1,112 karma · joined May 28, 2012
shanewilton.com
I'll probably do a write-up on it at some point, because it is now trivial for anyone on the team to deploy any of our services to any environment (or a new one!), and to integrate new services into the platform.
% and | are going to be unclear if you're an outsider looking in on the language, but that is true for any sort of specialization. I'd be interested to know what languages you find to be readable, because I can all but guarantee that there's aspects of that language that I'd find arcane -- not because they are, but because I don't know the language.
I'm not terribly interested in discussing whether a language is readable or not, because a lot of that is going to come down to subjective opinion, but at the end of the day, I find that Elixir lets me quickly write maintainable code.
I'm not entirely sure what you mean by "overloading of atoms to work like pseudo-objects", do you mind elaborating?
I thought the same thing once, until I actually sat down and tried to learn Erlang. It turns out that a lot of the decisions that I originally thought were asinine, actually make a lot of sense.
Line terminators for example (, ; .) tend to receive a lot of flak, but they really aren't as crazy as they first seem. Commas come after normal lines of code (you can read them as and), semicolons come at the end of clauses in if or case statements (and you can read them as or), and periods mark the end of a function. It's a little more verbose than something like Javascript or Ruby, but it really isn't as confusing as critics tend to claim!
The server implementation [0], for example, is 25 lines and handles a lot behind the scenes. Those 25 lines are all you need to define a process that can leverage all of the supervision and hot code reloading benefits offered by OTP. There's a lot going on, but it's mostly just pattern matching tuples and maps, and it only takes a few hours of messing around with Erlang or Elixir before that kind of thing stops looking so scary.
[0] https://github.com/sasa1977/erlangelist/blob/master/examples...
If you're interested in getting started with reverse engineering, I recommend Binary Ninja [0]. It's a newer platform, and you may run into bugs, but the team behind it is super responsive to feedback, and they've done a great job of taking a traditionally very arcane UI, and making it into something that's a joy to use.
Coeffects can be used to represent the "context" of a program, which includes things like permissions or capabilities that the program may have access to. They provide a fascinating way of modeling all kinds of information that is traditionally not handled by even powerful type systems like OCaml's or Haskell's.
You can read a lot more about the topic on Tomas Petricek's website: http://tomasp.net/coeffects/
I especially recommend this short article from 2014: http://tomasp.net/blog/2014/why-coeffects-matter/
Does anyone have experience using CloudI in production? I'm having trouble finding case studies by anyone who isn't involved in the project.
Even after changing the code to multiply by 99 instead of 100, the results don't change very much at all.
<!-- You can't know whether I'm exploiting a bias in the crappy JS -->
<!-- RNG to make my name first more often. Hah-hah. -->
document.addEventListener("DOMContentLoaded", function(event) {
var names = ["Erin Ptacek", "Thomas Ptacek", "Jeremy Rauch"].
sort(function(x, y) { return 1 - Math.ceil(Math.random() * 100) % 3; });
for(var i = 0; i < 3; i++) {
document.getElementById("n_" + i).textContent = names[i];
}
});
Good luck with the company, I hope you can also beat the RNG that makes or breaks a startup :)
The rich support for quoting / unquoting code in Elixir makes it possible to easily compute metrics like this. The implementation in Credo essentially walks through the code, keeping track of how many "branch" operations are encountered.
https://github.com/rrrene/credo/blob/master/lib/credo/check/...
It wouldn't surprise me if Cicada were something similar, but I have nothing to base that assumption on but anecdote.
This year, co9 actually took the social engineering game to a new level, and registered vanity domains, like http://assimilate.today. They hid puzzles on them that tied into 1o57's game, then they'd leak the domains to other teams playing, and trick them into spending hours solving puzzles that had no solution.
In the case of assimilate.today, I spent hours decoding it to different phone numbers, pointing everywhere from Bermuda to Thailand, and probably woke up a few dozen innocent people with phone calls.
If you like puzzles, riddles, or cryptography, I highly recommend the DEF CON badge challenge. It isn't for everyone, but it's one of the closest things I've found to a real life rendition of an old point and click adventure game.
That's good to hear. Last time I tried it took a few days for them to get back to me.
I'm also excited to give GnuAPL another try too. It looks like it's coming a long way since the initial release.
I almost exclusively eat meat. Just the thought of trying vegetables makes me feel sick to my stomach. Whether that's immoral or not is of secondary concern to me, when the alternative borders on a panic attack. Why that is, I have no idea, but I know other people with the same reaction as me, and it might partially answer your question.
It's a series of challenges by tptacek that task you with exploiting the firmware for a digital smart lock. It starts out by assuming no knowledge, with the first level literally just requiring that you read a memory dump, but by the last level you'll be reverse engineering custom heap implementations, injecting shellcode into ASLR'd binaries, and bypassing memory protections.
It really is the best introduction to this sort of material that I've ever come across.
I often meet people who wish they knew more about security, but they feel as though things like cryptography are beyond their grasp. Nothing could be further from the truth, and CTFs are evidence of this fact.
You can always find upcoming CTFs on CTF Time [0]. Give one a try sometime, and you might surprise yourself with how quickly you're able to pick things up. Even if you don't solve any problems, you'll have an absolute blast.
If you ever have questions about getting involved in CTF or you're looking for resources on learning security, don't be afraid to reach out to me. My contact info is on my profile.
Maybe so, but that only accurately describes things at the boundaries of your system. Your database tables still have columns that hold integers, dates, or floats. Sure, you could do the type coercions as needed, but at that point you're missing out on the valuable opportunity to validate your data as it enters the system. You can provide meaningful errors to users as early as possible, you can avoid defensive checks nearly everywhere else within your code, and you can just generally trust that invariants about your data are going to hold throughout the rest of your program.
This leads to smaller test suites, more concise codebases, and higher security assurances overall. If you look at the sorts of vulnerabilities that often pop up in Rails for example, many of them simply don't affect you if you use something like Virtus [0] to validate the types of your data as it enters the system.
I don't do much web development, but statically typed web development is the only way I've ever been able to tolerate it.
There's a great Radiolab episode that covers exactly that: http://www.radiolab.org/story/translation/
I'm reading Foucault's Pendulum right now, and even though I'm absolutely loving it, part of me feels like I'm missing out by reading a translation. The other part of me wonders whether those who read the original work missed out by not reading this translation.
Based on the paper, he performed two separate experiments.
For one of them, he chose the 50 most popular Rails projects on Github. Of these, 30 of them used a permission model that could be handled by his tools. The 23 flaws reported were among these 30 apps, with Diaspora being notable among those.
He also worked with a professor to test student submissions for an access-control assignment in a web development course at MIT. He uncovered security vulnerabilities in "over half of these projects" and "about half of those bugs were missed during manual grading."
Definitely worth a skim in my opinion.
I get that moving fast and breaking things works for some products, but I wish more companies had the same attitude as you.
I just ran a find over the project I've been working on full time, and the largest file, by a long shot, is 8kb, and a little under 100 lines. That's just an autogenerated enum of the HTTP status codes though, so it isn't indicative of real code.
In the vast majority of cases, all of my files are less than 4kb, and hover around 40 lines or so. Atom handles this use case just fine, and I'm hard pressed to think of a situation where I'd run into performance concerns. The entire process itself is using less than 80mb of RAM, and 0.2% of my CPU. A single tab of Chrome is worse than that.
What are people doing with their text editor that they need blazing speed?
A disheartening percentage of the work we've put into Tinfoil Security's web vulnerability scanner involves dealing with websites that aren't to spec, and so break in unexpected ways.
If you're looking to dive into the problems more immediately, there's a wealth of API clients and other resources available in the forums: https://discuss.starfighters.io/t/helpful-external-tools/136
Don't be afraid to try the game if you don't have much programming experience. It's seriously a great way to pick up some valuable skills.