jcoglan

7 ms·

1.
by jcoglan 6y ago
This is the exact thing that wasn't working and which necessitated me sending various test files with particular encodings to a colleague.
2.
Serious security flaw in the Faye pub/sub server, patches released(groups.google.com)
19 points by jcoglan 14y ago|0 comments
3.
by jcoglan 14y ago
I checked, the gem only has the Coffee source, no JavaScript. This frustrates the hell out of me -- clearly the message that you should ship JS is not getting through. When CS can do source maps, ideally people will ship the source, compile
4.
by jcoglan 14y ago
It is much less safe. PhantomJS has a filesystem API, which is fine when you consider that its primary use case is testing code you wrote and reporting the results. However, given that it is fairly easy to create a bridge between the Phan
5.
by jcoglan 14y ago
Never mind the cost. They are proposing that you run your app, with its 3rd-party jquery/facebook/twitter/google code loaded dynamically over non-SSL connections on a platform with filesystem-write-access to your server.
6.
by jcoglan 14y ago
Thanks for the suggestion in the last paragraph, very helpful.
7.
by jcoglan 14y ago
Dear Christ just kill me already.
8.
by jcoglan 14y ago
Relying on the way you happen to combine data, instead of using a function that's designed for authentication and has baked-in a safe way to combine the inputs, is a bad idea. "What if $EDGE_CASE_OF_INAPPROPRIATE_CRYPTO_FUNCTION" is never
9.
by jcoglan 14y ago
Your point about padding and length bytes is spot-on. I actually left this out of the explanation, although it's interesting, because I felt it a useless diversion: something that's safe except in an easily describable subset of cases is
10.
by jcoglan 14y ago
Possibly, although it depends on the lifetime of the link and the size of the tag (e.g. SHA-1 is 40 chars, each case requires mean of 8 guesses, so whole thing only requires 320 requests). Better to have resistance as baked into your crypto
11.
by jcoglan 14y ago
In some cases, not letting them know they've failed is nice. But the most common case to look out for is, if your auth/crypto process involves multiple steps, don't return early from it, or do anything that alters its runtime significantly.
12.
by jcoglan 14y ago
I realize it seems impossible, but it's been done, repeatedly. https://www.google.co.uk/search?q=timing+attacks+over+the+in...
13.
by jcoglan 14y ago
Not the best, but most string comparison methods are designed to fail as soon as possible, which is not appropriate for this use case. Compare the entire input, or use some misdirection to destroy the relationship between correctness and
14.
by jcoglan 14y ago
You'd think that, but it is possible. Google "timing attacks over the internet".
15.
by jcoglan 14y ago
The timing attack is if you check the tag, that fails, and then you don't do any further request processing. This shortens the request time. It depends quite a lot on what you're actually doing with the message, but in general you want to
16.
by jcoglan 15y ago
As someone who runs a lot of his own open-source projects (see http://jcoglan.com ), and occasionally contributes to others when I find bugs, the biggest reason I do it is to learn things. Not just to learn programming, and various problem
17.
by jcoglan 15y ago
This needs to be at the top of the thread, rather than all the formal-logic-obsessed debate-club navel-gazing currently sitting there.
18.
The Science of Insecurity(youtube.com)
2 points by jcoglan 15y ago|0 comments
19.
by jcoglan 15y ago
Two variants of Scheme, with shared libraries: http://github.com/jcoglan/heist http://fargo.jcoglan.com If it weren't for Lisp it would never have been so easy for total noobs like me to get into language hacking.
20.
by jcoglan 15y ago
I've been thinking about this. I might try out making all the primitive functions understand promises. So not lazy evaluation per se, but having the core library transparently deal with asynchronous values. Maybe monads would help but that
21.
by jcoglan 15y ago
I'll fix this so that invalid expressions are reported and car and cdr of () are errors.
22.
by jcoglan 15y ago
Oh, no offense taken. Thanks for pointing out other lisps, I should check them out for alternative ideas.
23.
by jcoglan 15y ago
With regard to maturity, Fargo is one week into development. I'm not even sure if its just a quick hack to show off an idea or if it will become a production language. Certainly I have a lot to learn about compilers and VMs before that happ
24.
by jcoglan 15y ago
I was going to do call/cc but fibers are cheaper. The implementation is very similar, but because fibers can only be resumed once from the last yield you don't need to copy the stack when yielding and resuming. They also require the user to
25.
by jcoglan 15y ago
Songkick (YC'07, London) is hiring again. We're a small company (about 20 people) that's working to improve the live music scene for everyone involved. We help fans track their favourite artists so they never miss them live, and we help art
26.
by jcoglan 16y ago
I wrote a Scheme in Ruby that has macros last year: http://github.com/jcoglan/heist . It's an interpreter, not a compiler, and is extremely dynamic: all functions, macros, special forms are just treated as function calls by the parser. Mac
27.
by jcoglan 16y ago
The rationale is that I wanted to learn how to write an interpreter, particularly some of the more challenging parts like tail recursion, macros, continuations and laziness. It's in Ruby because that's what I know best; it's not intended fo
28.
by jcoglan 16y ago
Apologies for the formatting screw-up. The deep_copy function is here: http://gist.github.com/407741
29.
by jcoglan 16y ago
You're missing a few details, especially around "primitive" data types. There's not really any such thing in Ruby - everything is an object, but some objects - numbers, booleans, nil - are immutable. When you copy an object, all you do is c
30.
by jcoglan 17y ago
Pimping my own projects here, but have a look at http://jsclass.jcoglan.com/packages.html and http://he.jcoglan.com

More ›