Viewing profile — jcoglan

This is the exact thing that wasn't working and which necessitated me sending various test files with particular encodings to a colleague.

I checked, the gem only has the Coffee source, no JavaScript. This frustrates the hell out of me -- clearly the message that you should ship JS is not getting through. When CS can …

It is much less safe. PhantomJS has a filesystem API, which is fine when you consider that its primary use case is testing code you wrote and reporting the results. However, given …

Never mind the cost. They are proposing that you run your app, with its 3rd-party jquery/facebook/twitter/google code loaded dynamically over non-SSL connections on a platform with…

Thanks for the suggestion in the last paragraph, very helpful.

Dear Christ just kill me already.

Relying on the way you happen to combine data, instead of using a function that's designed for authentication and has baked-in a safe way to combine the inputs, is a bad idea. "Wha…

Your point about padding and length bytes is spot-on. I actually left this out of the explanation, although it's interesting, because I felt it a useless diversion: something that'…

Possibly, although it depends on the lifetime of the link and the size of the tag (e.g. SHA-1 is 40 chars, each case requires mean of 8 guesses, so whole thing only requires 320 re…

In some cases, not letting them know they've failed is nice. But the most common case to look out for is, if your auth/crypto process involves multiple steps, don't return early fr…

I realize it seems impossible, but it's been done, repeatedly. https://www.google.co.uk/search?q=timing+attacks+over+the+in...

Not the best, but most string comparison methods are designed to fail as soon as possible, which is not appropriate for this use case. Compare the entire input, or use some misdire…

You'd think that, but it is possible. Google "timing attacks over the internet".

The timing attack is if you check the tag, that fails, and then you don't do any further request processing. This shortens the request time. It depends quite a lot on what you're a…

As someone who runs a lot of his own open-source projects (see http://jcoglan.com ), and occasionally contributes to others when I find bugs, the biggest reason I do it is to learn…

This needs to be at the top of the thread, rather than all the formal-logic-obsessed debate-club navel-gazing currently sitting there.

Two variants of Scheme, with shared libraries: http://github.com/jcoglan/heist http://fargo.jcoglan.com If it weren't for Lisp it would never have been so easy for total noobs like…

I've been thinking about this. I might try out making all the primitive functions understand promises. So not lazy evaluation per se, but having the core library transparently deal…

I'll fix this so that invalid expressions are reported and car and cdr of () are errors.

Oh, no offense taken. Thanks for pointing out other lisps, I should check them out for alternative ideas.

With regard to maturity, Fargo is one week into development. I'm not even sure if its just a quick hack to show off an idea or if it will become a production language. Certainly I …

I was going to do call/cc but fibers are cheaper. The implementation is very similar, but because fibers can only be resumed once from the last yield you don't need to copy the sta…

Songkick (YC'07, London) is hiring again. We're a small company (about 20 people) that's working to improve the live music scene for everyone involved. We help fans track their fav…