Live data from Hacker News

Reddit 1.0 source code

github.com

41–50 of 117 posts

Re: Reddit 1.0 source code

#41

It's unfortunate that Reddit silently went closed-source before being forced to admit it. Certainly a betrayal of trust with their long-standing userbase.

Maybe having it be open source would represent a security risk? https://github.com/reddit-archive/reddit1.0/blob/master/data...

I mean, it shouldn't. Humanity is perfectly capable of building secure web services without having to keep the way it works a secret. You don't publish your encryption keys with your source code, which is what your security should be depending on.

And what's more, Reddit themselves did not even use that excuse in their official statement for it, even though to me their excuse felt even less logical.

Basically, they don't want to leak the crazy features that they're developing and have such piss-poor source code management that they cannot provide tarballs of clean states of their source code.

I mean, how do they deploy new versions, if they cannot cleanly separate feature development from stable code?

https://www.reddit.com/r/changelog/comments/6xfyfg/an_update...

Re: Reddit 1.0 source code

#43

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

S-expressions can be mechanically converted to HTML. HTML is more verbose and error prone:

     vs )
     oops. Can't happen with an s-expression

Re: Reddit 1.0 source code

#44

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

> Good luck having a designer mockup/write HTML.

What you are looking at was designed by a designer.

Maybe you think another designer you know could make something that looks better if only they could use their own tools, instead of tools that this designer liked to use.

I remember an age when I would receive photoshop "designs" that I would have to re-code in HTML. Then they got dreamweaver and thought they didn't need me to code their stuff up anymore, just to debug their stuff and tell them why it didn't work in X/Y/Z browser combination.

When the lisp programmer is writing their login panel, they start out writing "code" like this,

    (defun login-panel ()
       (pbox "login/register"
then decide they need some HTML. `pbox` recognises HTML as long as it looks like lisp so:

         (:form :id "logform" :class "nomargin"
           (:table :style "border-collapse: collapse"
                   (:tr (:td :colspan "2"  "username:"))
                   (:tr (:td :colspan "2" (:input :id "loguser" :class "txt" :name "user" :type "text" :size 15)))
                   (:tr (:td :colspan "2" "password:"))
                   (:tr (:td :colspan "2" (:input :id "logpass" :class "txt" :name "pass" :type "password" :size 15)))
                   (:tr (:td :colspan "2" (:input :id "logmem" :type "checkbox" :name "mem" "remember me")))
                   (:tr (:td :colspan "2" (:span :id "logerror" :class "error" "")))
                   (:tr (:td (:input :id "logbtn" :class "btn" :type "submit" :value "Login" :onclick "login(); return false"))
                        (:td (:input :class "btn" :type "submit" :value "Register" :onclick "register(); return false")))
                   (:tr (:td :nowrap t :colspan "2" :align "center" :class "little" (:a :href "/password" "what's my password?")))))))

can be transformed into the much more complex:

         
           
                   username:
                   
                   password:
                   
                   remember me
                   
                   
                       
                   what's my password
           
         
But what is the alternative? To embed the html so that it still looks like HTML means making a string of some kind, and running the risk that there's some kind of variable expansion or XSS or other thing that will bite them in the butt. Maybe not in this simple example, but the need to get into the display-language is very common in a web application, so there are lots of fragments like this to answer to:

Maybe this one and bigger we could move into a file and either read it every request or add some extra code to save the contents to a global variable. But we haven't gained very much for all that complexity -- this hypothetical "when" we get a designer who knows HTML and not Lisp, and can contribute in a way that meaningfully moves the project forward without making more work for other programmers is far away at this point, and the reddit developers are just going to rewrite the whole thing in Python anyway.

Re: Reddit 1.0 source code

#45
post #6

Earlier quoted context omitted.

Maybe having it be open source would represent a security risk? https://github.com/reddit-archive/reddit1.0/blob/master/data...

It goes both ways, being open-source can also make your product more secure, as it's out in the open and a lot more eyeballs look at the code.

Tell that to OpenSSL

Re: Reddit 1.0 source code

#49

Earlier quoted context omitted.

This is not really a useful response. The trivial counterexample is that all modern crypto techniques rely on keeping a key, or part of a key, secret. That's security through obscurity, and you've just stated bluntly that obscurity never works under any circumstances, right? What you want to do instead is talk about tradeoffs. Talk about how much information you need to keep secret in exchange for a given window of e…

We don't allow you to change the definition of "security through obscurity" just like that! Using a public algorithm with secret key is BY DEFINITION _not_ security through obscurity. On the contrary.

In context it was fair because I was responding to a situation that was already playing with the definition, and once you allow that you have to allow taking it all the way.

Unfortunately, I started my reply to the wrong comment and didn't notice until after I'd posted it and it was too late to edit/delete.

tl;dr too many people have a knee-jerk "security through obscurity!" reflex action to things they don't like, and I have a reflex action of yelling at them about it, which sometimes misfires when I don't take care to reply at the right point in the thread.

Post reply on HN