tenderlove

13 ms·

91.
by tenderlove 14y ago
Stupid Sexy Flanders!
92.
by tenderlove 14y ago
You'll have to ask @bitsweat. I only accept hugs. <3
93.
by tenderlove 14y ago
I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!
94.
by tenderlove 14y ago
You need a way to inject symbols as hash keys. Normal parameter handling does not allow this, so you need a different way to exploit the bug. As venus says, session forging is one way. Regular parameter handling is not.
95.
by tenderlove 14y ago
Yes, it's true. You'd have to pass symbol keys. It's not easy to reproduce.
96.
by tenderlove 14y ago
Yes, the article does mention session secrets. However, this exploit does not require session secrets. The person who wrote the blog post wrote about essentially two vulnerabilities: session forging and SQL injection.
97.
by tenderlove 14y ago
They should also use principles from the Object Management Group.
98.
Ruby 2.0.0-preview1 is out(blade.nagaokaut.ac.jp)
115 points by tenderlove 14y ago|62 comments
99.
by tenderlove 14y ago
Well, it does actually define locals. But, IIRC, it uses the symbol hash parsing productions, so the default values are required. The only way to specify required parameters (without the above hacks) is to do a traditional method definiti
100.
by tenderlove 14y ago
> Named arguments yes, though it's basically an optional argument hash. AFAIK, you can't do required named arguments without weird hacks, or specifically checking the arguments. For example: irb(main):007:0> def foo(bar: b
101.
by tenderlove 14y ago
I'm waiting for the movies.
102.
Evaluate Scheme in Ruby's virtual machine(gist.github.com)
24 points by tenderlove 14y ago|2 comments
103.
by tenderlove 14y ago
lol! Do you have suggestions for improvement? I'm not sure what I'm doing to brand the site. My expertise is in tech, not branding. I'm open to suggestions, but I will not compromise on the color pink (or Ruby-San)! :-)
104.
by tenderlove 14y ago
> > I want to write to the socket. > That's what you do when you yield to the each's block. No IO object in ruby uses the `each` method for writing.
105.
by tenderlove 14y ago
Ah, sorry. I forgot to mention thin. I will update the article. I just mentioned the web servers I've tested with! :)
106.
by tenderlove 14y ago
Yup, IO objects use `each` for reading. I want to write to the socket. I am lamenting the hoops I have to jump through in order to make a reader act like a writer. Somehow data must be fed to the `each` function which means probably a Q
107.
by tenderlove 14y ago
I didn't go in to this in much detail in my article, but I'd like to follow up with my long term plan for this feature. I think that buffered responses are a special case of streaming responses (they're streaming responses with one chunk),
108.
Live Streaming in Rails 4.0(tenderlovemaking.com)
141 points by tenderlove 14y ago|38 comments
109.
by tenderlove 14y ago
Actually, I find it easy to read compared to some other functions in MRI. The trick is that it keeps the symbol in a global table (that never gets reaped).
110.
by tenderlove 14y ago
Crap. I keep forgetting to submit these announcements to hacker news. I'm saving up my HN points to get a commemorative pin! ;) If you have questions about the release, or the security issue, fire away. :-)
111.
BiwaScheme is a Scheme interpreter written in JavaScript.(biwascheme.org)
3 points by tenderlove 14y ago|0 comments
112.
by tenderlove 14y ago
I think it depends on the situation, and it's difficult to for me to describe. I try to think about it like this: I am writing a class to represent a car. I need to know if the cars doors are opened or closed. The `open` or `closed` attr
113.
by tenderlove 15y ago
A couple tricks that are specific to MRI and probably not useful for everyday programming: 1. Get the bytecode for some code: irb(main):001:0> x = RubyVM::InstructionSequence.new '1 + 1' => <RubyVM::InstructionSequence
114.
by tenderlove 15y ago
Only if you're reading Fibonacci numbers from an I/O. Fibur only allows concurrency while doing I/O operations.
115.
by tenderlove 15y ago
Yes.
116.
by tenderlove 15y ago
AMBER ALERT!
117.
by tenderlove 15y ago
Yes, I am very excited. I should have released during business hours with announcements prepared and whatnot, but I really wanted this code in people's hands. I hope that everyone enjoys this release!
118.
by tenderlove 15y ago
Well, we don't have a JS runtime on all our web boxes in production. As such, we precompile all our assets before deploying, so sprockets doesn't really buy us much besides being "baked in". To migrate our apps, it seems easier to upgrade
119.
by tenderlove 15y ago
I think it's unlikely that many people will switch from Jammit to Sprockets. At work, we will not switch. Sprockets is built on the assumption that you will be running a JavaScript runtime on your production machines. I'd prefer that we
120.
by tenderlove 15y ago
Progress is moving slowly. I'm not sure there's much I can ask you to do. The best thing is if I can lighten my other responsibilities, like bug fixes, etc. :-/

More ›