Live data from Hacker News

Reddit 1.0 source code

github.com

31–40 of 117 posts

Re: Reddit 1.0 source code

#31
post #7

Earlier quoted context omitted.

Making something closed source does not make your product more secure, it only makes it harder to look at. Determined people will still try to understand how your software works in order to accomplish their goals.

Hashing passwords is security through obscurity by that reasoning. That does not make them less of a security function. Just something to keep in mind.

"Security by obscurity" tries to keep the way that your encryption method works obscure, it does not try to keep a specific key obscure.

For example, if your way to encrypt works like this:

1) Shift all letters along by 5.

2) Cut out every second word and put them behind the message in order.

3) Whenever there's an f, s or y in a word, double up that word and shift the second word's letters by 7.

Then if your enemy figures out how your method works, you have to come up with a completely different method.

The opposite to security by obscurity would instead once come up with a method that entirely depends on a key. You can then publicize that method (or not), and if your enemy finds out your key, you just choose a new key and you're fine again.

Re: Reddit 1.0 source code

#32
post #21

Earlier quoted context omitted.

Enigma wasn't hard through obscurity. The Allies had the Enigma machine long before they were able to crack it. It was hard because with the equipment of the day, it was pretty much unbreakable in the same way that prime-number based cryptography is today. It was only A. Turing developing a completely novel kind of machine ( https://en.wikipedia.org/wiki/Bombe ) that enabled the decryption. In the same way that quant…

Don't forget about the Polish. They too broke the encryption before, but then they were invaded, and no precision machinery was available to increase the number of rotors to 10. https://en.m.wikipedia.org/wiki/Cryptanalysis_of_the_Enigma Turing did it too, independently.

[deleted]

Re: Reddit 1.0 source code

#33

Earlier quoted context omitted.

This is not really a useful response. The trivial counterexample is that all modern crypto techniques rely on keeping a key, or part of a key, secret. That's security through obscurity, and you've just stated bluntly that obscurity never works under any circumstances, right? What you want to do instead is talk about tradeoffs. Talk about how much information you need to keep secret in exchange for a given window of e…

We don't allow you to change the definition of "security through obscurity" just like that! Using a public algorithm with secret key is BY DEFINITION _not_ security through obscurity. On the contrary.

Agreed. Kerchoff's principle isn't really up for debate.

Re: Reddit 1.0 source code

#34
post #20

Earlier quoted context omitted.

Reddit was lisp, then python, then python, then React (and some other stuff).

Can you expand the last one? The first three are server-side, while the last is front end. Are they using node on the back end?

Recent post about it: https://www.reddit.com/r/announcements/comments/8830oa/and_n...

Re: Reddit 1.0 source code

#35
post #17

Earlier quoted context omitted.

The majority of their code is still open-source. https://github.com/reddit

That's like someone telling you the majority of ingredients that they put into something you're supposed to eat, but not that one ingredient. It's either their secret super sauce or it's poison. And I can tell you for free that whatever Reddit has built technologically, does not contain any secret super sauce whatsoever.

I sort of get reddits reason to hold the post ranking algorithm secret. So that it is hard to game it.

Until there is a way to easy 're-key' such an algorithm if someone found a way to abuse it, holding it secret is the best solution for them.

I currently can't think of a better solution to avoid gaming of ranking algorithms than holding it secret and changing/adapting it often. Maybe some machine learning algorithm?

Re: Reddit 1.0 source code

#36
post #21

Earlier quoted context omitted.

Enigma wasn't hard through obscurity. The Allies had the Enigma machine long before they were able to crack it. It was hard because with the equipment of the day, it was pretty much unbreakable in the same way that prime-number based cryptography is today. It was only A. Turing developing a completely novel kind of machine ( https://en.wikipedia.org/wiki/Bombe ) that enabled the decryption. In the same way that quant…

Don't forget about the Polish. They too broke the encryption before, but then they were invaded, and no precision machinery was available to increase the number of rotors to 10. https://en.m.wikipedia.org/wiki/Cryptanalysis_of_the_Enigma Turing did it too, independently.

Didn't know about that! But it seems they were able to break the system only while the Germans where sending the settings of the plugboard in the header of each message. Once that was changed in the early 1940, their decrypting techniques wouldn't work anymore.

Btw, from the wikipedia article: "lazy cipher clerks often chose starting positions such as "AAA", "BBB", or "CCC"" Weak passwords were an issue already back then.

Re: Reddit 1.0 source code

#37
post #34
post #20

Earlier quoted context omitted.

Can you expand the last one? The first three are server-side, while the last is front end. Are they using node on the back end?

Recent post about it: https://www.reddit.com/r/announcements/comments/8830oa/and_n...

Cheers. Looks like this most recent work was primarily front-end:

> "When we set out to rewrite our code to solve these problems, we wanted to make sure we weren't just fixing small, isolated issues but creating a new, more modern frontend stack..."

Re: Reddit 1.0 source code

#38

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

A designer can just write HTML or some toy language.

A programmer will translate it to something manageable eventually anyway. A trivial automatic process can convert HTML to a DSL. Although making code sensibly refactored and readable is usually a manual job for the programmer.

Re: Reddit 1.0 source code

#39

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

Layout in code is something Flutter is doing. And Flutter will be used in the mobile OS Fuchsia.

Re: Reddit 1.0 source code

#40
post #24

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

It's not uncommon. An example in Racket is html-template.[0] Hiccup is one in Clojure.[1] There's a spectrum of methods for doing things like this: both Clojure and Racket have Mustache[2] implementations. "Confusing and hard to grok"† is in the eye of the beholder. Syntax highlighting and indentation go a long way (as well as exposure), though even in black and white, the parens fade for me much more than angle brac…

Clojure also has Selmer (https://github.com/yogthos/Selmer) which is a Django inspired templating language!
Post reply on HN