hynek

21 ms·

61.
by hynek 11y ago
ATM it takes work to create a deployable artifact. We package virtualenvs using fpm, others use Docker. But Go just spits out a single binary you can scp anywhere (the build process OTOH is more painful IMHO). That’s why I’m highly curious
62.
by hynek 11y ago
I would recommend to even use pyenv ( https://github.com/yyuu/pyenv ) that will allow you to install any Python version in your home directory (i.e. not fucking up your system installation). If you maintain many FOSS l
63.
by hynek 11y ago
That’s only true for people who are part of the community for a long time. Newcomers don’t understand what the fuss is about and why anyone would want to use Python 2. My own Python bubble is more like what you described (although the mood
64.
by hynek 11y ago
Hm that’s unfortunate that it comes out that way. I thought I’m just acknowledging that people are agonizing over them and then explain why’s not a good metric.
65.
by hynek 11y ago
Yes! RedHat needed it too and forked the project: https://pypi.python.org/pypi/pyldap
66.
by hynek 11y ago
Ah yeah the small nice things. `raise from`, `__traceback__` on all raised exceptions (instead of dicking with `sys.exc_info`), `nonlocal`, `super` …
67.
by hynek 11y ago
That’s exactly the place I found myself in and that made me sum it up.
68.
by hynek 11y ago
Hmm I’m not sure how to take this comment. The main point of the article is basically that those numbers don’t tell the whole story (even explicitly in footnote 1).
69.
by hynek 11y ago
Look, nobody is defending the title. I’ve even apologized for it here and in the article and explained how it happened. But if you insist on keeping to beat the dead horse tells more about you than the title.
70.
by hynek 11y ago
There is absolutely nothing hasattr does that you cannot achieve with other means in a more robust way and with minimal impact. It’s not like ditching goto that requires a completely different approach to programming.
71.
by hynek 11y ago
TBH it was just a quick write up to point ppl to in discussion as said in the intro. I never spent much time to ponder the attractiveness/SEOability etc.
72.
by hynek 11y ago
It’s not about abuse, it’s about behavior/consequences most people don’t realize.
73.
by hynek 11y ago
Aw thank you!
74.
by hynek 11y ago
Cf https://twitter.com/ircmaxell/status/685207462992035841 & ff
75.
by hynek 11y ago
It isn’t raised in the middle of testing the hash. The testing is completely done in the Argon2 C library and the bindings raise an error if it returns an error. The Python library doesn’t do anything smart at all except calling C functio
76.
by hynek 11y ago
You should rate-limit your logins anyway lest you want to end like Apple & Fappening.
77.
by hynek 11y ago
BLAKE was pretty close to becoming SHA3. The only reason Keccak was chosen is that BLAKE was too similar to SHA2 (which has no known weaknesses).
78.
by hynek 11y ago
Two reasons: 1. mainly: the C library has no concept of “wrong password”; only “verification failed with an error”. If you want to know why it failed, you need the error. As you can see in the example, a wrong password is "Decoding
79.
Storing Passwords in a Highly Parallelized World(hynek.me)
167 points by hynek 11y ago|65 comments
80.
by hynek 13y ago
It’s very early now, so I think one of the most helpful things would be to look at the API discussions and tell us if something doesn’t make any sense to you. That would mean that a) the API is bogus or b) the docs/rationale are insuf
81.
Sharing Your Labor of Love: PyPI Quick And Dirty(hynek.me)
12 points by hynek 13y ago|1 comments
82.
by hynek 14y ago
I felt like it was good to mention it when we started out to give context. I’ve banned it now to a sub-page. I don’t want to remove it for good so nobody accuses us of being sneaky and ignoring incidents or something like that. It’s not the
83.
by hynek 14y ago
Unfortunately mass media chose to report only on donglegate. One of them even started with something like “PyCon was as boring as a tech conference goes [until donglegate].”
84.
by hynek 14y ago
last time i checked none of them got nightly creeper calls and death threats because of their involvement with PyCon. if you know of any, i’ll add them.
85.
by hynek 14y ago
You can because you’re still using logging if you want. You only use a different ‘Handler’ which writes your entries to stderr instead of into a file. That’s the advantage of logging’s modularity. In the examples, I set the log level to INF
86.
by hynek 14y ago
It very much depends on your target audience. We’re in the web hosting business and whenever we try to be a bit more progressive, people start yelling at us that their IE 4-using customers in rural Mongolia can’t SSL-surf their shop. When i
87.
by hynek 14y ago
Oh certainly not a crisis – especially since it didn't bring new vectors to the table. I just saw many “what now!?”s in my timelines and figured I better give them a solid good-enough solution that just works before they do something stupid
88.
by hynek 14y ago
Hm, I'm just on my phone now and going to bed but here's link from RH's bugzilla going into it, maybe it's of any help to you: https://bugzilla.redhat.com/show_bug.cgi?id=857051#c5 Can't say any more than that it works for us – we compile
89.
by hynek 14y ago
Yes, the discovery of Lucky13 and the following helplessness by many not-really-ops-but-doing-it-anyway people were the motivation to write that article in the first place. To get a minimal baseline security out there. Those who know better
90.
by hynek 14y ago
Yes, but some of the ciphers aren’t supported in widely used OpenSSL versions (like 0.9.8). I wanted to give people a configuration that works everywhere and is reasonable secure. If they want more, there’s a link list at the end. Let’s not

More ›