HN user
quinnwilton.com
[ my public key: https://keybase.io/quinnwilton; my proof: https://keybase.io/quinnwilton/sigs/RWWjIgOCtLO7zky-yIgatpgLiCyvFsr4qLvGYMvIPO8 ]
It's difficult to take comments like this in good faith when the Github profile linked on your account prominently features your signature on a letter calling for Richard Stallman to be reinstated to the FSF after his resignation, following his comments defending sex with minors and child pornography.
To an extent, you get this with Datalog, which is an easily embeddable subset of pure Prolog.
I've been spending a ton of time with the language and its implementation through my day job, and I recently spoke about its use as a DSL for embedded knowledge bases: https://www.youtube.com/watch?v=lYLkaOq7WbU
I wonder if it's fair to consider it constraint-based programming rather than just logic programming
Prolog III is considered the origin of constraint logic programming: http://www.prolog-heritage.org/en/ph30.html
This has historically been fairly common among a lot of the early Elixir libraries, and I'd imagine that's a byproduct of many of the early adopters coming from the Ruby ecosystem, and not having prior experience with the patterns used in Erlang. I think some of the early confusion surrounding how application config should be used also led to some misguided decisions early on.
Fortunately it's something that I've seen improve over time, but it's a pain-point I've run into with a lot of dependencies, so I try to call it out when I see it.
Yes, that's mostly it!
A lot of what I'm talking about has to do with configuration, but reuse is another big element. Your example has no configuration, and so is good in that regard, however your example is not reusable, in the sense that it's only possible for a single counter to exist.
I realize this is a contrived example, because you were trying to keep things simple, but if I needed two distinct atomic counters in my app, then I wouldn't be able to use Ergo, as it's currently implemented, because the application only starts a single counter, and doesn't provide any capabilities for starting additional counters.
You could change Ergo to get around this, possibly by instead running a dynamic supervisor that can start named counters under it, using something like `Ergo.create_counter/1`, but this would only address this specific use case.
To go back to my last comment, if you instead exposed, for example, a `__using__` macro that modules could use to define new counters, then callers would be able to integrate as many counters as they needed, whenever or however into their supervision tree as they required.
This ties back to the testing point too: if the process is a singleton, managed by the application, then you can only run one test against that process at a time in order to isolate the state for this tests, and you need to ensure you properly clean up that state between tests. Instead though, if the library allows you to start the processes yourself, then each test can use `start_supervised!` to start it's own isolated copy of the process, which will be linked to the test's process, and automatically cleaned up once the test finishes.
Problematic is probably too strong of a term, and I think I'd use the word inflexible instead.
I want to be clear though: my issue isn't with applications -- the functionality you're talking about is powerful and useful -- it's purely with the tendency of starting a static and global supervision tree as part of a dependency: see some of the other comments in this thread for some neat examples of how applications like ssh and pg2 handle supervision.
When libraries are written like this, they usually start everything up automatically, and pull from their application environment in order to configure everything. This means that this configuration is global and shared amongst all consumers of the library.
Imagine an HTTP client, for example, that provides a config key for setting the default timeout. This key would be shared among all callers, and so if multiple libraries depended on this client, their configurations would override each other.
Fortunately, Elixir now recommends against libraries setting app config, so this problem is partially mitigated, but it's still a concern within your app: if I'm calling two different services, I want to use different timeouts for each, based on their SLA, so having a global timeout isn't helpful.
Instead, in this situation, I'd prefer something like what Finch provides, where I'm able to start different HTTP pools within my supervision tree, for different use-cases, and each can be configured independently: https://github.com/keathley/finch#usage
Another approach would be to do something like what ssh does, and have the Finch application start a pool supervisor automatically, but then provide functions for creating new pools against that supervisor, and linking or monitoring them from the caller.
There's a few other techniques you can use too, with different tradeoffs and benefits: like Ecto's approach of requiring that you define your own repo and add that to your tree. Chris Keathley describes some of those ideas here: https://keathley.io/blog/reusable-libraries.html
Global trees like this are also harder to test, especially if they rely on hardcoded unique names, and usually restrict you to synchronous tests, since you can't duplicate the tree for every test and run them independently of each other.
Again though, I want to stress that running processes in the library's application is not my problem: it's just not having any control over when or how those processes are started.
I'm just responding on my phone, and I need to run for a few hours, but feel free to ask for more info or reach out. I'm always happy to talk about this stuff! I enjoyed your article, and I apologize if my initial comment came across as an attack on your core points.
Yes! This is a great approach, and I'd be happy to see more examples like this in the wild. This is similar to the same way Phoenix PubSub works, with the PubSub application starting a pg scope as part of its supervision tree, that client PubSub servers can join if configured to use the pg adapter.
I was a little bit flippant in my initial comment, but my main criticism was of libraries that don't support any sort of hooks like this into their supervision strategy, and instead rely entirely on a global and static supervision tree, usually configured using app config.
Agreed. I also wish fewer libraries started their own supervision tree, and instead gave you a child spec to drop into your supervision tree. There's definitely use-cases where shipping libraries as an application makes sense, but oftentimes that sort of design causes problems for me, because it means not being able to start multiple copies of the dependency with different configurations.
I think Phoenix PubSub is a perfect example of how libraries should be structured, in that you just need to drop the module + options into your supervision tree, and you have the freedom of starting multiple independent copies of the tree, in different contexts, and with their own configurations: https://hexdocs.pm/phoenix_pubsub/Phoenix.PubSub.html#module...
I don't think this is a fair argument. Sure, the shirt probably isn't appropriate for a business casual environment, but that doesn't change the fact that this behaviour is sexual harassment: made worse by the fact that the recruiters are acting from a position of power.
It's also worth pointing out that these events occurred at Black Hat, in Las Vegas: what passes as acceptable business attire there is not the same as what would fly in an office, and I guarantee there were plenty of people wearing far more risqué shirts without facing any harassment.
It's easy to try to pin some responsibility on the woman here, but that ignores the fact that this sort of language and culture is extremely common at Black Hat and DEFCON, and a shirt like she was wearing would not have been out of place at the conference. Hell, I wouldn't be surprised if she won the shirt at the conference.
From the year before, here [0] is a sign from the vendor area at Black Hat, featuring an underwear clad model with the caption: "You know you're not the first... but do you really care?"
Similarly, to this day, DEFCON, held one week after Black Hat, and likely the largest security conference in the world, still holds a "Hacker Jeopardy" competition, featuring strippers who remove their clothing as contestants answer questions correctly.
I only say all of this because I think a lot of context is being lost in this article, by people who haven't been to these conferences: the women's shirt wouldn't have been what singled her out here, her gender was, and for the recruiters to harass her for that is unacceptable.
Finnegan's Wake absolutely exists to be read, or even sung, out loud. If you've never gotten the appeal, just try listening to the start of an audiobook version. There's a Youtube series that covers the first few chapters that I adore: https://www.youtube.com/watch?v=6HgCjtd2iPU
I think an obvious solution would be to exclude anyone who is incapable of managing the bare minimum level of professionalism that's required in a workplace.
If someone is incapable of managing their feelings in a workplace then maybe they don't belong in one, and their colleagues should not be the ones who are punished for that.
I don't expect you to agree with me here.
Plenty of us have absolutely no problem working in same-sex environments, and plenty of straight people have no issues working in coed environments.
This is very clearly a case of the professor being unprofessional and exploitative of his position of power.
Where do non-straight people fit into this "solution"?
For what it's worth, I spoke last year about using Gleam to develop a type-safe core for a LiveView application: https://www.youtube.com/watch?v=UCIcJBM_YDw
I think that what you're looking for is already possible today, and that things only get easier over time.
Oh and it wasn't. That was the least of the school's problems though.
They also used a surveillance system called LanSchool, which sent out all of its commands entirely unencrypted and unauthenticated, so people would spoof the remote takeover command and steal exams from teachers' accounts. It ended up being a whole thing my senior year.
My highschool physically removed the right mouse button from the mice, because we were right clicking to make text files that we'd rename as batch files to get a command prompt open.
Some people would just bring their own mouse in to get past the defences.
This is a really tough question to answer, because the answer depends on what you're using JWT for. JWT crams as much functionality into the format as possible, and most of that functionality isn't needed for most use cases. This means that offering an alternative requires knowing some context about what you need out of JWT in the first place.
That being said, for most purposes, you can do worse than using either mutual TLS or Macaroons [0]. As always with cryptography though, the devil is in the details, so for a more thorough discussion, check out @tptacek's "A Child's Garden of Inter-Service Authentication Schemes" [1]. It's one of my favourite treatments of the topic, and discusses the tradeoffs of a few different techniques for different use-cases.
[0] https://en.wikipedia.org/wiki/Macaroons_(computer_science)
And all of this is to say nothing of the frankly embarrassing problems that have plagued JWT as a result of algorithm agility (alg=none). Removing agility from JWT wouldn't make it a good specification, but it would certainly make it a better specification.
I think this is very indicative of Winkelmann's philosophies about software in general. On his site he writes a little bit about why he thinks Forth is so important, and I think it makes for a good explanation of why he probably implemented Strand like this:
http://www.call-with-current-continuation.org/articles/forth...
Oh thank you for sharing! I've never come across this, but there's some great references in the README I'll have to go through.
Unfortunately not: it's a physical copy and was a very generous gift from a friend yesterday, who knew I had been trying to track down a used copy for over a year.
Not that I've seen yet, but the manual does include this passage:
Strand provides pattern matching but no general unification, instead logic variables must be explicitly assigned, which simplifies the semantics considerably.
What isn't clear from this snippet, that I think is incredibly cool, is that all of the expressions within a function (here, called processes), actually run in parallel.
In this snippet:
count(N) :- N =< 10 | even(N), N2 is N + 1, count(N2).
Where it gets weird, is that the resulting three processes have data dependencies between them, so if the third process were executed first, count(N2), the dependency on N2 wouldn't be satisfied, and so that process would suspend, and a new process be chosen for execution.
It's easy to look at this line of code and think that the three expressions will execute in the order they're written, but any interleaving of them is possible, with that sort of non-determinism being built into the language by design.
I'm currently reading the Strand book, and it more or less describes the language as being Prolog, but without unification and backtracking: instead treating dataflow as being the basis for the computational model.
Yup! The original Prolog implementation is described in "Use of Prolog for developing a new programming language" [0], and took place in 1986. After performance eventually became an issue, they cross-compiled Erlang to a few other concurrent languages (Strand included), before opting to directly implement Erlang in C.
[0] http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.34.3...
Joe Armstrong and Robert Virding actually experimented with compiling Erlang to Strand. I'm not familiar with all of the details, but I believe they saw a factor of six speedup as compared to the Prolog implementation [0], but deemed the project a failure because of the complexity involved in restricting Strand's parallelism and failure to meet their target of a 70x speedup [1].
I'm actually sharing this in the first place because I managed to acquire a copy of "Strand: New Concepts in Parallel Programming" [2] yesterday, and it includes a case study about the Erlang -> Strand compiler, so I've been having fun trying to piece together the lineage.
[0] https://erlang.org/download/armstrong_thesis_2003.pdf
[1] http://erlang.org/pipermail/erlang-questions/2007-September/...
[2] https://www.amazon.com/Strand-New-Concepts-Parallel-Programm...
I'm a huge fan of GraphQL, and work full-time on a security scanner for GraphQL APIs, but denial of service is a huge (but easily mitigated) risk of GraphQL APIs, simply because of the lack of education and resources surrounding the topic.
One fairly interesting denial of service vector that I've found on nearly every API I've scanned has to do with error messages. Many APIs don't bound the number of error messages that are returned, so you can query for a huge number of fields that aren't in the schema, and then each of those will translate to an error message in the response.
If the server supports fragments, you can also sometimes construct a recursive payload that expands, like the billion laughs attack, into a massive response that can take down the server, or eat up their egress costs.
Chromium EC. It's the part of Chromebooks that handles things like keypresses: https://chromium.googlesource.com/chromiumos/platform/ec/+/m...
You'd likely be interested in the work done by Eric Oestrich in building MUDs with Elixir.
Kalevala: a world building toolkit for text based games, written in Elixir [0]
ExVenture: a text based MMO server written in Elixir [1]
Grapevine: a MUD chat network [2]
[0] https://github.com/oestrich/kalevala
I love this, and I'm excited that you've finally released it!
One of the biggest issues I run into with using Elixir as a scripting language is the difficulty of making use of libraries in a REPL without first installing them into a Mix project. Sometimes I really just want to open up a shell that has access to my HTTP client + JSON parsing library of choice, and until now, my workaround has been using a Mix project that I toss everything into.
I'm very excited to dive through the code and see how you've implemented everything!
I grew up learning to program on Roblox 14 years ago, and more than a few of my friends from back then are now wildly successful engineers.
It's only gotten more advanced since then, and if I were a parent, I'd love for my kids to be making games on the platform.