« first day (3714 days earlier)      last day (1234 days later) » 

12:26 AM
@roganjosh Yeah, basically it works but you gotta have cython consumer everything, especially for cyclical class reference definitions.
 
cyclical class reference definitions?
 
Child holds a parent object, parent holds a child object, you get this stuff with graphs. Thats kinda the pattern Python 3.10 solves with its fixes in typechecking.
 
12:42 AM
@Mikhail considering your esoterically astonishing problems this last week or two, I'd be cautious extrapolating from your experience specifically :D
 
Haha, well it cython worked for that stuff, and it was a pretty giant OOP code.
 
Cython-worked is potentially a marketing stamp to add to the library
In any case, I don't think there would be cyclical dependencies between classes. What I take from your messages is that this is possible, and I'd be really interested in any benchmarks you can share
 
Hmm, well walltimes didn't change too much, but narrowing down the types helped a lot for memory consumption
 
12:58 AM
And you defined everything with C types?
 
Not everything, but the objects that were used the most.
For example, if you want to reduce the memory consumption of a base case class, you replace __slots__ with more narrow types.
 
That's a crucial diverge here; I optimise for time.
 
I mean, walltime didn't go up either. I had a mostly graph walking code which didn't do much computation, but a lot of cache misses.
 
So it failed as an approach for you
?
 
1:15 AM
Not failed. It was an improvement for free without any real issues. But ultimately, I'm rewriting in C++ now.
 
 
1 hour later…
2:22 AM
what is this hat thing?
was it always there (since December)? I can see its Christmas related, but I only just noticed it
 
user13727121
2:55 AM
Is it the standard style guide of Python to start writing my codes on the 2nd or 3rd line instead of the 1st line?
 
user13727121
I've seen a lot of tutors doing that but never explained the reason behind it or is it just a style
 
defncon is phython?
what is the difference between defenition and declaration
 
3:24 AM
@holdenweb ...coupled with the prevalence of bad book/blog/tutorial authors (even highly-credentialed ones) who insist on things that are wrong/dubious/obsolete/likely to change in future. When I started Python I had to learn be very skeptical and verify things for myself. To reverse-paraphrase Mr Miyagi (the sensei, not the SO user), "for every bad student there is often also a bad teacher"
 
 
4 hours later…
6:59 AM
@CoreViSional No, it is not 'standard style'. Look at Pep-8 for style guides
 
 
2 hours later…
9:10 AM
@roganjosh cython works extremely well if you have bread-and-butter OOP. it's a chore with heavy polymorphism, and a nightmare with generics.
 
9:49 AM
Does anybody know how to do lexicographic ranking using pandas rank function? Here is the link: pandas.pydata.org/pandas-docs/stable/reference/api/…
I am trying to do exactly what this person shows in his bug intro here where the type error is appearing : github.com/pandas-dev/pandas/issues/21554
As per that, there isn't any solution but since its 2020 I just wanted to confirm
 
hi guys,
I am switching from Pandas to Vaex and I weirdly cannot find an equivalent way to create a dataframe from a list of lists.
In pandas I simply do pd.DataFrame([[1,3],[2,4]]), how can this be done in Vaex?
 
Not sure whether we can create a vaex dataframe from list of lists, last I checked there isn't a way to get it directly but you can do an intermediate step of converting to pandas dataframe if its not computationally expensive @shamalaia
vaex.readthedocs.io/en/latest/example_io.html for further reference @shamalaia
 
yeah, I looked in the docs and seemed weird to not find it, so I thought maybe it was trivial. I will probably create intermediate hdf5 files then
 
10:40 AM
@MisterMiyagi that's really reassuring - thanks! That has probably swayed my mind, then
 
Just read your second comment after that question. You can introduce both Cython and Julia easily into an existing Python codebase. So you should be pretty flexible when starting with a Python prototype, then gradually moving parts to Cython and/or Julia.
Cython is pretty cheap to introduce because its syntax is very similar, and Julia has quite some tooling for directly using/being-used-by Python code.
 
Yep, I was erring on the side of Cython but I didn't want to get half way through and find out that it was compiling into garbage code because I was asking too much of it. Julia would be learning for all of us, but I shortlisted that because the syntax would be familiar enough, but it doesn't fit well with OOP (though, the real meat of the problem can probably be abstracted away to just arrays)
 
11:00 AM
Julia should translate very well from Python-style OOP. I know the multi-methods feel weird at first, but practically the main difference is just that they do not live on the objects.
You lose compile time encapsulation/private, but Python doesn't have that either, so...
IMO the main challenge of Julia is that it's very easy to write low quality code. There's a lot of "do whatever you want" in the language.
 
Random webdev question: Is implementing a login button with AJAX always a bad idea because it means the session cookie can't be marked as http-only? So logins should always happen through a regular POST request?
 
I'm not sure why you'd want AJAX there anyway since logins are usually accompanied by a redirect?
 
I'm not sure either, but my brother's designing a website and apparently he does everything through AJAX
 
As to the specific question, I'm not sure I can give a definitive answer, though, sorry
 
11:09 AM
oauth is a nice option
 
If the session cookie isn't marked as http-only, any JS inserted into the page (through ads or whatever) can potentially steal it. Right?
 
Also, I think that depends on whether you use backend session storage. See this article (orientated around Flask but I think the principle is the same)
@MisterMiyagi That's a distinct pitfall I was seeing with that, too. It looks easy to jump in and make loopy code because the JIT will handle it, right? :P
 
11:32 AM
Yeah, you get away with lots of bad things because JIT magic, and you can do lots of bad things because macros and no mandatory namespacing.
 
Hmm, I think I need to read up on how AJAX interacts with cookies
If the browser automatically sends http-only cookies along with AJAX requests and the response can also set new http-only cookies, then I guess there's no problem
@roganjosh that's too advanced for me, no clue what I should take away from that
 
@Aran-Fey That sensitive data can be stored in a database on the server, not in the cookie itself. So there would be nothing to steal from the browser other than the key for a database entry
Though we might be talking about two slightly different things, but I thought there might be overlap
 
11:49 AM
So basically you're hiding a piece of secret information in the db, and exchanging it for a new piece of secret information? That doesn't seem useful for a session token
 
Well otherwise it's just a dict of raw info in the browser, no?
 
Wait, I think I may have misunderstood
ok, I have no idea. But it seems like AJAX requests can send and receive http-only cookies just fine, so there's no problem
 
It's quite possible I'm also not being helpful. Lots of plates spinning and I'm dipping in and out sorry
 
I thought since JS can't access http-only cookies it can't send them along with an AJAX request either, but apparently that's not how it works
 
12:06 PM
@roganjosh are you at the circus?
 
No comment :P
 
 
1 hour later…
1:07 PM
@Aran-Fey yes pretty much
 
1:42 PM
Hey I'm writing a Kalman filter to try to predict the position, velocity and acceleration of a car. For the prediction step I have the kinematic equations for position and velocity, but how would I go about predicting the next acceleration? Just assume it doesn't change?
 
As far as physics goes, acceleration is the input into the equations of motion and it need not be continuous. And causality implies that it's inherently impossible to guess.
if you look at the data you have for a longer time period you can make educated guesses about the behaviour of the measured acceleration
if it's smooth for technical reasons you could try extrapolating that too, no idea
 
Hmm yeah the blogs I see treat a as a known control input. I guess I can still have a in my state estimation and just propagate it like a_k = a_k-1 and hope the measurement step fixes it... Kalman filters sound so easy conceptionally, but implementing them is quite a task
 
2:00 PM
when trying to model data you should probably start from representative samples of data
it's dangerous to model data the behaviour of which you're unaware of
and if you have data you can experiment on it to see what sticks
 
@Aran-Fey if you're going all AJAX stuff... then you might also want to look into seeing if JWT would be an option
 
Cbg guys, is f'' and format() method same? Like they serve the same purpose?
I was asking because I know format() prevents sql injections but was wondering if f'' also does the same. Any ideas?
 
@CoolCloud no and no!
@CoolCloud you know nothing :D
 
Mind explaining?
 
"I was asking because I know format() prevents sql injections"
they absolutely do not prevent any sql injections period.
 
2:09 PM
Dont emphasize on that point, what I meant was, it makes it less vulnerable, not put a stop to sql injections.
 
NO
it is the one that makes you vulnerable to SQL injections
clearly I should write it in all caps so that it lands :D
 
Hmmmm, I agree, but how else would you substitute for column names in a query?
 
I actually wouldn't. I would use SQLAlchemy.
with SQLAlchemy you would never need to substitute anything in a query yourself.
 
I actually was concentrating on this answer.
 
format, f'', % formatting, string catenation, string.Template etc are all exactly equally dangerous. Either your column name comes from within the program and is therefore safe and it doesn't matter which you use, or it comes from the user and you're aiming at your foot.
yes, there is nothing in format that makes it safe by itself. It is the whitelist at top that makes it safe.
        if a == 'id' or a == 'emirate_id' or a == 'email_adress' or a == 'gender' or a == 'DOB' or a == 'blood_grp' or a == 'COVID_test':
this is the SQL injection prevention method assumed to be used by that answer.
 
2:18 PM
So this assumed method is of no use?
 
@AndrasDeak see what sticks = see what works? Don't know that phrase
 
No, I mean that .format cannot protect you from anything by itself. You asked does f'' protect you from like .format does. Well they both are footguns when it comes to shooting yourself into foot with SQL.
 
Hmmmm well my whole 7 months have been a lie. Anyway other than SQLAlchemy any solutions? Some SO answers tells me to use concatenation xp.
 
the whitelist makes it safe to use .format yes. But it is the whitelist that makes it safe.
 
Check this out?
Whats the whitelist you're referring to xp
 
2:28 PM
no, there is nothing safe with ` `
user image
4
 
@AnttiHaapala I was literally just reading it here xp
 
this is Bobby Tables. His cousin Harry User, i.e. Harry`); ALTER USER root SET PASSWORD TO 'swordfish' -- would compromise that.
 
Laurel.
 
if you must interpolate column names into the query, then you must have a whitelist.
 
Hmmm, I guess ill have to compromise security here as my whole app is build around f''.
 
2:33 PM
no!
you will use a whitelist
 
Any posts or more info or something about it?
 
Whitelisting is the practice of explicitly allowing some identified entities access to a particular privilege, service, mobility, access or recognition. It is the opposite of blacklisting. == Email whitelists == Spam filters often include the ability to "whitelist" certain sender IP addresses, email addresses or domain names to protect their email from being rejected or sent to a junk mail folder. These can be manually maintained by the user or system administrator - but can also refer to externally maintained whitelist services. === Non-commercial whitelists === Non-commercial whiteli...
whitelisting: you verify that the column name is within the preapproved list of column names and if not, you will take no action or error out :D
 
2:48 PM
Oh so its like a way to prevent errors?
 
@Hakaishin yeah. Throw spaghetti at the wall, see if it sticks
@CoolCloud listen to the angry man. Do NOT insert variables in queries by hand!
 
@AndrasDeak lol, I wont do it by hand anymore.
 
3:03 PM
at previous workplace we had two Antti's. I was the one known as the "Angry Antti" :D
 
3:35 PM
@holdenweb Never >:-)
 
@CoolCloud Ideally, one would start by reading the DBAPI specification
 
@CoolCloud incidentally you don't need to use SQLAlchemy specifically to guard against sql injection. Any good sql-interfacing library has safe parameterization methods.
Anything that adheres to the DBAPI spec will at least implement cursor.execute, with a params arg... Dang, beaten once more by holdenweb
 
@CoolCloud Note, too, that while you can parameterise data values in SQ queries using parameter substitution, you cannot substitute column and table names that way.
 
Who needs to dynamically generate column names when you have select * from ... ;-) </onlyHalfJoking>
 
Then you are forced to generate queries directly when working in SQL, which is why many programmers prefer to use SQLAlchemy or some other object-relational technology.
@Kevin Don't. I have known databases where the values of certain columns were table names. That was ugly.
 
3:47 PM
Fun*!
(*not actually fun)
Thought experiment. History teaches us that sanitizing sql strings is very very very hard. But if you were very very very smart, could you do it? Or is it a game of walls vs ladders where every injection-detection code can be defeated by a very^(N+1) smart attacker?
My guess is that there are a finite number of possible attack vectors, so if you know the sql grammar like the back of your hand, you could in principle defeat all of them
It might take you 20 years and fifty million dollars, though
 
well if we trust libraries to sanitise queries properly, it can presumably be done
unless they haul shared libraries in buckets from the oracle fountain
oracle with lowercase o
 
@Kevin Most ordinary mortals are quite happy with the job the database libraries do in practice.
 
I suspect that all good libraries either employ very^(N+2) smart developers writing string sanitization methods; or they carefully encapsulate all user-tainted strings in unbreakable bubbles, and hand them gingerly to the SQL engine, saying "here, evaluate these in a strongly typed context where they can't be interpreted as anything but primitive values"
In the latter case, no part of the tech stack ever actually interpolates the values into the query to produce one monolithic query string. The query is already in AST form by the time the engine subs in the values
 
Given that there are few questionable characters it really isn't that difficult. Doubling apostrophes gets you most of the way there.
 
Yeah, I'm just wondering if you approach 100% safety asymptotically as you stomp naughty characters, or if you reach 100% after a finite amount of work
Half-baked thought: having a finite number of questionable characters is necessary but not sufficient to prove that a bulletproof sanitization algorithm exists. For much the same reason that having a language with a finite grammar is not sufficient to prove whether any particular program of that language halts or not
 
4:04 PM
@holdenweb This is why i asked about an alternative for that. Im using mysql.connector
 
If you need to sub in columns and table names, odds are good that you can compose a whitelist of columns and table names ahead of time
Unless you're working on holdenstein's monster db
 
xpp
Actually what is sql injection, ive just heard the name, not about it xp.
Gotta do some research
 
But even then, some sql backends have commands that can show you every existing table and column, so you should be able to compose the whitelist at runtime
 
Yea true, something like this would do the job too, SHOW COLUMNS FROM table_name;
 
Yup. Database introspection for the win.
In fact each execute response contains metadata, so SELECT * FROM table WHERE 1=0 will get you a null response showing you the column names for that table.
 
4:12 PM
Oh, thats intresting.
 
I wonder if type(eval(repr(input()))) always evaluates to str...
 
@AndrasDeak Thanks, ill read for Bobby ;)
 
4:27 PM
I wish slideshare.net/billkarwin/sql-injection-myths-and-fallacies would expand more on the point in slide 12, "myth: escaping input prevents sql injection"
I can see how poorly implemented escaping doesn't prevent sql injection, but I don't see how proven-correct escaping could fail
Let's say that's not a No-True-Scotsman argument because we all seem to agree that perfect sanitization is in fact possible
 
I imagine it's people that think it's straight forward to do... 'where x = "{}"".format(blah)
 
Streaming Advent of Code day 16! twitch.tv/davidism
 
I was about to suggest that 'where x = {!r}'.format(s) is 100% secure and reliable, but on second thought it's not very practical if your sql backend only understands string literals surrounded by apostrophes and not quote marks
For instance oracle understands where x = 'foo' but not where x = "foo"
It's easy enough for a bad guy to compose a string that repr() will surround in quote marks
 
4:45 PM
"foo" is a name, 'foo' is a literal string. The double-quotes have a defined use.
Besides which, the representation of something can contain apostrophes: you have to consider how to escape them ...
... even if you could somehow force repr to return an apostrophe-quoted string.
(This is not a new issue to me ... I have suffered).
 
5:35 PM
My initial assumption was that, if you could somehow force repr to return an apostrophe-quoted string, then it would automagically escape contained apostrophes in a sql-friendly manner. For example, print(repr("""foo'bar"baz""")) outputs 'foo\'bar"baz'. But after marinating over your counsel, I worry that it's not always so easy...
Tangentially related: A snippet from CPython's unicode_repr:
        else if (ch < 0x10000)
            incr = 6; /* \uHHHH */
        else
            incr = 10; /* \uHHHHHHHH */
It's interesting to know that even the wiz kids in the core dev team have moments of doubt sometimes ;-)
Hmm, CPython's repr always uses apostrophe-quoting if the string contains both an apostrophe and a quote mark. So you could do something like apostrophe_forced_repr = lamba s: repr(s + "'\"")[:-4] + "'"
What could possibly go wrong? [thunder crashes ominously in background]
 
6:09 PM
I have an immutable dataclass with only 2 attributes, and there's only a total of 6 valid combinations of values. I'm going to be creating millions of instances, which is kind of a waste of memory considering that most of them are equivalent. Is there an easy way to cache instances of this class?
 
6:22 PM
Reminds me of the Flyweight pattern. Don't know offhand how you'd do it in Python
Much like the singleton pattern, it's hard if you want it to work seamlessly and invisibly, and easy if you don't mind creating everything through a factory method
 
Yeah, it's a lot like a singleton. I have no idea how well dataclasses mix with metaclasses though (which is how I usually implement singletons). It's also kind of a pain to implement. But fortunately the problem solved itself
The only reason why I had that problem to begin with was because I was trying to under-engineer the whole thing. For some reason I do that a lot
Me: "I'll just hack up a quick'n'dirty simulator"
Me, 5 minutes later: "Never mind, I'm writing a full-blown library and *then* I'll write the simulator"
 
class Widget:
    _cache = {}
    def __init__(self, color, numspokes):
        self.color = color
        self.numspokes = numspokes
    @classmethod #or staticmethod? idk
    def make(cls, color, numspokes):
        if (color, numspokes) not in cls._cache:
            cls._cache[color, numspokes] = cls(color, numspokes)
        return cls._cache[color, numspokes]


a = Widget.make("blue", 23)
b = Widget.make("red", 42)
c = Widget.make("blue", 23)
print(id(a),id(b),id(c), sep="\n")
#1579305144960
Lazy solution
 
yeah, but I don't like factory methods for this kind of thing
 
Same
A factory that always returns the same type is bad and wrong
 
6:39 PM
I don't agree with that. Something like Dataframe.from_2d_numpy_array() would be totally fine, for example. If the factory has well-defined semantics, I don't see a problem. The reason why I don't like factory methods for singletons/caching is because I want the caching mechanism to be inseparable from my class. It shouldn't only apply to instances that were created through the factory method
 
Ok, some homogeneous factories can be unBadWrong.
 
@Kevin Wrong kind of escaping. The SQL standard says the Python string literal "I'm" should be represented as 'I''m'
 
I had my doubts about my message but I thought "eh, I'll say it anyway, maybe my callout will be interesting". And it was.
@holdenweb Ah, foiled by the differences in string literal representation of Python and sql
 
Yup.
 
The hypothetical sql grammar genius could probably whip up a valid repr-maker, but he's not here right now, so we're up a creek
 
6:46 PM
"unBadWrong" is some peak programmer naming sense
 
In fact sql.replace("'", "''") does most of what you need!
 
What could possibly possibly go wrong
 
Absolutely. That's the spirit [backs away towards SQLAlchemy].
 
7:16 PM
@holdenweb doubling apostrophes is like aiming your footgun at your ankle instead of your foot.
@Kevin not in Python 2 :----------------------D
 
OK, excluding LIKE clauses (where the string is a pattern) show me an example where it doesn't suffice. It even works when the first or last characters are apostrophes.
I'm not saying there isn't one, merely that my small brain does not encompass it.
 
Let us not speak of Python 2, for my sanity grows short in these long winter months
 
Wasn't that like a programming language once?
 
Some history is best left buried
 
@holdenweb sql dialects can understand other escape methods than doubling the '
@holdenweb you specifically are forgetting the PHP magic quotes... it worked by \-escaping the quotes!
 
7:21 PM
Not saying there aren't bastardised implementations, and the whole discussion should anyway be labelled "don't do this at home, kids." I believe PHP magic quotes are an artefact of the langugae rather than part of the SQL standard.
 
so what will happen if I enter Robert\'); DROP TABLE students; --
notice just the extra backslash. You've now vulnerable.
No single escape method people think "suffices" actually suffices
 
Do you mean that no single escape method will work on all possible sql dialects? Or do you mean no single escape method will work on even a single sql dialect? Or something else?
 
yes :D
 
alright then, keep your secrets
 
@AnttiHaapala The backslash is a literal character in the SQL standard. You have been perverted by implementers.
 
7:25 PM
For instance, could I write an escape method that only has to work for mysql?
If it crashes and/or sql-injects oracle sql, I couldn't care less
 
@Kevin the problem is knowing what will work with the database system you've been given. Just use SQLAlchemy/the proper DBAPI
 
Nice try, you know that arguments of practicality simply bounce off my thick skull :-)
 
@Kevin so you say doubling the apostrophes is enough for the database system X. What if they use some older version Y... what if it was configured incorrectly...
 
I expect a catastrophe would occur
Hmm, an apostrophe catastrophe... I like it
 
how do you know? You probably don't. But maybe... just maybe the DBAPI compliant driver would know...
 
7:31 PM
But doctor, sobbed the man, I am Pagliacci the DBAPI compliant driver's maintainer
 
@holdenweb I've seen SQLA mentioned a couple of times in this context but never understood how it adds any layer of protection over a correctly-written query for postgres in psycopg2, for example
 
for example php had a) addslashes, b) magic quotes, c) mysql_escape_string, d) mysql_real_escape_string, e) mysqli_real_escape_string, f) PDO::quote
@roganjosh it doesn't. But I don't trust you.
 
Well, then the argument for SQLA to protect against injection is just that "it accounts for sloppiness"?
 
zzzeek doubts your capabilities too.
@roganjosh yes!
 
Ugh, that and the disapproving glare from zzzeek, and his cat not baring to look at me, is just tragic
 
7:36 PM
@roganjosh It uses engine-specific drivers.
 
<whispers to self> I trust me
 
I trust myself to know my own limitations, e.g. when I'm in over my head writing raw queries
 
@roganjosh No, the argument for SQLA is it handles all data correctly no matter what the engine.
 
Usually the limit is "everything beyond select * from widgets where numspokes > 10"
 
Does SQLA support a dialect that doesn't adhere to PEP 249?
 
7:40 PM
I don't believe it uses the DBAPI at all. Why should it?
 
I'm not saying it should. But the argument that SQLA can be a safe haven for writing queries that would otherwise be vulnerable is really just an excuse for sloppiness in that case, no? All of the dialects it supports also have bindings where your only requirement is to adhere to PEP 249 and not have to worry about injection in the first place
(That's not directed at you, btw, but the general case)
 
I wouldn't mind working in a dialect-specific binding if I had assurance in writing from my manager that it wouldn't change halfway through the project
 
It's possible that I've misread your comment, though, with it appearing in the middle of a discussion on SQL injection. I agree that SQLA is nice in that it can translate across different databases, but I have definitely seen people argue that it should be used because it's safer. I may have conflated the two
 
@roganjosh yes.
but SQLAlchemy has dialects too.
It doesn't work with some random DBAPI driver.
one needs to write a dialect for SQLAlchemy.
I would want to ping "our" Ilja but he's not in the room :F
 
anyone know how I can find measurement_values in my postgres database that match the pattern .../d/xxxx where xxxx is "digits" and ... is "anything" and the string ends with those digits? Oh also, measurement_value is a jsonb type, which I can stringify with ::text
 
7:49 PM
Easier is just to tell me which RBDMS it supports where the underlying python implementation of the binding doesn't obey 249 :P
 
@inspectorG4dget use regex.
 
On first thought I don't see an obvious reason that SQLAlchemy would be safer than, say, Psycopg, but I also find it plausible that there's some advanced case where one is superior to the other
 
@roganjosh I doubt there are any.
 
Ok, so then your "yes" suggests that the problem is in the code that allows SQLA to use the binding?!
 
comparing SQLAlchemy to Psycopg is like saying "I know Python has its uses, but I think JSON is better"...
 
7:51 PM
@AnttiHaapala I can't figure out the regex... or is it the query. I came up with select ... where measurement_value::text <operator> '.*/d/\d+$'; with the following values for <operator>: like, ~. But that didn't pan out. Would love some help
 
@roganjosh every single SQL dialect needs a SQLAlchemy dialect written for it so that it would know how to produce queries.
 
@roganjosh You may have seen such arguments. I have never deployed them.
 
@holdenweb in which case, apologies for misconstruing your comment
 
If I were to meet a deployer of such an argument I would feel comfortable placing a [citation needed] next to their speech bubble
 
It's an advantage it shares with any competently-written database driver.
 
7:53 PM
@inspectorG4dget ~ '/d/\d+$' should work
 
@AnttiHaapala I swear it doesn't :'(
 
@inspectorG4dget then the question is what is the result of x::text for the column. Is it sth like "string in quotes"...
 
good point. I did try the regex with and without quotes: ~ '/d/\d+"$' without luck
 
# select '"sadfsadf/d/123"'::jsonb::text ~ '/d/\d+$';
 ?column?
----------
 f
(1 row)
# select '"sadfsadf/d/123"'::jsonb::text ~ '/d/\d+"$';
 ?column?
----------
 t
(1 row)
I.e. the string definitely has double quotes around it if you do that conversion
@IljaEverilä how do I convert top level jsonb string to text btw :D
 
Good one, let's see...
 
8:02 PM
@AnttiHaapala no arguments there. I think there's a gap in my understanding somewhere. Gonna try to do this in pandas
 
then you have 2 problems :D
 
yup, I'm able to replicate your test select. There's definitely something else at play here
 
What is the fastest way of iterating over text widget selection from tkinter ?
 
@AnttiHaapala I don't think you can. You would wrap it in a container (1 item list), and extract as text.
Checked, apparently #>> can extract a scalar root, if given '{}'. Go figure.
 
yea that's what I suspected.
my db is 10.10
# select '"sadfsadf/d/123"'::jsonb #>> '{}'::text[];
    ?column?
----------------
 sadfsadf/d/123
(1 row)
that's rather... ugly.
# create function jsonstr2text(jsonstr jsonb) returns text as $$ select $1 #>> '{}' $$ language sql;
CREATE FUNCTION
# select jsonstr2text('"sadfsadf/d/123"'::jsonb);
  jsonstr2text
----------------
 sadfsadf/d/123
(1 row)
or maybe
create or replace function jsonstr2text(jsonstr jsonb) returns text as $$ select case when jsonb_typeof($1) = 'text' then $1 #>> '{}' else null end $$ language sql;
 
8:16 PM
Btw. in relation to the talk about SQLA and injection safety, there are some interesting foot guns in it too: stackoverflow.com/questions/60030570/…
 
@inspectorG4dget ^ you should read that carefully :-D
 
:)
I continue to dig, good sir!
 
@inspectorG4dget i mean ilja's link :D if you use pandas.to_sql with user-sourced data :D
 
ooh! thank you. That's much helpful. And thank you @IljaEverilä
 
9:04 PM
winterbash <3
where are your hats guys
 
That involves interacting with main, though?
 
9:21 PM
no, you can use any site to wear a hat
 
hmmm. Maybe as an Xmas treat to myself, I could go be grumpy on another site... and get hats for it!
 
9:42 PM
winter trash
 
10:33 PM
I think what you're referring to is what we call "snow" :P
 
11:02 PM
Yes hats for me please
 

« first day (3714 days earlier)      last day (1234 days later) »