I'd like to generate alphanumeric authentication tokens in a cryptographically secure way on my Google App Engine Flask server. How can I go about doing that?

192927376337929292283737373773

08:41

Hmm.

mousetail

UUID would be fine too

192927376337929292283737373773

uuid is builtin so we're going with that.

mousetail

You need to be very careful not to expose the ID to other clients anywhere

192927376337929292283737373773

Yes.

mousetail

Might want to generate a additional public ID for when you need to refer to other players

192927376337929292283737373773

08:45

As I said nicknames.

So need to have a 36-letter string.

mousetail

Nicknames can change

192927376337929292283737373773

Since that seems to be the length of uuid4.

@mousetail good point

Actually, I am thinking of more permanent usernames.

/nicknames.

mousetail

The the UUID module to generate the UUID

Please allow people to change their nicknames

192927376337929292283737373773

Okay.

Fine.

But it takes 14 days for it to fully change.

And within that time it has a warning.

That this user's name will change.

mousetail

Why?

192927376337929292283737373773

08:47

Like how on SE you can change your username once monthly.

mousetail

It's just for the leaderboard, it doesn't matter

192927376337929292283737373773

@mousetail so it isn't abused?

mousetail

I don't think that's a big issue

192927376337929292283737373773

@mousetail well.

I can imagine I might need more uses for it later.

mousetail

I've had entire fun chats with people by changing my username over and over on different games

192927376337929292283737373773

08:48

Hmm.

mousetail

It's a fun feature

192927376337929292283737373773

So we have one private ID, one public ID, and one username?

mousetail

I'd call it nickname, not username

192927376337929292283737373773

I see

...is probably my favorite phrase.

Now I think of it.

Alembic might be useful.

Because I might end up changing the schema a freaking thousand or more times.

At this rate.

But for now we have one private ID, one public ID and one nickname.

So I am going to use uuid4 for both of them..

And we can cap the nickname length at like 32 characters max.

mousetail

Sounds solid

192927376337929292283737373773

08:52

So our private ID will be our primary key then.

One question: What does db.Column mean?

mousetail

It's a column in the database

192927376337929292283737373773

I hate camel case.

Whoever invented it should burn in hell.

There we go.

And then we have another table which stored global things.

So like global points or dimensions.

emanresu A

09:58

HNQ do be HNQing

Redz

@emanresuA ...is there a link to this question?

mousetail

2

Q: If inflation/cost of living is such a complex difficult problem, then why has the price of drugs been absoultly perfectly stable my whole life?

The prices of all the different drugs that I use have not changed at all, in the 46 years I have been alive. (Which means, that the price has consistently gone down, if adjusted). Please explain how Cartels manage to avoid inflation problems but governments can not. Remember. Absolutely perfectly...

inflation

emanresu A

(warning: slightly cursed question)

You can see all HNQs on stackexchange.com/questions and stackexchange.com/questions?page=2

Redz

ah got it

lyxal

12:51

@192927376337929292283737373773 what is it?

Unrelated String

13:29

@att Also, if the package does get delivered before the form gets processed, I feel reasonably confident that it's not a package that elderly retirees would want to keep LMAO

Rydwolf Programs

14:25

@UnrelatedString Wait don't they not even do CoA for packages or to other states? USPS really going above and beyond to give you a shitty experience lol

Unrelated String

Wait really

LMAO

I know you can pay for extra time on the forwarding order so maybe that also upgrades it somehow

Rydwolf Programs

Maybe yeah

Rydwolf Programs

15:57

I sure hope I can get a spot

@emanresuA I figured this would be about pharmaceuticals and price controls lmao

Up until recently I'd have guessed a lot of the stable price would just be due to cash being used, though I think cashapp is the main way now

(I wouldn't know personally, but some of my friends/former roommates bought a lot of weed lol)

Whoa nice, that hardware security class I was considering taking instead of poli sci is in the same room as the class I already have right before it

Which is a crazy coincidence given how big Wean Hall is (the building where the classes are)

And how different the subject matters are

Rydwolf Programs

16:21

I hate when they make cool loopholes in privately-made rules illegal

Like check kiting

Like instead of learning how to do proper game balance the banks just run home crying to the government when people do anything clever

Don't get me started on insurance companies (relevant xkcd exists)

Rydwolf Programs

16:36

It's too bad they haven't handed out our Air Force uniforms yet, we're required to wear them all day on Thursdays meaning I'd be required by the military to show up to the student diversity center's welcome event for LGBTQIA+ students in uniform (which would be hilarious)

New Posts

16:48

0

Q: Encode a VarInt

Similar question to my previous one, but in reverse. This time I want you to encode an integer into a VarInt. Background: I'm not going to assume everyone's seen my previous question, so here is a little background as too what a VarInt is. A VarInt is a type of signed integer encoding of variable...

code-golf integer encoding

mousetail

I'm inspired to create a JQ inspired golfing language

I might name it GQ

So far I have 11+r1+1+r with output 0, 1, 0, 1, 2

Oh and it transpiles to JS for some reason

The only number literal supported so far is 1

Unrelated String

Oh yeah that reminds me of a terrifying idea I had in the shower three nights ago

mousetail

Hmm I thought because of RPN I could get away with just having ] and no [ builtin but it seems you can't actually unambiguously parse where the [ should go

Maybe it's possible with just [ and no ]?

Unrelated String

Not going to share any details quite yet, but the working title is either Peanut Butter or Demiurge

mousetail

Otherwise there is no way to distinguish between 5[rr] or 5r[r]

Unrelated String

17:04

Don't know enough about jq to know why that's a problem, but it should definitely be possible yeah

I really ought to learn jq some time

It seems so nice

mousetail

5[rr] would output [0, 0, 1, 0, 1, 2, ...] (flattened), while 5r[r] would output [0], [0,1], [0,1,2], ...

[5rr] would be equivalent to 5[rr] since 5 yields just one value, so in that case there is redundancy, not good for golfing

Unrelated String

So you could erase the distinction by needing a separate flatten instead

mousetail

Yes, but implicit flatten is very integral to what makes JQ interesting and unique

Unrelated String

Ahhh

mousetail

There are a lot of buitins that yield either 1 or 0 values for errors, which can be very elegant for some problems

Unrelated String

17:07

Is there some kind of pure/wrap-in-singleton you can use to effectively suppress it, then?

mousetail

Yes, that's the purpose of []

Unrelated String

...ah :P\

This whole time I was trying to parse it as indexing LMAO

Yeah you probably do need to keep both braces, and/or have group-n stuff that works like them

Unrelated String

17:30

@Ginger Okay thankfully I don't seem to be the only person who's struggled with this :P

Ginger

that's good

Unrelated String

Unfortunately they don't have much advice because they just genuinely never did it before getting a new therapist

But it's not like that isn't an option

Ginger

aren't there therapists who specialize in gender stuff?

Rydwolf Programs

17:50

How the hell did I just mix up Karl Marx and Frederick Douglas

Seggan

@192927376337929292283737373773 ...

i love camelCase

Rydwolf Programs

Camel case does kinda suck imo

But I reserve hell for slightly worse offenses

Depending on your IDE one of my two main complaints with it can be fixed though

Seggan

my main gripe with snake case is how long _ is

like aReallyLongFunction is so much nicer than a_really_long_function

Unrelated String

@RydwolfPrograms They've got a weirdly similar vibe appearance-wise if nothing else

@Ginger Already found one and can ask my university for a full list of referrals

Thinking of maybe seeing my current therapist every other week and alternating with a new one

Ginger

why do websockets not have a way to reconnect :|

Unrelated String

18:00

But it still feels like this is a bottleneck in other things we've been working through anyhow

Ginger

handling disconnections from the vc websocket is going to be so annoying lmao

this is why socket.io exists

Unrelated String

@Ginger Oh. Wow yeah good luck

Ginger

18:13

I'm just going to use socket.io

Unrelated String

18:25

Understandable

...Ooh wait I hope this isn't too weird of a question but @RydwolfPrograms what textbook is your Russian class using?

If it's Этажи... my condolences

Ginger

ah yes

att

what's wrong with that book

Seggan

id chime in with my experience but unfortunately my only russian textbook was Азбука :P

Rydwolf Programs

19:10

@UnrelatedString not sure

> Beginner's Russian with interactive online workbook

Anna Kudyma, Frank Miller, Olga Kagan, ISBN-13: 978-0-7818-1251-1

Rydwolf Programs

I hate is so much when surveys just ask the same question with slightly different wording like a half dozen times

Had to take one like that a minute ago, finally just chose "somewhat" for everything then emailed the researcher listed to let them know they should ignore my data lol

Unrelated String

19:48

@RydwolfPrograms Don't think that's it

So yeah nice :P

Though come to think of it Этажи would probably not be as bad for you as it was for me at least

@att This might also be a bit of a teaching style difference and/or just inherent to intermediate level, but we switched to it for 201 and most of the exercises were straight up creative writing even though they were notionally still just to practice grammar/vocab that we were learning

Okay this is not nearly fleshed out enough to hide anything about, so basically
The idea is "dyadic Jelly" as its own language, designed from the bottom up to be slightly more usable in general but also more awkward in other ways

Ideally, with a builtin set that makes the optimal way to derive constants depend highly on invariants about the input

Seggan

20:35

cursed idea: a database that is stored by literally just storing each and every sql query ever run on it

Ginger

blockchain

or git I think

Seggan

git is not a database fortunately

Ginger

not with that attitude

Seggan

git'); git revert HEAD~100000 --

5

good enough?

Ginger

beautiful

att

20:56

@UnrelatedString uh what's wrong with that

Unrelated String

Chameleon challenge :P

But it's also even harder than the sum of its parts, since you have to write within the constraints of your intermediate level grasp of the language, on top of simply writing and using your intermediate level grasp of the language

And some of it can even require indeterminate amounts of research that you aren't actually expected to be good enough at the language to do without scraping for sources in English or MTLing it

Rydwolf Programs

Not me misreading the schedule and showing up half an hour after an event I was trying to go to ends (wouldn't have mattered anyway since I was in class lol)

Unrelated String

lol

Bbrk24

22:07

@Seggan git revert "$(git log --oneline --reverse | head -n 1 | cut -d' ' -f1)"

Rydwolf Programs

22:38

Well, I emailed my advisor, trying to convince her to let me take both courses and exceed the limit on course hours for freshmen lol

Unrelated String

Good luck LMAO

Both getting that approved and managing it if you do

Rydwolf Programs

I think anyone who looked at this situation quantitatively would not only deny the request but involvuntarily commit me...the maximum for first years is supposed to be 52 units (17 and a third hours), I'm currently at 58 due to some loopholes, and this course would put me at 70

Unrelated String

Oh

Rydwolf Programs

For reference my prof made the sucking-air-through-teeth noise when I said I was taking just 55 units this semester lol

Unrelated String

PFFFFFFFFFFFF

Rydwolf Programs

22:41

But on the other hand my time management is good on account of the fact that if the conditions are right, when I lock in, I lock in

Unrelated String

If that's all you're counting on

Rydwolf Programs

Those conditions are something I still haven't quite pinpointed but so far CMU seems to be delivering them

Unrelated String

Be VERY careful

Like it sounds like you can tap it more reliably than I ever could but that is still courting burnout

Bbrk24

Yeah seriously

Rydwolf Programs

I'm like, broken though. I enjoy work and hate free time

Bbrk24

22:44

I never took more than 21 credit hours in one semester and that was plenty

Unrelated String

That's what it feels like until that breaks

Rydwolf Programs

Maybe this is just a "I'm never gonna get hit by lightning out here" moment on my part, idk

Unrelated String

Yeahhhhhhhhhh

Rydwolf Programs

But I feel pretty in-tune with my like, mental health I guess

Unrelated String

You're still in a radically different environment from high school

And burnout is the kind of thing that you can't really get a feeling for until you've hit it

Rydwolf Programs

22:45

I guess, but I've also been switching between radically different environments quite a bit recentlky

And the difference between high school when you live in an apartment and college isn't nearly as big as high school when you live with your parents and college

Anyway gotta go to a recitation for fucking chemistry (that is now its course title in my head, "09106 fucking chemistry") o/

Unrelated String

What do you currently know about the overall work load for each of your classes?

Because frankly how tenable this is relies a LOT on that

"Enjoy" the recitation :P

But yeah credit hours are honestly not a very good proxy for the amount of time you're going to be spending actually doing things and using effort since AFAIK they tend to just be based on lecture times

@RydwolfPrograms The biggest difference here is just the way the work is patterned

Bbrk24

For lectures it’s just hours in class per week, and for labs where I went to college it was 1 hour of credit per 3 hours in lab

Unrelated String

You have to organize more for yourself, you're going to have a larger variety of kinds of work, you're going to have a bunch of extremely important exams at the same time of year

4

It's all very unreliable

And don't even think about trusting what other students say about what is and isn't a hard class LMAO

ATaco

Make sure in advance you have a source of Income. I made that mistake

Transcript for