1. 8

    Still in the midst of reading this, but just have to say: worst website background ever

    1. 4

      Firefox’s reader mode is a lifesaver here.

      1. 2

        Yes, I had to use that too. I tried to read it the way it was displayed but it was too distracting

      2. 2

        I removed the background and background color via inspector which makes it a lot easier to read.

        1. 1

          I’ve done enough accessibility work on the web to announce: this site’s contrast is great, but its presentation is horrific.

        1. 2

          I feel like this is being blown way out of proportion. Mastodon is open source under the AGPL. Hiveway’s fork immediately changed all intellectual property (the logo, the name) because I would assume those are trademarked (see Firefox forks: Iceweasel, Waterfox, etc).

          Forking an open source project to make your own is par for the course. As long as the project gets licensed under the AGPL, I see absolutely no problem with this.

          1. 4

            I think the bigger issue here is how far the Hiveway people have gone to ensure that all connection with the original Mastodon project, including the authorship of individual commits, was removed. Does that violate the AGPL? I have no idea, IANAL etc, though I suspect it does. But, even if it doesn’t, that is a deeply shitty thing to do.

            1. 1

              including the authorship of individual commits, was removed.

              If that’s the case, then this is the part that should be highlighted. I, too, would question how the AGPL would affect this. IANAL either, but I think that removal of the .git directory from a fork would be an interesting topic of discussion for AGPL cohesion. Personally, I believe that since it’s part of the project and just a bunch of files, it’d be completely valid to remove it as long as you keep previous attribution to the parent project - otherwise removing any arbitrary files from the project could be a potential violation.

              EDIT: of course after typing up this comment I realize that removing a LICENSE/COPYING file and all attribution of the previous license would also be a violation. Hmmmm, this is definitely not simple.

            2. 3

              Just because it’s technically legal doesn’t mean it’s not a shitty thing to do.

              1. 2

                I still don’t see how this is shitty. If you’re going to put your source code on the web with a license to copy it, then you absolutely must expect someone to take it and make it their own. I personally see them removing indication of Mastodon as a way of keeping themselves away from legal trouble involving trademarks.

                1. 2

                  Intercal is right. It’s eye-roll inducing for sure, like of course some ico-idiot is going to make a quick buck off of mastodon, but who cares? The investors are the ones getting scammed. And they’re the ones not paying attention anyway.

            1. 3

              I’m assuming you’re going to try to get wycats on at some point? Considering he’s been involved with at least 3 different package managers (bundler, cargo, and yarn are the 3 I know of), it seems like he would be a great interview.

              1. 3

                Yep, he’s already on the list of people to interview ?

                1. 3

                  Also, the SolusOS guys recently did a lot of work with the tool they use to make packages for their package manager, so they might be worth talking especially wrt the producer-side of package managers

                  1. 3

                    Will add them to the list, thanks!

              1. 6

                For example, my SAP analysis web interface uses three different product group structures, as the required amount of details varies between user stories. Go forces me to maintain the same code in three different places.

                I would really like to see an example of this, if anyone has one. I can think of a bunch of alternative ways to structure “similar but different” code paths and I’m curious why they didn’t work for this author.

                1. 2

                  Yea, I usually count myself among Go’s detractors but this point even befuddled me. I think Go has it’s share of code-reuse issues but it seems like this particular issue would be easily solved by embedding data members or a better use of interfaces.

                1. 1

                  Is it just me or does this basically boil down to “test all the control paths in your models?”

                  1. 4

                    I see this as a temporary hype. If it is still standing strong in a few weeks, why not? But not after a few days of hyped articles on the topic. This is not judging the language, but we have these meta-posts very often where people want to promote their favourite programming language with a special tag.

                    1. 6

                      IMO, the fact that Google is now officially supporting it for android development is a pretty significant sign that it isn’t going away anytime soon.

                      1. 5

                        I see this as a temporary hype.

                        Counterpoint: if you search by stories + newest for Kotlin, there are 3 pages of “Kotlin” stories. Roughly 3/4 of the first page of results has “Kotlin” in the title. The oldest story of the first page that has “Kotlin” in its title is 3 months old. Understanding that Lobste.rs moves relatively slow, I think it’s fair to say that people are definitely posting about the language SOME of the time on here.

                        Now, because it’s recently gotten the “officially supported on Android” greenlight is probably what’s giving it temporary hype. But, I’d argue that Lobste.rs is still going to get a steady stream of Kotlin-related stories, and I’d like to have a tag for that.

                      1. 2

                        Why clickbait is better than whatever honest title you’re using?

                        Honestly, the article is good, but I am sick of click-bait and disappointed to see it on lobsters landing…

                        1. 5

                          Maybe it helps if you’re familiar with the author? I’m pretty familiar with Yegge’s writing, so as soon as I saw his domain on the entry I understood the title to be tongue-in-cheek

                        1. 10

                          It’s time to start using a modern programming language

                          How long does “modern” last? Does that mean I should already plan on moving off Kotlin in a year or two?

                          Kotlin isn’t some weird language born in academia.

                          Ugh, this trope.

                          Its syntax is familiar to any programmer coming from the OOP domain, and can be more or less understood from the get go.

                          Maybe, but semantics are really quite important so hopefully its semantics can be understood from the get go.

                          Not a very compelling article, IMO, but it is on Medium so about what you can expect.

                          1. 11

                            I’ve lost the original source so I can’t properly attribute the joke, but:

                            they’re Medium posts because they’re neither rare nor well done

                            1. 9

                              Television is a medium, so called because it is neither rare nor well-done. – Ernie Kovacs, American comedian

                              1. 2

                                Ah, so the joke I heard was plagiarized in the first place :) Thanks for the info!

                          1. 2

                            This reminds me a little of the optional chaining and forced unwrapping syntax sugars recently added to Swift.

                            1. 3

                              I can’t find the link now, but I remember one of the rust core devs explicitly saying that swift was the inspiration for the question mark syntax.

                              1. 2

                                That was “if let”, actually. ? Is similar but IIRC has some differences.

                                1. 1

                                  Ah, my mistake

                            1. 6

                              Author here, I’m happy to receive feedback, comments and corrections (content, grammar, typos, …). Thanks!

                              1. 2

                                I think there is a typo in the “The Bad: Type Inference” section. As written, it is:

                                val nums4: List[Double] = List(1, 2, 3) // compiles
                                
                                val nums5a = List(1, 2, 3)
                                val nums5b: List[Double] = nums4         // fails to compile
                                

                                I believe it probably should have been

                                val nums4: List[Double] = List(1, 2, 3) // compiles
                                
                                val nums5a = List(1, 2, 3)
                                val nums5b: List[Double] = nums5a         // fails to compile
                                

                                or else I don’t know what nums5a is supposed to be there for.

                                1. 3

                                  True, thanks! Fixed!

                                2. 1

                                  Looks like a typo here: “In response, it was tried to put band-aid around it.”

                                  1. 2

                                    You are right, the grammar of that sentence sounds weird … do you have a suggestion on how to improve it?

                                    1. 2

                                      How about, “The response was a band-aid.” or “In response, a band-aid was applied.”

                                      1. 3

                                        Thanks, fixed!

                                  1. 2

                                    If you didn’t scroll all the way past the code, you should, and read antirez’s short blurb there. I thought it was a great little story, and I’m glad he shared it & the code.

                                    1. 1

                                      Ah, I’d completely forgotten about sublevel. I used it for a while, it is nice. Looks like I stopped using it 2.5 years ago o_O

                                      1. 3

                                        Neat. Now, who to follow?

                                        1. 4

                                          All aboard the follow train - https://mastodon.social/@mulander

                                          1. 2

                                            followed :P

                                            1. 2

                                              Followed. I just set up https://mastadon.social/@munyari

                                              1. 2

                                                I wondered why this link wasn’t working for me until I saw “mastadon” should be “mastodon” :P

                                                1. 1

                                                  I, too, am on this network, at https://icosahedron.website/@mjn

                                              2. 4

                                                Something that I think would fit the federated model well, if @jcs wanted to do it (or let someone else do it with the domain), is if there were a lobste.rs server. In addition to being able to follow individual people who use any federated server, the client also supports viewing a global firehose (all federated servers) or a local firehose (just this server). The latter, on smallish servers, can provide a kind of IRC-like community, while also interoperating with the broader Twitter-like usage.

                                                I think people are still working out what the social configuration of a federated system would look like, though. Some tech exists, but a lot is still up in the air.

                                                1. 2

                                                  I’m https://mastodon.social/@stevelord if anyone wants to follow me. Mostly posting AVR development and security stuff.

                                                  1. 1

                                                    I’m there at @NinetyNine.

                                                    1. 1

                                                      I’m there at pnathan.

                                                      My Twitter tends to be a blend of liberal retweets, bad jokes, and occasional tech remarks.

                                                      I also have some kind of other gnu social account I forgot somewhere, but it wasn’t interesting enough there…

                                                      1. 7

                                                        Considering that I trust digitalocean more than my home ISP to not sell my browsing history, I might install this and start piping some of my home traffic through it

                                                        1. 6

                                                          I think this is spot-on. I love Rust, and write it as often as I can, but sometimes members of the RIIR crowed can get a little carried away, and imo, actually damage the credibility of the rust community by advocating for rewriting everything-but-the-kitchen-sink in rust.

                                                          1. 24

                                                            That last largest group running a “IN RUST WE TRUST”-viral thingy was The Register. What should we do in this case? They are not “the Rust community”. There’s a notable bunch of people who never tried Rust in practice who root for this. It’s the more annoying part of my work to them that doesn’t make any sense.

                                                            You may note that the Rust project itself takes a very concious non-agressive stance on this issue (putting down other peoples work is generally frowned upon). We cannot do much more then this.

                                                            Re-implementations are obviously an interesting thing, but Daniel puts it right: he’s the maintainer of curl, not of of a curl-compatible library. He lays out the practical points very right. He also welcomes re-implementations in that post , which would be the very FOSS way.

                                                            Also note that he literally mentions Rust once, in the intro, I don’t think that’s his beef.

                                                            The kitchen sink, I’d rewrite though. Mine’s leaking again.

                                                            1. 4

                                                              You may note that the Rust project itself takes a very concious non-agressive stance on this issue (putting down other peoples work is generally frowned upon). We cannot do much more then this.

                                                              It is a rough place to be in, and you have my condolences. :(

                                                              There’s got to be some way of saying, though, “Hey, if you’re doing this, please please please knock it off.”

                                                              1. 3

                                                                I think my comment was poorly worded, in that I don’t think “the rust community” has done anything wrong, or not-done something “they” should have done. My fear is only that I’m afraid the RIIR-crowd, when viewed from outside the community, might give others cause to negatively stereotype “the rust community,” though this would be unfair. I also agree that Daniel doesn’t seem to have any beef with rust or the community, but I definitely was thinking of the RIIR crowd while reading Daniel’s post. This is my own fault, and I didn’t mean to ascribe any motivations to Daniel that weren’t actually there.

                                                                1. 4

                                                                  Okay, I can see that. I must say that my biggest fear for Rust is it being pushed into too many places to soon, in a too cargo-culty matter. That will might cost us dearly.

                                                                  Luckily, I know that most community members in positions where they could actually make such a push are really careful about that.

                                                              2. -3

                                                                I assume they’re advocating to rewrite the kitchen sink too.

                                                                1. 5

                                                                  This bit of sample code jumps out at me (as a total crypto noob, pretty nervous about writing any crypto-related code):

                                                                  $nonce = random_bytes(24);
                                                                  $ciphertext = sodium_crypto_box($plaintext, $nonce, $message_keypair);
                                                                  

                                                                  Would it make sense for a safe-defaults-oriented crypto api to generate $nonce by itself, and return it along with the ciphertext? That way I can’t screw it up by re-using it or using something predictable.


                                                                  Meta: I can’t stand “first” claims. Title suggest: PHP 7.2 Adds Modern Cryptography to its Standard Library

                                                                  1. 3

                                                                    The nonce does not necessarily have to be randomly generated, and in fact it can have some semantic meaning if you want it to. For example, in “Practical Cryptography,” Schneier and Ferguson suggest using the message number plus some additional information as a nonce, assuming the messaging system has the concept of a message number. The most important aspect of a nonce is that it is used only once (hence, “Number used once”), and does not necessarily have to be high-entropy. If you want it to have some kind of meaning, then having the crypto library choose it for you is not always what you want.

                                                                    1. 12

                                                                      Just to be pedantic and because I’m taking a break at work:

                                                                      I’m like 90% sure that the etymology isn’t “Number used once”, but rather from the Middle English “nonce”, meaning “current occasion”, via the linguistics term “nonce word”, meaning a word that is expected to only occur once.

                                                                      Why yes, I am fun at parties.

                                                                      1. 4

                                                                        I won’t argue with you at all, as I had absolutely no idea what the etymology of the word is :). Assuming you are right, I still find my mental link of “nonce” == “number used once” useful because it helps me to remember the actual purpose behind the use of the value.

                                                                        1. 6

                                                                          No, no, your version is immediately more useful. I just like linguistics. :)

                                                                      2. 2

                                                                        Oh, interesting! That makes me feel better, so hopefully the docs will include similar guidance :)

                                                                        I wonder then, if sodium_crypto_box is stateful, and will refuse to work if $nonce is reused? I didn’t find relevant libsodium docs with a quick search, but I think I just don’t know the right keywords.

                                                                        1. 3

                                                                          Secretbox is an abstraction of the concept: “given a key x nonce pair, push data into a thing and get the encrypted data on the other side”. An application could potentially have thousands of secretboxes at once and they really shouldn’t know anything about each other.

                                                                          Think of a secretbox being stateful the way an iterator is: if you give it all the same parameters its going to replay exactly the same behavior.

                                                                          Finally, the nonce space can be very large (depending on the cartographic algorithm being used and what it specifies). In the case of Salsa20, it is 64 bits. It isn’t realistic to track a space that size. (When using libsodium you should really stick to the symbolic constants, like crypto_secretbox_NONCEBYTES, and not, say, 24.)

                                                                          As long as you never use the same key x nonce pair, you’re fine. As @untothebreach said, using an application invariant that guarantees the nonce will be unique is often sufficient. For many algorithms, the nonce space is large enough to randomly generate the nonce each time and not worry about it (if that sounds fishy to you, recall that the nature of cryptography is to make bad things really unlikely and then accept that it’s fine).

                                                                        2. 1

                                                                          Does “once” in this case mean once, ever. Or once in this application of the algorithm? Is some randomness required?

                                                                          But to go back to @phil’s point, it sounds like a safe default would be to generate the nonce in the library. But you can always provide your own.

                                                                          1. 1

                                                                            Once with the same key

                                                                      1. 2

                                                                        I think it’s a bit disingenuous, because C++ technically can return an internal member. I think the author should be more clear about the fact that some languages can do it, but that Rust is the only one^1 that can do it safely.

                                                                        1: Maybe Ada can do it safely too? I’d need clarification from someone who knows more about Ada than I do

                                                                        1. 20

                                                                          He does.

                                                                          From the post:

                                                                          Crucially, the Rust compiler will verify that all callers of the getter prevent the returned reference from outliving the X object.

                                                                          It doesn’t get much stronger then “crucial” when it comes to explaining a central point.

                                                                        1. 7

                                                                          I experienced something similar to this in Rust maybe a year ago. I was trying to write a baby LISP interpreter as a way to get more comfortable in the language. It felt like I was fighting the compiler the whole way through, but it was because I was so used to programming in a C++ way. The thing that really killed the project for me was something so painfully simple that it had me scratching my head as to how this passed under peoples' noses: getting a substring from some base string.

                                                                          • There is no .substr() method, or any equivalent that’s built in.
                                                                          • You can’t take the slice version of the string, allocate a new slice, and copy index-to-index; slices are indexed by byte, and not by character. Furthermore, string sizes are done by character, and not by byte.

                                                                          So the only solution was to write my own substring method (accounting for Unicode/multibyte character weirdness described above), or bring in a new dependency to the project. It felt ridiculous that I wasn’t able to do this basic string manipulation that’s a pretty common operation in most languages. My solution was equally ridiculous; chop off N front characters, reverse the string, chop off M back characters, and reverse again.

                                                                          Maybe there’s a better way to do this, but it just felt like an extreme solution to something that the standard library should be able to solve. The first hit from googling “rust substring” gives this link detailing a few possible solutions, but nothing conclusive. It was a frustrating experience and it really turned me off to the language for a little while.

                                                                          1. 12

                                                                            If you can, please see my response to @azrazalea. Rust strings are UTF-8 encoded, which means we give up fast & easy substring indexing, but the rust devs have decided that the gains are worth the losses.

                                                                            1. 6

                                                                              Taking a substring in Rust by byte ranges is simple. If s is a String, then &s[i..j] is a &str substring of s from bytes i to j. If either i or j aren’t on a valid UTF-8 encoded codepoint boundary, then the expression causes a panic.

                                                                              Doing this by Unicode codepoint index is generally considered an anti-pattern and something you should try to avoid. Both Rust and Go leave this type of slicing/indexing out of their standard library, so Rust is not alone in this. But if you wanted to do it, the way I’d suggest would be to get the byte offset of the corresponding codepoint, and then slice it that way. You can get byte offsets by using the s.char_indices() iterator. For example, s.char_indices().nth(5).unwrap().0 will give you the byte offset of the beginning of the 5th codepoint.

                                                                              The reason why this type operation is not something you should generally do is because “Unicode codepoint” isn’t necessarily “one character” from the perspective of humans. A better approximation of “character” is a grapheme cluster, as defined by the Unicode standard.

                                                                              As I see it, there are two good reasons to make this operation very explicit:

                                                                              1. To give you appropriate pause that maybe it’s not what you want to do.
                                                                              2. To make the performance costs obvious. Slicing by bytes is O(1), but slicing by codepoint is O(n) given how Rust represents strings internally.
                                                                              1. 1

                                                                                it just felt like an extreme solution to something that the standard library should be able to solve

                                                                                I’m a beginner/hobbyist in rust, but from what I understand their philosophy is to have very very little in the standard library and for you to pull in a dependency for many things that other languages have in their standard library.

                                                                                In addition, strings are indeed just bytes in rust but from what I understand they went that way to avoid setting a “blessed” encoding for the language. Since they are just bytes, libraries can implement UTF-8, UTF-16, whatever support.

                                                                                As far as unicode support in standard library, the situation isn’t that great with programming languages in general. I don’t see rust as much of an outlier.

                                                                                1. 17

                                                                                  This is incorrect. Strings in rust (meaning the String and &str types) are guaranteed to be UTF-8. In the stdlib, you can get the individual characters with .chars() and get their indices with .char_indices(). If you want to deal with graphemes, you need to use unicode-segmentation: https://unicode-rs.github.io/unicode-segmentation/unicode_segmentation/index.html . Manishearth had a great post on dealing with unicode in strings recently: http://manishearth.github.io/blog/2017/01/14/stop-ascribing-meaning-to-unicode-code-points/

                                                                                  edit: wrong manishearth page! it is now corrected

                                                                                  (also cc @intercal for all of the above)

                                                                                  1. 1

                                                                                    Thanks for the correction! The need of a library for graphemes is what I was thinking of.