« first day (3636 days earlier)      last day (1298 days later) » 
03:00 - 17:0017:00 - 00:00

5:01 PM
I mentioned handcalcs the other day, here is another sample showing some pretty crazy, um, output.
 
@PaulMcG Oh, side note, the system is similar to the one that davidism built into our very own sopython. Only the system is cleaner over there cos I was learning SQLA as I was going along :)
 
"Show my work"? Too much trouble, I'll just import handcalcs.decorator
 
@roganjosh I see what you have done there I am guessing the db.relationship with the Departments table has the departments while permission groups table has the different permissions levels for each
 
@Kwsswart exactly that. Departments can be made and destroyed as and when the structure of the factory changes. The department is the highest-level "object" in the dashboard, defined elsewhere, which keeps a list of machines, products it makes etc. I just made it so you could associate staff with them too
If I'd had more time, I could have made the decorator check whether a department ID was being passed into the route, and then I'd only have to specify the permission group and the department check could have been done in the background. But I didn't have time to play with that, so the check is done in 2 stages :(
 
5:32 PM
Woah, the future is now. Paramedics with jetpacks are a thing
 
There was an accident. They sent a paramedic on a jetpack. There were two accidents.
 
laurel
 
So I don't know how to google this but what is this notatio in python:

something, __ = mythings.delete()
 
I was just thinking the same. I'm just imagining me hooked up to one of them. The patient sees me coming - "yey, I'm saved" followed by me careering off into a fireball on the mountainside :P
 
tuple unpacking
 
5:34 PM
I searched __ notation and it takes me to the init documentation.
thanks @PaulMcG
 
In this case, __ is just a throwaway variable name, not any special notation.
Replace it with unused and you get the same result.
 
Okay, I'll probably google it now because I don't understand it at all but I didn't know how to google for that.
Oh are we just saying we want the first entry of the tuple and don't care about the second?
 
Effectively yes
 
ah cool
 
Hmm, is the naming convention of _ for unused variables documented anywhere? I don't see it in PEP 8. docs.python.org/3/reference/… mentions its special role in the REPL, and its use in i18n in docs.python.org/3/library/gettext.html#gettext.install, but nothing about being a throwaway
 
5:42 PM
@roganjosh Really interesting i may save it to read through and see if i can addapt a similar form for this one this is all in the models.py no?
 
well not sure I just see it in a big code base and I believe it's being used for that.
 
@roganjosh follow zerogravity on instagram its a company researching those jetpacks its really interesting
 
@Kwsswart no, the second is in a routes.py to show how it is implemented and the third is in your app factory file
 
@roganjosh makes sense when starting a project do you start with the app factory or do you first follow the theory from mega and convert to app factory later?
 
The first file I linked is the entirety of auth/models.py
 
5:45 PM
Can i please get any help on this? Thanks
 
Always with the app factory. Don't forget that that resource is a tutorial so it continues to build up best-practice as you get more familiar with the technology. You wouldn't consider converting your python approach back to the introductory tutorial code, would you? :P
@YKerem Hello. Please take note of the room rules. Questions on main should be at least 48 hours old before being brought to chat
 
Oh ok im sorry @roganjosh
 
@Kwsswart I think what I'm saying is that there is no cognitive burden for me to implement the app factory approach from the start, and it standardises all my flask projects so no matter what stage they're at, I know where to go looking for stuff. Similarly with the permission model - as soon as I realise I need it, I implement a fully extensible model right at that point. It's no real overhead and then I don't have to worry about it again
 
6:29 PM
@roganjosh So it may be better even though it may take a bit getting used to it but to implement the application factory and a permission model from the start
 
To the app factory: yes, start projects like that unless there's a good reason not to. To the permission model, only implement if you need it, but when you implement it, do it properly. The "department access" aspect I would only add if I needed that on top. I find it difficult to distinguish the argument for an incrementally-sophisticated auth system from "I need to send HTTP requests, but I only need GET so I'll roll my own wrapper and only switch to requests when I need more"
 
I need a strategy to not hit my head against a wall. We're doing some housekeeping on the in-house code for which we're trying to get it all cleaned up. I see beginner code patterns in the code (which to be fair, was written by someone without a ton of experience). Still I see bad patterns from time to time that make me wanna take a walk </rant>
 
@inspectorG4dget refactor? Pair programming? Code review?
 
sidenote: is this what growing up feels like? Is it just that I'm more experienced than this person?
@AndrasDeak review ± refactor
 
Refactor together?
 
6:39 PM
good idea. Thanks
 
6:52 PM
@roganjosh Fair enough what about bp would you normally form them at first or only once needed
 
@Kwsswart less straightforward to tell. All of my projects start with blueprints because I can already envisage that there will be logically-separate aspects before I even start. If it's possible to know beforehand that you don't need them, then obviously don't use them
but that's a pretty decent target in refactoring, and even when I have started with blueprints, I tend to have to refactor the structure as things grow
 
Anyone knows pyqt
 
@roganjosh makes sense as to with the permissions you got there simply using the user_permissions db table should surfice for a simple 3 layered permission slot done need to take in user_departments or woud the user_departments work for a system with multiple academies?
 
@Kwsswart Well isn't "academy" synonymous with "department" from my system?
 
@roganjosh that is what I was thinking lol
 
7:07 PM
Or maybe you need to add yet another level. Or you need to take the academy into account when you direct to particular pages. I can't really advise on that because I don't know the full context of what you need to build; I'm just giving you an approach that should be moldable to your context
 
@roganjosh I appreciate that I am looking through the code and trying tosee how i can mould it into my work
 
Jun 28 at 10:47, by roganjosh
That's less damaging than user access. In the case of users, there is a hierarchy of access. Once you had any sort of access to delete users, you could use that exploit to punch upwards and just delete admin users
 
Can someone help me in pyqt5
 
Note that, though. I messed up in a couple of routes. I had a dynamic route like @bp.route'/do_something_bad/<dept_id> but the JSON payload also contained a dept_id. So by validating the dept_id of the route they got their access, but the body of the JSON could contain a different dept_id if they played with the HTML
The more layers of checks you add, the more loopholes you might open
 
@roganjosh i would have thought the more layers th less loopholes
 
7:16 PM
Only if you spend a serious amount of time considering how they fit together. In this case, the second check actually overruled the limitations of the first check if they tried to inject random department ids into the HTML template (dept_id = 1 is a decent guess at something important)
 
ahh I see
 
In SQLA you can make self-referential relationships. So staff could delete other staff if they were subordinate. So a supervisor could delete shop-floor staff if they existed in their department. They log in, go to the "delete user" link and pick a subordinate user. They get through the @group_required decorator because the request originates from their department, and they get through the dept check
but the body of the request was user_id = 1, which the @group_required check on its own would have forbidden
 
@roganjosh so wouldnt it be best to check by department and position? thus only managers would be able to do that for their department?
 
I can't remember how I fixed it now but it was a definite "oh crap" moment. It was a pretty convoluted hack, but the principle was that if you targeted your hack at the second validation check, you could get around what the decorator actually stopped
Nobody ever used it, I just spotted it while thinking a bit outside the box
 
very interesting way of working around it... the more i learn the more i realize i know nothing lol
 
7:31 PM
That's a good thing IMO. If you go forward thinking you know exactly what you're doing all the time, you'll never spot these things
I've checked their access level --> I've checked they are targeting a user in their department --> I'll accept their user ID in the request body (which could be any ID)
vs. I've checked their access level --> Senior Planner can't delete Master --> reject
 
the departments when using it can literally just use a separate table for academy names and also tlinking the academies to and students classes and should serve 2 purposes no?
 
I don't understand the question, sorry
 
7:48 PM
argh
the new highlighter is awful
 
@roganjosh basically looking at how you have accosiated the accessgroups in the user mix in and wondering if doing anything similar for the academies say for instance i have the following dpaste.com/62KFJCFGD and would like to use your dpaste.com/A4SMX6M4X
to associate this table to help allow checking access on two fronts
but not wanting to lose the class and student access
 
I'm gonna advance a little up the hill back home; I'll have a look on the next pub stop :P
 
those lessons and students are linked to two separate tables with which i am using to track students and the classes of each academy
surely i could almost turn it using dpaste.com/8NYEKKEW3
 
8:06 PM
This is broken, no?
def add_user_access(self, user):
        """
        Associate user with a deparment
        """
        if user not in self.teacher:
            self.teacher.append(department)
It doesn't take a department reference
 
yeah was a quick dpaste edit to ask about concept
havent implemented it yet questioning concept
 
The problem being that your quick sketch probably doesn't reflect the levels of access you need to implement
 
Well the levels would be based on academy
in academies there would be 3 levels
 
I don't think I have a whole lot to add to what I have said. I think it's a case that you need to go away (in a nice way) and think about how you want to structure this
 
@roganjosh alright mate appreciate the assistance
 
8:10 PM
I'm happy to review your ideas when you've battled them out a bit and come up with a structure :)
 
@roganjosh thanks mate :) may i just ask one thing what is the natural_key you are using in the user_get_permissions() method first time i have heard this
 
in-so-far-as you trust my opinion. I'm only suggesting things based on my experience - I'm not a Flask contributor so maybe I have a wonky setup... but I spent a lot of time trying to make sure I didn't :)
@Kwsswart I have no restrictions on what usernames people pick. If I don't use that, then you won't get alphabetical ordering of usernames between people that capitalise their username vs. usernames all in lower-case
 
@roganjosh oh ok so a sorting mechanism thanks man
 
Cargo-culted from SO:
def atoi(text):
    return int(text) if text.isdigit() else text


def natural_keys(text):
    return [ atoi(c) for c in re.split('(\d+)', text) ]
 
oh lord, atoi. I'm getting flashbacks to C++ programming
 
8:16 PM
excellent thanks man will defo look into it more in the morning and try implementing thanks again
 
 
3 hours later…
10:57 PM
How can I convert the following to a bytearray?
['0000000', '0000000', '0000000', '0000000', '0000000', '0000000', '0000000', '0000000', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111', '1111111']
I'd like something like:
display = bytearray([
0B0000000, 0B0000000, 0B0101110, 0B0101010,
0B0111010, 0B0000000, 0B0000000, 0B0100010,
0B0101010, 0B0111110, 0B0000000, 0B0000000,
0B0000010, 0B0000010, 0B0111110, 0B0000000,
0B0000000, 0B0111110, 0B0000010, 0B0111110,
0B0000000, 0B0000000, 0B0010110, 0B0101000,
0B0101000, 0B0111110, 0B0000000, 0B0000000,
])
 
@duhaime since 0B0000000 is literally 0, the closest you can get is [int(byte, 2) for byte in inp] if inp is your list of strings
I mean that's a list
replacing the [] with bytearray() will give you a bytearray
I'll note for future people trying to help that your input and output obviously don't match :)
 
Seems like we just did this. Is there a homework assignment due?
 
I think that was also duhaime, if you mean his short chat with Aran-Fey
trying to wrangle an arduino I think
 
11:17 PM
Ah
 
03:00 - 17:0017:00 - 00:00

« first day (3636 days earlier)      last day (1298 days later) »