zedshaw

57 ms·

601.
by zedshaw 16y ago
You'd use both HTTPS and this, as I mentioned before. This just means that a site using the service, if they use it right (big if), doesn't have to worry about password storage or securing them and leaves it to autho.me. Otherwise, everyt
602.
by zedshaw 16y ago
Haha, suck it! :-)
603.
by zedshaw 16y ago
You like that? I was going for a "this shit is crazy" motif. Just to make sure it's clear that it's new and not tested yet.
604.
by zedshaw 16y ago
Designed on Linux actually, and looks fabulous!
605.
by zedshaw 16y ago
It took me a week+ to get this far with it, and it's still not totally right. It is definitely not "easy" to do. But, I'm thinking the main reason someone would do this is if they wanted to not be responsible if there was a break-in, and t
606.
by zedshaw 16y ago
I'll do that, and have read that.
607.
by zedshaw 16y ago
Sure. I'm thinking it'd probably be up to the site using the service what their login policy is.
608.
by zedshaw 16y ago
Wow, longer than a single line comment. I'm impressed. :-) I agree totally on all your points, and this still needs work, as I said. But that age old boogeyman from the 90's of "javascript cryptography is flawed" has to go. It works just
609.
by zedshaw 16y ago
I'm not sure yet since I haven't got the API designed, but I will aim for autho.me to be a centralized web service that your clients and/or webservers use to auth people. Most likely you wouldn't even know they're using it unless they choo
610.
by zedshaw 16y ago
The source I have is just like the Lua that runs the website. Everything else is standards based and totally open source. As I say in the about page, I'm using: http://srp.stanford.edu/ as the protocol, specifically SRP6a but with a SHA
611.
by zedshaw 16y ago
I swear it wasn't me. :-)
612.
by zedshaw 16y ago
But, I thought you weren't supposed to take people's "high-drama" into account when evaluating statements and arguments, and judge them entirely on the facts. Isn't that ad hominem as you love to point out?
613.
by zedshaw 16y ago
> It's interesting that the bug was fixed without an advisory (oh to be a fly on the wall on ICB that day; Theo had a, um, a, "way" with his dev team). This would be my question. That seemingly small change has large security implicati
614.
by zedshaw 16y ago
Yes, I really like this stuff. I think back to having to use "hacks" like BackgroundDRB and cringe now.
615.
by zedshaw 16y ago
Well, I only did what I needed, but since Lua's included code blocks are also functional, wouldn't it be easier to just allow passing arguments? It'd also make a lot more sense. I find Django/Jinja inheritance concepts really confusing. I
616.
by zedshaw 16y ago
Yep, 'cause pointing your nasty dogs at someone is just low class. (ha)
617.
by zedshaw 16y ago
The main feature that is required is the ability to callcc and/or coroutine yield from any point in the stack. If you look at Wee, the user of the framework has to callcc all over the place to make it work. In Tir I have web:prompt(), whi
618.
by zedshaw 16y ago
Interesting, I'll take a look at this some more. My only question is, isn't plain old Lua already like django's templates. What specifically are you adding that embedded lua doesn't just give you?
619.
by zedshaw 16y ago
Ha, yeah I had to put that in. I find working in the valley is kind of like working with a bunch of guys before Knuth and Dijkstra established structured programming. It's like they say, "Yo, I don't do if-statements man. I use gotos onl
620.
by zedshaw 16y ago
Hype.la is the only real Tir app, with the Mongrel2 BBS demo being a "proto-Tir" app. There's hardly anyone on it yet since I didn't really "launch" it. Because of that, I just run it in screen and I'll worry about the deployment scenario
621.
by zedshaw 16y ago
The natural style is sweet for things like that. I did the Hype.la signup process with natural style and it meant I didn't have to touch the database the whole time. If they quit half-way through then no DB junk left over. Where this kind
622.
by zedshaw 16y ago
Over a 4.0 GPA? Man, are grades that badly inflated now that they have to add extra points to the GPA to make people seem better? No knock on you at all, but just curious what the scale is.
623.
by zedshaw 16y ago
It varies for me. Sometimes it's just an idea and I want to share it. Maybe I'll never do it, maybe I want to get feedback on it. Some pretty cool stuff came out of just "What-If" like Mongrel2 and Librelist. Other times I get infected w
624.
by zedshaw 16y ago
That's pretty cool stuff man. I like people who go out of their way to do as much diverse stuff as they can.
625.
by zedshaw 16y ago
If you really want to learn how to do this, and do it really really well, check out sglib: http://sglib.sourceforge.net/ It's got nearly every data structure you can imagine, all implemented as CPP meta hackery. Brilliant.
626.
by zedshaw 16y ago
Well the ArcWTF challenge was sort of a joke, but I think this code isn't better. The big problem is you (and Arc and others like it) imply too much historical knowledge in the name of terseness. What happens is when someone has to fix the
627.
by zedshaw 16y ago
First, it's not a rant. Second, programming languages are about making things. If I have to learn a ton of concepts before I can make things, then your language sucks.
628.
by zedshaw 16y ago
Yes, but did it pass the ArcWTF Challenge. You should try it. It's actually pretty funny, but you also learn that maybe a bit more code is better for the brain.
629.
by zedshaw 16y ago
Nice, yeah it's really not hard to crank these little frameworks out. In fact I'm starting to think, if doing one is so simple, then maybe just little frameworks from now on. One thing though: Part of the point of Tir is that you can read
630.
by zedshaw 16y ago
Well it was mostly a joke, so you can loosen your booty a bit and have a laugh. But, having worked with the average programmer and written a book for newbs I'd say the Arc code is just harder to use.

More ›