12 ms·
GNU Artanis – A fast web application framework for Scheme
- alphazard 1y ago[flagged]
- coderatlarge 1y agothe page also says “ GNU Artanis was Certificated as Awesome Project at 2013 Lisp in summer projects “ so i guess this is not news?
- tjr 1y agoIt looks like the latest 1.3.0 release just happened a few days ago, but that isn't clear from (or even stated on) the linked web page.
- mindcrime 1y ago> so i guess this is not news? Does it matter? Despite the name of the site, not everything that is posted/discussed here needs to be "news". Far from it, in fact.
- kazinator 1y agoNews to me; I've not heard of it, and I bumble around in the Lisp world.
- smcl 1y ago[flagged]
- serhart 1y agoRelax, it's just a play on https://www.poetryfoundation.org/poems/43291/sailing-to-byzantium https://www.poetryfoundation.org/poems/43291/sailing-to-byza... The code is a mouse wheel scroll down.
- smcl 1y agoCalm down it was a little joke, no need to flag me
- Y_Y 1y ago> Sorry, that poem is currently unavailable. The poem actually loaded, but then flipped to that. Thank god Yeats' work is protected by clever JavaScript from people in third-world countries who dare try to read it.
- kwk1 1y agoWow, that is a hefty poem. Thanks for explaining the reference. Edit: Just to share a bit, here's more background on it from Wikipedia. https://en.wikipedia.org/wiki/Sailing_to_Byzantium https://en.wikipedia.org/wiki/Sailing_to_Byzantium
- aaron_m04 1y agoProjects using it is 404.
- iameli 1y agoIs this named after the Protoss Executor Artanis?
- fixmycode 1y agoif it's any consolation, the Protoss executor Artanis was named after Frank Sinatra
- shakna 1y ago> Has a Sinatra-like style route, hence the name "Artanis" ;-)
- stackghost 1y ago"Artanis" backwards is "Sinatra" which happens to be the name of a popular Ruby gem for web dev.
- vincent-manis 1y agoAnd was a gag in the ancient Dick van Dyke show, where Dick's character gets a painting signed by `Artanis', and thinks it worthless, until someone spells it backward.
- maz1b 1y agoMy first thought as well. State your will!
- shakna 1y agoI've used this in production once. Mostly able to because Guile's web server is standard, and if you need to bypass the framework, you can rather easily. It's more than fast enough for most people's needs. Flexible, because Scheme, and Artanis' design will be familiar to all the Flask/etc devs.
- whizzter 1y agoMaybe you can answer one thing that pickled my mind, no mention of CSRF protections,etc in the documentation that seems to cover quite a few bases. (apart from one xss symbol application that I couldn't fully decipher).
- zelphirkalt 1y agoXSS should not be a problem with many Scheme dialects and Lisps, unless you render JS from user input. This is because SXML does not treat HTML as a mere string, but as structured data (as any sane library should, but very few do). So if you get some user input and want to display that in some label or paragraph or whatever, then SXML is aware what is a tag and what is text content of the tag, due to how you build the SXML expression. This is not PHP or something. I do not know, whether GNU Artanis makes use of SXML all the way, but I think it is very likely, since SXML is in GNU Guile's standard library.
- whizzter 1y agoYou're talking about injection attacks when escaping isn't present. CSRF is cross site request forgery, f.ex. creating a POST form on a hostile site that targets a POST processing endpoint in on site with data that the user didn't want to supply, but whose login cookie would authorize the request at the target. Many frameworks inject an per-user "authentication" cookie in form's that is validated upon request, this way an attacker cannot trick the users browser to submit data since they don't have the correct CSRF-cookie. https://owasp.org/www-community/attacks/csrf https://owasp.org/www-community/attacks/csrf https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF https://developer.mozilla.org/en-US/docs/Web/Security/Attack...
- rolandog 1y agoBeautiful and clean website (loads well without JS and fonts); not sure why some people are reacting negatively to some poetry... I swear, HN crowd can be often worse than Mean Girls. About Artanis itself... It looks really cool! Scheme is such a nice language to code and hack with; but, how safe would it be to expose it directly? I see they are dogfooding on the Guix packages website, so... I'm guessing it's pretty well tested.
- edoloughlin 1y ago> not sure why some people are reacting negatively to some poetry... As another commenter pointed out, the poem is a parody of a Yeats poem. An an extract from another of his poems might offer some insight into the reactions... What need you, being come to sense, But fumble in a greasy till And add the halfpence to the pence And prayer to shivering prayer, until You have dried the marrow from the bone
- neilv 1y ago> Scheme is such a nice language to code and hack with; but, how safe would it be to expose it directly? If you have really good Scheme programmers, who know their system, and built it competently, it's probably safer to expose that than your average conventional system. (Example: A system in Scheme was the first to get a particular certification for sensitive data hosting on cloud servers. Partly because the very small team that developed it knew the stack inside and out, and could do whatever needed to be done, in a smart way.) (Meanwhile, say, a consulting firm-led team who got a contract for a comparably complex system, and billed for 10 or 100 times the seat-warmers, with huge and ridiculously complex stacks they didn't understand... would just flounder, focus on appearances in sprint tasks, and churn out things implemented in poor ways, and with a large number of vulnerabilities, and probably take a lot longer before they could deliver a system that would survive the first day of use.)
- evertedsphere 1y ago> A system in Scheme was the first to get a particular certification for sensitive data hosting on cloud servers. What system was this?
- aorlov_a 1y agoI so appreciate the website. So easy to read makes it appealing to try the framework, especially taking into account the most recent experience writing on Scheme was back in college 15 years ago.
- neilv 1y agoJust a comment on APIs in Scheme... If you're defining a Web server route handler, it's reasonable to do it as you would in most languages, like this package's example: (get "/hello/:who" (lambda (rc) (format #f "<p>hello ~a</p> " (params rc "who")))) But the following might be easier syntax extension in Scheme, in which each variable URL path element can be mapped for the programmer directly to a Scheme variable binding in the closure: (define-http-get-route ("/hello/" who) (format #f "<p>hello ~a</p> " who)) (Of course, you'd also have a function to sanitize/escape `who` before injecting it into the HTML.)
- taeric 1y agoWhy not keep the string as normal, but still do as you are suggesting? Shouldn't be too hard to have the macro parse it out so that the following would work, no? (define-http-get-route ("/hello/:who") (format #f "<p>hello ~a</p> " who))
- danlitt 1y agoIMO the whole point is to get rid of the string as normal. The whole "/hello/:who" syntax is weird and arbitrary, it is a different way of declaring a variable which adds an unnecessary extra step to understanding the code.
- taeric 1y agoIt matches the Open API specifications, is about the only reason I would try to support it.
- neilv 1y agoYes, with some of the fancier Scheme/Racket syntax transformers, you can do that string parsing at syntax expansion time. Sometimes it makes sense (e.g., if you want to support chunks of hairy SQL pasted into the code). I could go either way on how to specify Web server routes, but decided to go with the way I did, for 3 reasons: 1. Looks more familiar to Scheme programmers, without bindings coming out of strings (which I don't think is idiomatic Scheme). 2. Can be implemented more portably, including in Schemes that have only `syntax-rules` as a transformer. 3. If more semantics are added to the route specification later, such as type or validation, you might want want to be doing it in s-expressions rather than in a string.
- mmargerum 1y agoDisappointed they didn’t use hiccup to generate html. Format?
- terminalbraid 1y agoWhat's the guile hiccup package? Or are you confusing scheme with clojure?
- rcarmo 1y agoI have to wonder why Guile hasn’t become more popular over the years, frameworks or not. It ships with so many distributions that the ease of access is there, but I’ve yet to come across any significant code base using it for web apps.
- ahoka 1y agoI think Scheme, however elegant, is just not really a practical language, especially its standard library situation.
- mhitza 1y agoMaking it clear that I never worked with Racket... Guile was the most ergonomic Scheme I used. Great documentation, "mostly" batteries included, and a while loop macro (the blasphemy, but the convenience!). The reason I switched was that I wanted to use my small programs on servers, and with Chicken Scheme it was easy to build a statically linked executable. Guile should definitely be packageable as such, if someone versed in C has the patience, but it isn't out of the box and there are no "project templates" out there.
- mark_l_watson 1y agoJust my personal opinion: Racket and Gerbil Scheme are the most useful Schemes because of their fairly rich standard libraries. There are other Schemes I like to play with but I don’t do much with. Sorry for the plug, but I wrote a Racket book last year and I am just now about 20% of the way through a Gerbil Scheme book. I have a luxury: I am retired so I can write on topics that fascinate me, even if I get small audiences.
- rcarmo 1y agoIt's a good plug. I've had an eye on Gerbil for a while, and miss the batteries included aspect of Python when compared to overall Schemes
- zelphirkalt 1y agoThe standard library can be very practical, if it implements the SRFIs you need. And Guile implements quite a lot of them.