Threads for kodo

  1. 3

    Anything new here? This has been around awhile

    1. 14

      Crystal http://crystal-lang.org. It’s a Ruby inspired syntax, but compiles to code that’s comparable to C.

      1. 2

        I was ready for the link to go to crystal lang homepage

      1. 2

        I dunno, isn’t this pretty much what ApplePay®™ is all about?

        Not saying yay or boo, just sayin’…

        1. 8

          “Apple added that they would not track usage, which would stay between the customers, the vendors, and the banks.”

          Looks like… at least they’re telling us… that it’s just a payment service where they’ll make the traditional fees, support purchases of iPhones, and maybe other value-adds. They don’t have to do surveillance. They already got nice PR for anti-surveillance crowd after not unlocking the phone.

          1. 6

            Apple isn’t in the ad business so I’m not sure how this comparison makes sense, even aside from their stated focus on privacy and lack of tracking as @nickpsecurity pointed out.

            1. 14

              One need not sell advertisements, to profit from the capacity to conduct analysis on a large group of buyer’s spending habits. Recall that Apple acts as a media outlet, and partners with many large corporate entities in a variety of ways. I’m usually pretty wary about how the internet gets connected to my bank accounts, simply to ward off impulse buys and identity theft, so I never felt particularly comfortable with Apple Pay, which is why I’m not very familiar with Apple’s policies surrounding it’s use.

              Initially, I was under the impression that this was about the Google Wallet®™ product, since, these sorts of services do support “offline” in-store purchases with NFC devices, but a CTRL+F for “wallet” reveals that I misinterpreted the first paragraph while skimming the article. This goes way deeper than just credit cards attached to NFC payment apps.

              Google says its third-party partnerships capture roughly 70% of all credit and debit card transactions in the U.S.

              Basically, if this is how the world works now, no one should ever use plastic to buy anything ever again.

              1. 4

                Holy fuck.

                1. 0

                  anonymous altcoins zcash/dash/monero ftw

                  1. 1

                    $

            1. 2

              Shocked his hasn’t been posted here before.

              1. 2

                Anyone here who hasn’t heard of IPFS already should get their membership revoked :P

                1. 1

                  there have been some articles here

                1. 34

                  Why are we even considering using a specific service for content hosting? I don’t see any benefit in using dropbox (or any similar service), especially not if it’s supposed to be the preferred option.

                  1. 2

                    not to mention dropbox is kinda horrible in many facets.

                  1. 2

                    Copy by value not reference

                    1. 1

                      This looks quite interesting. Isn’t the way Query params are used as the Env a possible vector for maliciousness though, e.g. overwriting existing relied-upon environment variables. Perhaps this could be alleviated by prefixing the query string parameter names when loaded as the environment (e.g. HTTP_FOO instead of FOO).

                      This is quite similar to the register_globals issue that PHP suffered for a long time with.

                      1. 1

                        Yeah, this is pretty much just a simpler version of CGI. CGI uses QUERY_PARAMS to store the entire params. You make a good point though, can overload apps that are using something else. Although I’m not sure what you would gain since these are explicitly wired to webframework in config file.

                        1. 1

                          Wouldn’t the gain be security/stability?

                          1. 1

                            Yeah, theoretically. but one of the assumptions Im using while running this for myself is that I’m not using pre-existing ENV vars in the executables I’m using. That can easily change tho, so thanks for bringing it up.

                      1. 28

                        When you curl host:3000?FOO=bar it calls echo.sh with the FOO=bar environment variable.

                        curl host:3000?FOO=';rm -rf *'

                        1. 1

                          False, sorry.

                          $ a=';printf asdf'
                          
                          $ $a
                          No command ';printf' found.
                          
                          $ ls $a
                          ls: ;printf: No such file or directory
                          ls: asdf: No such file or directory
                          
                          1. 4

                            I was using raw shell input previously so there was an actual attack vector. I changed the code to make it more secure

                        1. 6

                          Forgive me if I’m ignorant, why is this different to CGI?

                          1. 3

                            CGI is an actual standard. This is just a quick hack I threw together to serve stand alone executables.

                          1. 2

                            Looks like it’s still vapourware?

                            1. 1

                              Sia is basically the same thing and has been out for quite some time. There’s also StorJ, which I haven’t looked into much because of its reliance on Counterparty (but they’re switching away from that to Ethereum, yay!)

                              Filecoin, if it’s ever released, will be late to the scene.

                            1. 6

                              I’m making another version with a lower level execute command to mitigate shell attacks

                              1. 1

                                Spend entire article shitting on Java. Then lists reasons why he likes Kotlin. #1 is “It works like Java”

                                1. 5

                                  mosh is amazing. I discovered after ~3 months of dropped ssh connections over a very poor internet connection. If only port forwarding was possible.

                                  1. 4
                                    1. 2

                                      If only there was a native Windows client …

                                      1. 2

                                        Port forwarding is absolutely possible: Use ssh for it.

                                        If you want a proper VPN that stands up to a lossy connection, use IPSEC with a dummy network.

                                        mosh is secure remote desktop for terminals: Such a thing didn’t exist before mosh (or it wasn’t very good), but forwarding TCP is a solved problem.

                                      1. 1

                                        I use syncthing for passwords too, but instead of keepass, I started using plain text files encrypted with encfs. I like keepass but for me personally, I like the flexibility of a plain text file.

                                        1. 1

                                          To add to this, this thread actually inspired me to spend a few hours yak shaving my password management from “they’re in my brain” to “they’re encrypted in a git repo with the pass tool.” It’s a bit of a different flavor than encrypting the entire file system, but it’s breathlessly simple and can be shared easily. i.e., My wife and I can collaborate on the same repo of passwords. There’s even an Android app! (And it works.)

                                        1. 6

                                          I believe “Easyness” is missing. It is probably before or after Simplicity. I don’t know Pony.

                                          The distinction by example: Lua is a simple language. Very few mechanisms (everything is a table). Python is not simple. There are lots of corner cases in the language. However, it is easy. Many people describe it as the language closest to Pseudocode.

                                          1. 2

                                            I think easiness was part of simplicity. In the Richard Gabriel essay, the Worse is Better solution that favored simplicity might use an easy construct that sort of worked now but caused problems later. It should definitely be a measurement, though. One thing I’ll add that people overlook is your background and thinking style makes some things easy to you that aren’t to other people. People from mathematics background might grok functional programming while imperative programmers have a hard time with it. That was a common one with a general form, too: anything you are learning that’s really different from your main approach might be hard. If we follow that reasoning, we’d have tossed out both functional and OOP once imperative dominated the world.

                                            So, we have to make sure we consider that when evaluating easy to learn/use. Easy to who and with what prior skills I’ll say.

                                            1. 5

                                              People from mathematics background might grok functional programming while imperative programmers have a hard time with it.

                                              Except the people who developed Fortran had a very strong mathematical background. Personally, I think the “mathematics” of e.g. Haskell is sloppy and poorly grounded. But each to their taste.

                                              1. 4

                                                Except the people who developed Fortran had a very strong mathematical background.

                                                You got me there. Excellent catch. It also helped that it was higher-level and closer to how mathematicians think than something like C. It had less dark corners in it that hurt optimization of numerical algorithms, too. No wonder it lasted in HPC with occasional updates.

                                            2. 1

                                              You sound like Rich Hickey

                                            1. 1

                                              OpenSnatch would have been a good name too

                                              1. 6

                                                They didn’t mention https://www.scuttlebutt.nz/ or zeronet

                                                1. 1

                                                  There’s twister and Freenet systems like Sone too.

                                                1. 3

                                                  99.9% of the time just use postgres for the love of god :P

                                                  1. 11

                                                    and they use broken home rolled crypto..

                                                    1. 3

                                                      The sad thing is that only cryptogeeks (cypherpunks?) care about that.

                                                      Telegram tends to just work if you expect same level of trust/privacy than say public IRC.