Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reddit 1.0 source code

github.com

Post reply on HN
Print view View original

61–70 of 117 posts

Re: Reddit 1.0 source code

#61

Post by TeMPOraL »

TheAceOfHearts wrote: post #54
nodesocket wrote: post #23

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

Embedding templates in code is actually quite nice. I used to think like you, but then I gave React a try and it completely won me over. Even without the transpilation step for JSX support, I find hyperscript [0] and friends [1] a notable improvement over other templating tools. Instead of having to jump to a separate file which magically inherits a bunch of implicit globals, you just call a function. If the system s…

I still don't get why non-code templating ever became popular. Especially that I saw it becoming popular in PHP, which itself is a better templating language than the templating languages people were using. Instead, people created plethora of languages that slowly accrued Turing-completeness with them, because religious adherence to "no code in views" is stupid.

That said, glue-strings-together templates are still a problem and should not be used. HTML document is semantically a tree, and if you don't treat it like that, bugs and security vulnerabilities follow.

(Respecting semantics applies to other languages as well. For instance, those who recognized SQL as a language, instead of some blob you concatenated out of strings, didn't have to worry about SQL injection.)

Re: Reddit 1.0 source code

#62

Post by bluefox »

nodesocket wrote: post #23

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

You could instead write abstractions for generating forms, e.g.:

    (pbox "login/register"
      (form (text "username:" :name "user")
            (pass "password:" :name "pass")
            (check "remember me" :name "mem")
            (group
             (button "Login" :onclick "login(); return false")
             (button "Register" :onclick "register(); return false"))
            (link "what's my password?" :href "/password")))

Re: Reddit 1.0 source code

#63

Post by TeMPOraL »

grzm wrote: post #27
unrealhoang wrote: post #25

Earlier quoted context omitted.

How is it verbose? It has much LESS noise than HTML. IMHO, Lisp is the simplest and smallest readable representation of data structure. I will trade JSON for edn [1] any days of the week [1] https://github.com/edn-format/edn

I share your zeal, but the answer to apparent incredulity isn't to raise the level. People have different tastes when it comes to programming languages and methods, and that's okay. There's often things we can learn from different techniques. To our parent's points, it's more verbose if you're used to passing data into a separate template file. That can help abstract the markup from the data processing. To their poin…

The notion of incredulity probably comes from fact that it's literally impossible for HTML encoded in s-expressions to be more verbose than HTML encoded in HTML!

> To our parent's points, it's more verbose if you're used to passing data into a separate template file. That can help abstract the markup from the data processing.

One does not exclude another. The "template" can be another lisp function (in another file).

> Clearly some lispers agree, as they've implemented alternatives like Mustache templates.

Probably popular demand. Personally, I don't think they should be used, like ever. Those template languages were a doubly bad idea.

First, they work on HTML serialization to string instead of HTML semantics as a tree, making it easy to introduce both bugs and security vulnerabilities. The concepts of "escaping", "sanitization" or "injection" are only relevant when you're abusing a serialization format instead of working with the language at the appropriate level.

Second, they all seem to have started with the assumption that "views don't need code". Each of them, over time, slowly discovered that no, views actually do need to have code, and slowly gained variables, conditionals, loops, function calls... and turned into shitty Turing-complete languages they tried so hard not to become. The problem here was always the premise. Views absolutely do need code, and so they should be written in a proper programming language.

Re: Reddit 1.0 source code

#64

Post by zeth___ »

amelius wrote: post #56
Sylos wrote: post #41

Earlier quoted context omitted.

I mean, it shouldn't. Humanity is perfectly capable of building secure web services without having to keep the way it works a secret. You don't publish your encryption keys with your source code, which is what your security should be depending on. And what's more, Reddit themselves did not even use that excuse in their official statement for it, even though to me their excuse felt even less logical. Basically, they d…

> Humanity is perfectly capable of building secure web services without having to keep the way it works a secret. That's the same as saying that humanity is capable of building a large system without bugs, in an economically viable way.

Just look at Linux. The only way to keep bugs out of the kernel is to keep the source closed.

Re: Reddit 1.0 source code

#65

Post by zeth___ »

Skunkleton wrote: post #11
wvenable wrote: post #8

Earlier quoted context omitted.

Security through obscurity is a valid and effective tactic -- it's simply ineffective on it's own .

To reinforce your point, see all pre-modern crypto techniques. It cannot be argued that they worked, and they were all certainly security through obscurity.

Yes, the Zimmermann Telegram is a perfect example of security through obscurity.

Re: Reddit 1.0 source code

#66

Post by adwf »

1wd wrote: post #28

What kind of Lisp system was used to run this? Would it work with any Common Lisp? What other things are required, like libraries or a database etc.? I'm guessing reddit.asd lists some: :tbnl (a toolkit for building dynamic websites) :cl-ppcre (a regex library) :trivial-http (a HTTP client) :cl-who (a library for using S-expressions as HTML markup templates) :clsql (a SQL database interface and ORM) :clsql-postgresql…

The interesting thing is you can still use pretty much that entire stack today. The only one that stands out as outdated is tbnl which changed name to hunchentoot.

The stack I used for a website just the other day:

hunchentoot

cl-who

postmodern (prefer it over clsql-postgresql)

cl-smtp

ironclad

drakma (fuller featured than trivial-http)

Re: Reddit 1.0 source code

#67

Post by candiodari »

erpellan wrote: post #43
nodesocket wrote: post #23

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

S-expressions can be mechanically converted to HTML. HTML is more verbose and error prone: vs ) oops. Can't happen with an s-expression

Exactly. The thing that I always remember is that identifiers encoded this way simply can't get out of sync from client to server. Commands, paths, enums, ... Where a form is posted, say, is an easy constant, that defines both the routing AND the string in the form. Where forms always have the fields defined in a structs, never more, or less.

And this can result in sites that are very fast to add things to, as opposed to have dozens and dozens of files everywhere.

But everyone wants "single page apps". Because

  client -> server ---[html]--> client --> server --[javascript]--> client --> server --[4*ajax requests necessary to fill in the initial page]--> client --> server --[4*images necessary to fill in said javascript]--> client
Is so obviously "much faster" than:

  client -> server --[html+embedded everything]--> client

Re: Reddit 1.0 source code

#68

Post by Jach »

nodesocket wrote: post #23

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

A nice thing about Lisp is you can do whatever without much getting in your way -- though this is a pretty common way of doing HTML for get-it-out-the-door work. You can get a whole lot fancier (https://github.com/Day8/re-frame is an example from ClojureScript land). But the context of what you're making determines the important variations, and whether you ever let a designer (or a programmer) touch this example at this level of resolution or something approximately the same like a separated out HTML file (or whatever template system you like) that the Lisp function just wraps. Example details that could be important in general, not just for this specific code repo:

This thing has no concept of localization, is that a constraint? Accessibility? Are there dozens of other engineers working at this level of detail you need to worry about? Is this the output of a higher level tool used by either coders or designers? Is there a coherent component architecture behind this or is it just more of a utility function someone made? Do components need to be namespaced? Live in their own files/packages? Is the thing you're building a site with several unique pages or a SPA? Where are the JavaScript implementation points for things like the on-click's register() function? Or are you going to forbid JS in your markup (because it confuses designers, or because of CSP policy) and force programmers to bind things elsewhere? How does your routing system work, is it fine to hardcode those paths like that?

Re: Reddit 1.0 source code

#69

Post by e12e »

JetSpiegel wrote: post #26
azag0 wrote: post #21

Earlier quoted context omitted.

Enigma wasn't hard through obscurity. The Allies had the Enigma machine long before they were able to crack it. It was hard because with the equipment of the day, it was pretty much unbreakable in the same way that prime-number based cryptography is today. It was only A. Turing developing a completely novel kind of machine ( https://en.wikipedia.org/wiki/Bombe ) that enabled the decryption. In the same way that quant…

Don't forget about the Polish. They too broke the encryption before, but then they were invaded, and no precision machinery was available to increase the number of rotors to 10. https://en.m.wikipedia.org/wiki/Cryptanalysis_of_the_Enigma Turing did it too, independently.

See also the Swedish who cracked the t52:

https://www.wired.com/2007/08/looking-back-at/

https://en.m.wikipedia.org/wiki/Arne_Beurling

Re: Reddit 1.0 source code

#70

Post by Grue3 »

nodesocket wrote: post #23

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

It's common (and I agree it's ugly) but it's far from the only option. I'm using a library [1] that generates HTML from Google's Closure Templates [2] which any designer can easily understand.

[1] https://github.com/archimag/cl-closure-template [2] https://developers.google.com/closure/templates/

Post reply on HN