Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reddit 1.0 source code

github.com

Post reply on HN
Print view View original

111–117 of 117 posts

Re: Reddit 1.0 source code

#111

Post by kakwa_ »

onion2k wrote: post #16
Skunkleton wrote: post #11

Earlier quoted context omitted.

To reinforce your point, see all pre-modern crypto techniques. It cannot be argued that they worked, and they were all certainly security through obscurity.

Aren't most examples things where it didn't work? The most famous case is the German "Engima" device from WWII (hardware- and 'software'-based, but cracked and readable for years before the Germans knew because they believed it was both obscure and effective) but it's wholly possible that most schemes were broken eventually. Keeping an obscure system secret is really hard, especially against a motivated attacker.

Enigma security didn't rely on security through obscurity. Having the machine didn't enable the allies to decrypt the messages. It relied on the secret of the... secret keys and the monthly key books.

It's also quite interesting to see that the Polish cryptanalists were able to reproduce the enigma machine used by the german army without even having seen one. They were able to deduce the number of rotors, the wiring, etc.

What in the end doomed the Enigma was the fact it was more a kitchen recipe than cryptography based on solid principles. It was a smart recipe for the time, but it had flaws (like the fact a letter could not be the same letter once encrypted). In some regards, most of our symetric encryption algorithms today feel a bit that way (with a lot more external scrutiny from experts however).

Even in WWII, I don't think that security through obscurity was considered as an absolute barrier. It's more in line with a "defense in depth" pattern. It gives a little more work to your adversary as he now has to figure out how your encryption works before breaking it, but it's not expected to last for long.

Re: Reddit 1.0 source code

#112

Post by kjdsiheioahef »

Unrelated to the original post: Does anyone know if Reddit keeps or shares records of content that ends up on the (unauthenticated, uncustomized) homepage (top 30 results at any given time) for US-based users? If so, how far back does such data go?

I don't believe the mainstream archive sites would be a definitive source. Perhaps there is another?

Re: Reddit 1.0 source code

#113

Post by geocar »

testb wrote: post #106
geocar wrote: post #76

Earlier quoted context omitted.

Can you explain what you mean, if it's not one of the things I mentioned (that are often called "templates") and how it doesn't have the drawbacks for a small team that I mentioned?

I'm guessing they meant something like jinja,ejs,jade,etc. where you have your html in a separate file and your lisp code would just render said html file with the necessary variables. I think you implied that in your last point but I'd be curious to find a designer who knew lisp better than HTML.

> I'm guessing they meant something like jinja,ejs,jade,etc. where you have your html in a separate file and your lisp code would just render said html file with the necessary variables

That doesn't benefit our designer who knows lisp well enough, and it doesn't benefit our programmer who knows lisp very well (or they would have done it).

> I'd be curious to find a designer who knew lisp better than HTML.

Well, if your team is a handful of lisp developers, then all of them.

Perhaps buried is the assumption that hiring/resources are free, or that there is some kind of gatekeeping for the term and title "designer". If it helps to make the point clearer: I program and I design, and I know lisp better than I know HTML.

Re: Reddit 1.0 source code

#114

Post by Qub3d »

stakecounter wrote: post #5
notthemessiah wrote: post #2

It's unfortunate that Reddit silently went closed-source before being forced to admit it. Certainly a betrayal of trust with their long-standing userbase.

Maybe having it be open source would represent a security risk? https://github.com/reddit-archive/reddit1.0/blob/master/data...

That violates Kerckoff's principle[0],a cornerstone of modern information security. I would run far, far away from anyone coughtelegramcough who claims "its secure, don't worry about it" and otherwise refuses to expose their codebase to scrutiny.

[0]:https://simple.wikipedia.org/wiki/Kerckhoffs%27s_principle

Re: Reddit 1.0 source code

#115

Post by codedokode »

TeMPOraL wrote: post #63
grzm wrote: post #27

Earlier quoted context omitted.

I share your zeal, but the answer to apparent incredulity isn't to raise the level. People have different tastes when it comes to programming languages and methods, and that's okay. There's often things we can learn from different techniques. To our parent's points, it's more verbose if you're used to passing data into a separate template file. That can help abstract the markup from the data processing. To their poin…

The notion of incredulity probably comes from fact that it's literally impossible for HTML encoded in s-expressions to be more verbose than HTML encoded in HTML! > To our parent's points, it's more verbose if you're used to passing data into a separate template file. That can help abstract the markup from the data processing. One does not exclude another. The "template" can be another lisp function (in another file).…

Writing templates in Lisp, I think, is an awful idea. Template languages have evolved for a long time to include all the things you will probably need.

For example, imagine if you want to test some HTML code in a browser. Browser doesn't understand Lisp so you have to write it in HTML. And then you have to convert it to Lisp to use as a template. What a waste of time.

There are all king of template languages around. There are editors that can highlight the syntax, there are plugins to write HTML faster. I don't imagine how you justify writing your own template engine. Probably that is just a NIH symdrome.

> First, they work on HTML serialization to string instead of HTML semantics as a tree, making it easy to introduce both bugs and security vulnerabilities.

This can be easily solved by validating HTML code.

> The concepts of "escaping",

Tenmplate engines do necessary escaping automatically. For example, in Twig you just write

    {{ user.getName() }}
and don't have to worry about escaping. I guess in Lisp you cannot even write user.getName() because it doesn't have objects.

> Views absolutely do need code, and so they should be written in a proper programming language.

In my experience, template engines like Twig have enough features. If you need soem complicated logic, you can write a helper function.

Re: Reddit 1.0 source code

#116

Post by codedokode »

bluefox wrote: post #62
nodesocket wrote: post #23

Never played around with Lisp, so excuse the ignorance. Is this typical to construct HTML in Lisp? This feels incredibly verbose and error prone, not to mention confusing and hard to grok. Good luck having a designer mockup/write HTML. (defun login-panel () (pbox "login/register" (:form :id "logform" :class "nomargin" (:table :style "border-collapse: collapse" (:tr (:td :colspan "2" "username:")) (:tr (:td :colspan "…

You could instead write abstractions for generating forms, e.g.: (pbox "login/register" (form (text "username:" :name "user") (pass "password:" :name "pass") (check "remember me" :name "mem") (group (button "Login" :onclick "login(); return false") (button "Register" :onclick "register(); return false")) (link "what's my password?" :href "/password")))

This gets complicated quickly. For example, what if you need to add a CSS class, a placeholder or some custom attribute to an input field? You'll have to write code for every such case.

And you can do the same thing with template engines like Twig with macros. Futhermore, Web frameworks like Symfony already have macros that are necessary to display a form. You don't even have to write them and that is a strong point of Symfony compared to weird self-made Lisp template engine.

Re: Reddit 1.0 source code

#117

Post by TeMPOraL »

codedokode wrote: post #115
TeMPOraL wrote: post #63

Earlier quoted context omitted.

The notion of incredulity probably comes from fact that it's literally impossible for HTML encoded in s-expressions to be more verbose than HTML encoded in HTML! > To our parent's points, it's more verbose if you're used to passing data into a separate template file. That can help abstract the markup from the data processing. One does not exclude another. The "template" can be another lisp function (in another file).…

Writing templates in Lisp, I think, is an awful idea. Template languages have evolved for a long time to include all the things you will probably need. For example, imagine if you want to test some HTML code in a browser. Browser doesn't understand Lisp so you have to write it in HTML. And then you have to convert it to Lisp to use as a template. What a waste of time. There are all king of template languages around.…

> Template languages have evolved for a long time to include all the things you will probably need.

Which is what turned them into Turing-complete languages that try to pretend they're not.

> For example, imagine if you want to test some HTML code in a browser. Browser doesn't understand Lisp so you have to write it in HTML. And then you have to convert it to Lisp to use as a template. What a waste of time.

Not much time is wasted, especially that s-exps are faster to write than HTML (especially with editor support). Browsers don't understand templates either, so in both cases you have to do some conversions. I'll give a point to HTML-ish template languages here, but I don't believe the time spent on manually converting large chunks of template code into browser-edible HTML and back is anywhere near the critical path on the project.

> This can be easily solved by validating HTML code.

That's validating vs. making it literally impossible to emit invalid HTML.

> I guess in Lisp you cannot even write user.getName() because it doesn't have objects.

Haha. Right. No, Lisp actually has objects. You'd write it as (get-name user), since the syntax for function calls in Lisp is consistent.

Post reply on HN