Coding: Fleeting Thoughts

[Thesh]

I'm not sure where you came up with 16^160 or if you really understand rainbow tables, but do you have any clue how large 16^160 is? You talk about building a table of 16^160 entries like it's a simple task.

[Steax]

I know it's ridiculously large. For all intents and purposes, I'm pretty sure nobody will attack my sites in such a manner. It does provide additional security over not using it, and the implementation is trivial (I really just use 2 salts, one of which being the original password, and alternate between them). So in the end I just use it anyway.

The 16^160 was for all the hexadecimal results of SHA-1 (160 characters, if I remember correctly).

I admit I'm not sure if the choice of using the original password as a salt is a good idea, but the guys over at security probably know more about that.

[Jplus]

(Excuse me for ignoring the hash/salt discussion.)

I've been going through A Tour of Go. I used to be very sceptical about Go ("oh, yet another high level language"), but today I heard it was designed by Rob Pike so I got curious and I went through the tutorial. To my surprise it's really a modern reincarnation of C.

Actually... It's a modern reincarnation of Algol 68.

Well that seems like a moot point to me, since C was also a modern reincarnation of Algol at the time.
To be honest, I found the article you linked to a bit shabby because the code examples contain many little errors and the rationale behind the design decisions in Go is mostly ignored (often the motivation is similar to the motivation for design decisions in C). That said, I do think Go has some peculiar quirks, and I agree the language shows some surprising similarities with Algol. Or perhaps the similarities are not that surprising at all.

[b.i.o]

An attacker doesn't have to compute extra rainbow tables per entry just because there are extra salts involved. For each database entry (I'm assuming each user has a unique set of salts, which is how it should be), the attacker needs to compute one rainbow table, to find the mapping from whatever the original password was to that one entry. The function to compute one entry in the rainbow table takes an input string (the password "guess") and does the same hash-with-multiple-salts process your application is doing to get the output hash. Adding more iterations slows it down. Interspersing more salts does not.

[Thesh]

If each entry has a different, sufficiently large, random salt, you don't even compute a rainbow table. You just do a straight-up dictionary attack.

[b.i.o]

Right, sorry, that's what I meant. I was conflating the two terms.

[Steax]

Yes, you could just do a dictionary attack. That particular route depends on the quality of the original hashed string, however.

[Thesh]

No, it depends only on the quality of the password and the time to run the hash function (which is dependent on the number of iterations).

[Steax]

No, it depends only on the quality of the password and the time to run the hash function (which is dependent on the number of iterations).

I agree, yes.

[phlip]

Oh yeah. Guess who has two thumbs and just took a misbehaving buggy third-party library, bent it over backwards, and taught it who's boss?

Man, I'd probably stay at work until 8:30 more often if it meant feeling this good about what I'm doing.
... Don't tell my boss I said that, though.

[Windowlicker]

More (possibly stupid) questions!
For one of my modules this year we're doing group projects, which means version control is needed. We've been doing fairly well with it so far I think, but I'm still not entirely sure if we're doing it... 'properly'.
I guess most companies would use version control for their projects, so I have (I think) two questions:
1) What is the most effective amount of work to commit? After a function is changed? After a class is changed? At the end of the day? We've been mixing between committing after a line is changed and after the entire file has been rewritten. It doesn't really help that these projects are so simple, we haven't really needed to go back to any previous versions or anything like that at any point.

2) I'm still not entirely sure how restoring to previous versions works. Is the entire thing undone? For example, say we want to create two functions. I write down the headers and leave the bodies blank, then commit that. Then I fill in function 1, and commit again. Function 2, then commit. Can I go back to the first version of function 1 whilst function 2 keeps its body? The word 'function' doesn't appear to be a word anymore. Function. Fuuunc.Tion.

[phlip]

2) I'm still not entirely sure how restoring to previous versions works. Is the entire thing undone? For example, say we want to create two functions. I write down the headers and leave the bodies blank, then commit that. Then I fill in function 1, and commit again. Function 2, then commit. Can I go back to the first version of function 1 whilst function 2 keeps its body? The word 'function' doesn't appear to be a word anymore. Function. Fuuunc.Tion.

As long as the parts changed don't overlap, then yes, that's totally doable. It's called a three-way merge, mainly because the technique is usually used when you make changes to a file (but don't commit them), and then check out an update to that file - you have a base file, and two files with changes made, and it generates a file with both changes (as long as they don't overlap). But the same tool can be used to revert an old change without affecting later revisions (again, as long as they don't overlap). There's probably an option for it in your version control tool, whichever one you're using... look for terms like "revert" or "undo".

[Xanthir]

1) What is the most effective amount of work to commit? After a function is changed? After a class is changed? At the end of the day? We've been mixing between committing after a line is changed and after the entire file has been rewritten. It doesn't really help that these projects are so simple, we haven't really needed to go back to any previous versions or anything like that at any point.

Commit after you've done a logical unit of work that can be described in a short commit message. If you have to provide a bulleted list of changes, you've probably gone too long.

[Steax]

So how does forum software usually track unread posts? A table that tracks when a user has visited a thread, with a timestamp? Sounds reasonable, although it could grow to huge numbers (at least no rows are needed for threads the user has never visited, which can simply be marked as unread). Or a cookie? That sounds more reasonable, but then it's specific to a computer...

[coyotebush]

This forum site, for one, would seem to be tracking the most recent post I've read per topic. In particular, I can read page 1 of a multi-page thread and have it remain "unread".

[Steax]

Perhaps, then, track the timestamp of the last post in the thread which a user has read. That seems closest to how it works here.

[phlip]

If post ids are chronologically ascending, you can store the id of the last-read post, for each thread for each user... might be slightly cheaper than storing a date, and would avoid some possible corner cases when several posts are made at the same time...

As for what phpBB does... I remember that phpBB2 used to store the information in the session - so while you were browsing around it would remember your last-viewed post in each thread, but when the session ended all it stored was the last-visited date... so essentially it would mark every post as "read", whether you read it or not, when you left the site. But now in phpBB3 it stores the last-viewed post per thread per user in a more persistent way.

And sure, it'd be a lot of rows in that table... but each row wouldn't be that big, and it'd be all indexed and such. So it wouldn't be that bad.

[mfb]

If post ids are chronologically ascending, you can store the id of the last-read post, for each thread for each user...

In general, they are not, as posts can be copied (so you can get old posts with new ids) in most forums.

vBulletin 3 lets the administrator choose:
- cookie-based: The read threads (I think the postIDs*) are stored in a cookie, inactivity marks all threads as read.
- database-based: Same as with cookies, but the status is saved even when the user logs out.
Threads with no new posts in the last x days are marked as read.

*I can check that later

[mister_m]

I aspire to become a master of C. Does anyone know where I can find a decent writeup about heaps and maps? I'd like to implement these data structures.

[EvanED]

Any algorithm book, probably. This is one of the standard suggestions.

For maps, you have to decide whether you're more interested in tree-based or hash-based maps.

[Anonymously Famous]

ThinkGeek reminded me on Facebook that today (in mm/dd/yy or any variation thereof) is the last binary-friendly day until 2100. Anyone planning on doing something binary?

[Robert'); DROP TABLE *;]

Code: Select all

List<BotListener> objects;
...
foreach (Type type in Assembly.GetExecutingAssembly().GetTypes())
            {
                if ( typeof(BotListener).IsAssignableFrom(type) )
                {
                    var Const = type.GetConstructor(new Type[] { });
                    if (Const != null && Const.GetParameters().Length == 0)
                    {
                        object o = Const.Invoke(null);
                        objects.Add(o as BotListener);
                    }
                }
            }

Should I be ashamed?
(In case it's not clear, this code looks through the program its running in for classes which implement an interface called BotListener, and then instantiates them dynamically.)

[Steax]

Throwing this out for my fellow web app developers: Twitter's Bootstrap library/framework/template/whatever is a great place to start when you need to whip up a simple but usable app. It has a bunch of basics you might need. I couple this with the Flourish Library for PHP and it's really soothed my soul of late.

[cemper93]

Bobby Tables: The fact that I really don't want to know for what kind of messed up design this code is needed (if it's not for fun) aside, I'll randomly be nitpicky and rant on a single Expression:

Code: Select all

 objects.Add(o as BotListener);

Specifically:
o as BotListener
o as BotListener
o as BotListener
o as BotListener!

Please, a C# cast works like this:

Code: Select all

objects.Add( (BotListener) o );

Your version has the disadvantage that if the cast failed, it would not throw an error - it would just silently fail and return null, which may not really be what you desired. Of course, in the example at hand, failing is quite impossible, it's just that the "as" keyword in general is a mighty, but dangerous force to play with and should never be used if its specific behaviour isn't needed, whether it looks more nicely or not.

Nice trick, though.

[Sc4Freak]

I dunno, I've seen that "trick" everywhere and IMO if it's blindingly obvious that the cast can never fail, using "as" is okay.

eg.

Code: Select all

if(sender is TextBlock)
{
    (sender as TextBlock).Text = "Hello, world!";
}


[Robert'); DROP TABLE *;]

I wrote it like that because I wanted dynamic plugins, and couldn't be bothered writing it "properly" the first time around. (i.e. have it to load DLLs or something more sensible) Also because I wanted to see if it would work.

[Ended]

Code: Select all

state = [st for s in state for st in states[(s,letter)]]

from http://swizec.com/blog/strangest-line-o ... wizec/3012

Makes my brain hurt a bit.

[RoadieRich]

Code: Select all

state = [st for s in state for st in states[(s,letter)]]

from http://swizec.com/blog/strangest-line-o ... wizec/3012

Makes my brain hurt a bit.

Code: Select all

state = []
for s in state:
    for st in states[(s,letter)]:
        state.append(st)

I don't see what's so hard about that.

[not baby Newt]

Code: Select all

state = [st for s in state for st in states[(s,letter)]]

from http://swizec.com/blog/strangest-line-o ... wizec/3012

Makes my brain hurt a bit.

Me too. I keep trying to understand it by decomposing into the 1-loop version.

Code: Select all

[st for s in state]

[state for st in states[(s,letter)]]

Either fits the basic syntax pattern but makes no sense.

That blog post had comment link to http://www.python.org/dev/peps/pep-0202/ which I found enlightening even though it didn't really explain anything.

I now think it better to see the construct as [<Return value/expression><one or many loops><zero or more conditions>] and not try to express the two-loop version as two single-loop expressions.

st -- result.
for s in state -- first loop.
for st in states[(s,letter)] -- second loop

I understand.. neat!


RoadieRich: Perhaps I made the/my source of confusion clearer.

[Xanthir]

Code: Select all

state = [st for s in state for st in states[(s,letter)]]

from http://swizec.com/blog/strangest-line-o ... wizec/3012

Makes my brain hurt a bit.

This is just written confusingly. With better variable names it's clearer:

Code: Select all

current_states = [new_state for current_state in current_states for new_state in state_transitions[(current_state,input)]]

This is implementing an NFA. You take the list of states you're currently in, and for each one, collect all the states that result from transitions from that state using the given input. This gives you a new set of current states.

Something missing from that is the uniquifying step, since you'll often end up with multiple starting states ending up in the same end state. That may be present in code that we can't see, though.

Edit: That said, nested list comprehensions are somewhat hard to read in any situation.

[mister_m]

Any algorithm book, probably. This is one of the standard suggestions.

For maps, you have to decide whether you're more interested in tree-based or hash-based maps.

How would you make a data structure generic in C?

[TheChewanater]

Any algorithm book, probably. This is one of the standard suggestions.

For maps, you have to decide whether you're more interested in tree-based or hash-based maps.

How would you make a data structure generic in C?

void* ?

[EvanED]

Any algorithm book, probably. This is one of the standard suggestions.

For maps, you have to decide whether you're more interested in tree-based or hash-based maps.

How would you make a data structure generic in C?

Short answer: go cry; maybe God will hear your tears and reward you with a better language.

But barring that, there are two options to actually do it, both sucky. One option is to lose the small amount of type & memory safety you get from C, and just use void*. The other is to use macro hackery. If you define your implementation in a header file, you can arrange things so that something like

Code: Select all

#define HEAP_DATA_TYPE double
#include "my_heap.h"

(I suggest actually undefining HEAP_DATA_TYPE in my_heap.h, but that's personal preference. There is a reason though -- it seems like it would reduce the risk of including my_heap.h with the wrong type.)

I think the latter option sucks less, but that's me. (It means that merely the implementation of your heap is terrible, whereas with a void* interface, the use of it is as well.)

[Jplus]

Personally, I'd just say that you don't do generic programming in C.

[headprogrammingczar]

Fleeting thought: self-modifying Perl code is way too much fun.

Code: Select all

sub load {
  my ($state, $module) = @_;
  my ($fh, $code, $error);

  open($fh, "<", "modules/$module.pl") || $error++;

  $code = join('', <$fh>);

  eval $code;
  if ($@) {
    warn $@;
    return 0;
  } else {
    return 1;
  }
}

sub callback {
  my ($state, $name, $func) = @_;

  $state->{$name} = sub {
    $func->($state, @_);
  };
}

$pm = sub {
  my ($state, $dest, $line) = @_;

  $state->{'write'}->("PRIVMSG $dest :$line");
};

&callback($state, "pm", $pm);


[EvanED]

Someone I knew in undergrad told me about a script he wrote (I'm guessing Perl) that would compute factorial by reading in its own source, changing, say, 10 to 9, and then rerunning itself. He said he mainly wrote it so that he could say "if (10 == 1) ...".

[TheChewanater]

Personally, I'd just say that you don't do generic programming in C.

Alternatively, if you really crave generic programming, use C++. Or maybe Python, which uses duck-typing, depending on your other requirements and preferences.

[headprogrammingczar]

Or Haskell, where "generic programming" can mean parametric polymorphism, type classes, GADTs, type families, functional dependencies, kind-polymorphism, ...

[TheChewanater]

FT: Does anyone know of a roguelike or RPG with really well-written and comprehensible source code?

[Thesh]

Attention person who used to work here before me: mm is months, mi is minutes. If you want to create a unique file name using the time stamp yyyymmdd_hhmmss is not necessarily going to work... Not as well has yyyymmdd_hhmiss.