3 ms·

Show HN: IRC client example written in Octaspire Dern [video]

4 points by octaspire 9y ago

shurcooL 9y ago
Is the source code of the example available somewhere?
- thomasdziedzic 9y ago
  The latest commit in the github repo has an example of an irc client: https://github.com/octaspire/dern/commit/fab2f5a2766a16fffc7bee57e71b8d49371a2ee6 https://github.com/octaspire/dern/commit/fab2f5a2766a16fffc7...
throwaway2016a 9y ago
My thoughts in order: 1. Cool, I've never heard of Octaspire Dern, it looks interesting 2. I remember years ago implementing an IRC client in C++ by spending hours studying the RFCs. It was fun. Though it ends up being way more lines of code but had a GUI and and the peer to peer extensions. 3. Did that video just download a binary from HTTP not check the hash of the file and just compile and run it !?!? I do wish the internet would stop encouraging running arbitrary code on your machine without at least checking the signature especially over HTTP that can be MITM'd do easily. Not as bad as piping curl directly to the shell though. Edit: looking at the websites it even has a file you can download with the checksums in it (although over HTTP still) but if it's there it should be used.
- octaspire 9y ago
  Thank you for the kind words and the feedback! Some notes on the third point on the list: * Latest release of Octaspire Dern can be downloaded through secure HTTPS connection from here: https://octaspire.github.io/dern/release.tar.bz2 SHA-512 checksum for the latest release can be downloaded from: https://octaspire.github.io/dern/checksums SHA-512 checksums of all past releases can also be found from: https://octaspire.github.io/dern/ What I have done in my other asciicasts is this (for example in Dern introduction/tutorial at https://asciinema.org/a/123972): curl -O octaspire.com/dern/release.tar.bz2 tar jxf release.tar.bz2 cd release/* curl -O https://octaspire.github.io/dern/checksums sha512sum -c checksums This is what I have recommended in the manual http://www.octaspire.com/dern/Programming_in_Octaspire_Dern.html Both the release and checksums could be downloaded from https://octaspire.github.io/dern/ but I though that by downloading them from two different servers (octaspire.com and octaspire.github.io) would have the added safety factor that attacker would have to get access to both distinct servers to be able to modify both the release and the checksums. And the checksums are available only through HTTPS, even if the release is available through HTTP and HTTPS. But I too recommend to always check the checksums. I should not have cut corners while making this video. Or at least I should have downloaded the file through HTTPS when not checking the files.
  - throwaway2016a 9y ago
    I noticed it can be done. I was juts pointing out that it wasn't done in the video.

4 points by octaspire 9y ago

shurcooL 9y ago

Is the source code of the example available somewhere?

thomasdziedzic 9y ago
The latest commit in the github repo has an example of an irc client: https://github.com/octaspire/dern/commit/fab2f5a2766a16fffc7bee57e71b8d49371a2ee6 https://github.com/octaspire/dern/commit/fab2f5a2766a16fffc7...

throwaway2016a 9y ago

My thoughts in order: 1. Cool, I've never heard of Octaspire Dern, it looks interesting 2. I remember years ago implementing an IRC client in C++ by spending hours studying the RFCs. It was fun. Though it ends up being way more lines of code but had a GUI and and the peer to peer extensions. 3. Did that video just download a binary from HTTP not check the hash of the file and just compile and run it !?!? I do wish the internet would stop encouraging running arbitrary code on your machine without at least checking the signature especially over HTTP that can be MITM'd do easily. Not as bad as piping curl directly to the shell though. Edit: looking at the websites it even has a file you can download with the checksums in it (although over HTTP still) but if it's there it should be used.

octaspire 9y ago
Thank you for the kind words and the feedback! Some notes on the third point on the list: * Latest release of Octaspire Dern can be downloaded through secure HTTPS connection from here: https://octaspire.github.io/dern/release.tar.bz2 SHA-512 checksum for the latest release can be downloaded from: https://octaspire.github.io/dern/checksums SHA-512 checksums of all past releases can also be found from: https://octaspire.github.io/dern/ What I have done in my other asciicasts is this (for example in Dern introduction/tutorial at https://asciinema.org/a/123972): curl -O octaspire.com/dern/release.tar.bz2 tar jxf release.tar.bz2 cd release/* curl -O https://octaspire.github.io/dern/checksums sha512sum -c checksums This is what I have recommended in the manual http://www.octaspire.com/dern/Programming_in_Octaspire_Dern.html Both the release and checksums could be downloaded from https://octaspire.github.io/dern/ but I though that by downloading them from two different servers (octaspire.com and octaspire.github.io) would have the added safety factor that attacker would have to get access to both distinct servers to be able to modify both the release and the checksums. And the checksums are available only through HTTPS, even if the release is available through HTTP and HTTPS. But I too recommend to always check the checksums. I should not have cut corners while making this video. Or at least I should have downloaded the file through HTTPS when not checking the files.
- throwaway2016a 9y ago
  I noticed it can be done. I was juts pointing out that it wasn't done in the video.