« first day (982 days earlier)      last day (2490 days later) » 

3:11 AM
What parallel universe is this
0
Q: How to compare strings while avoiding timing attacks in Rust?

Charles ShillerGenerally, when comparing strings one compares char by char until one hits a char which isn't equal. If one is validating a login nonce or password (which, while hashed, should not be shared to the world), one cannot use the naive algorithm because of "timing attacks". Many languages/libraries ...

Some rando stealing the idea for a question because the OP of the first question asked for a library...
 
3:48 AM
In France, we have a old group of comic: One of their sketch say:
- Never consider people stupid but never forget that they are...
 
 
3 hours later…
6:45 AM
@LukasKalbertodt do you think this is valid :p ? play.rust-lang.org/…
"it's constant time"
 
@Stargateur Ha :D
But what if the server wants to compare huge strings? You should scale your sleep time with char count :P
Like: one second per byte, that would be .. a good idea :P
 
you will connect in 18 days.
 
 
6 hours later…
12:32 PM
so
a question was opened
it had a single line at the end "are there any libraries for ..."
so I commented that line should be removed
so then another person opened another question, 17 minutes later
asking the exact same thing
without asking for a library
so I was like "that's excessive"
then the second poster deleted their question
then the first poster deleted their question
then the second poster asked the same question again
 
Wat
 
Constant Time String Comparison is madness ;)
 
Madness...
 
12:53 PM
Yeah, I consider deleting my answer... don't want responsibility for security concerns :D
 
1:43 PM
Now one OP just replicated the answer in rust-users. users.rust-lang.org/t/should-simple-enum-derive-copy-trait/…
It hasn't even been downvoted or close-voted. Are they just desperate?
 
I'm not sure I understand... he posted to URLO after receiving the response on SO...
 
Indeed.
 
2:31 PM
@MatthieuM. @E_net4 see, I just use it as an opportunity to get more badges
put those cross-post links with my user id in them
 
xD
is doomed to duplication hell. I'm glad we've managed to control that so far.
 
In my experience seeing the growth in the C++ tag, duplication is a side effect of the rate at which questions are asked. At some point it gets really hard to check all incoming questions... and even when you remember a potential duplicate, it takes a lot of effort to actually manage to find it.
 
2:55 PM
@MatthieuM. Yep. Even now I find duplicates after they've been answered
The system is set to reward answering a question, even if it's a duplicate
And if there was a sufficiently advanced search engine, there'd be less (or at least easier for us to find)
 
And that's assuming you actually find the duplicate; I have stopped counting the number of times I knew the question had been asked before (and I had answered it!) but my google-fu failed me in finding it again...
 
haha, I was trying to find a link to my second-highest rated question and was googling
couldn't find it
had to pop into my profile
the benefit we have is that we know the answer
so we can search for that, which usually uses a bit more reproducible words than the question
 
 
2 hours later…
4:39 PM
@Shep I was just thinking whether awarding rep for (successful) dupe votes would work. But I guess it would all turn around "that's no real content contribution" and "let's award rep for reviewing stuff while we're at it".
 
5:07 PM
@E_net4 I also feel like I should be able to upboat good edits
 
@Shepmaster Sure, that would be of extreme interest to you when reciprocal. :P
 
@E_net4 eh, I'd be fine with it being capped like the 3k edit boundary
but honestly, how many people look at the edit diffs
I think I'm in the minority
So it's more likely I'd be handing out the points
 
5:24 PM
When I see a old question or a question with a lot of view pop as active I have a look :p
but this is not an edit ^^
 
Hah, that was just a noobish mistake.
 
5:37 PM
 
Seems to me it's a dupe too indeed.
 
Aye dupe
 
Ah dang it
Why didn't I find that one :< Thanks humanz!
Kill it with ze hammer!!
 
@LukasKalbertodt hooman
 
Shep has incredible google-fu
 
5:40 PM
@LukasKalbertodt you have the hammer :-)
 
Stop!
Hammer time.
 
@MatthieuM. site:stackoverflow.com rust option result convert
 
Ha, closing my own question as dupe. Haven't done that before...
 
@LukasKalbertodt also this stackoverflow.com/a/41682685/155423
the concept, not the impl — can you avoid creating it somehow
And if it's really common, you could make an extension trait on Option
 
@Shepmaster Yeah maybe. I'll see about that soon.
 
6:05 PM
What do you think about this? Maybe a useful helper method to have? Still have to come up with a good name
Maybe and_then_res?
 
6:41 PM
@LukasKalbertodt seems reasonable. Looks like an answer once you get a nice name :-)
 
@Shepmaster So and_then_res is not a nice name? :D
 
@LukasKalbertodt Oh, I dunno about that. Just compared to foo
 
In case anyone is interested: I'm frustrated! Developing a web app in Rust is somehow hardly any fun at all :/ I have the feeling that the strong type system is more annoying than it helps in this domain. Mhpf.
@Shepmaster Carol and you develop crates.io, right? Is that fun?
 
@LukasKalbertodt crates.io is scary in it's own way
cause of the importance
and the fact that it predates any web frameworks
And that it's in the middle of transitioning to Diesel
and I found that nice enough
@LukasKalbertodt how are the types annoying you, though?
@LukasKalbertodt Also crates.io uses ember which I'm not in love with
 
7:00 PM
@Shepmaster I don't have a good example right now, sorry. I just feel like I have to rewrite something just for the compiler to understand. In other kinds of applications/libraries I more often think "oh the compiler is right there, I haven't thought of this failure case". But in the webapp case I have a different feeling.
But maybe it's also just because I'm way too slow and I expect everything to work much faster.
Or: this error handling stuff. I think I'd prefer Rocket to catch panics in handlers. There are many errors I can't handle. Those errors should be logged and result in a 503. But I don't want to annotate everything with Result...
But maybe I just can't concentrate anymore. That's the first time I'm really annoyed by Rust :P sad sad
 
> I think I'd prefer Rocket to catch panics in handlers
I'm pretty sure it does
> I don't want to annotate everything with Result...
That's just Rust though ;-)
 
@Shepmaster Really? I wasn't sure and tried 0_o waaait
Oh ok it does
ha
._.
Ok not really, Sergio says: "Rocket doesn't launch the threads used to handle requests: Hyper does. So we wouldn't be able to do so even if we wanted to, LukasKalbertodt-M. I think it would be nice if we did, however."

Anyway, I'm out for today :<
 
7:17 PM
@LukasKalbertodt buh bye!
 
 
3 hours later…
10:47 PM
O wow.
I haz a Rust question, doin' research first.
 
@E_net4 Yeah, don't wanna be like some people ^_^
 
And guess what, my search on SO brought me to a question that I answered. It doesn't address my current concern however.
 
search more :p
 
@Stargateur The right term is research here. I can search and experiment. :)
I still am a half-arsed scientist at heart.
 
Here's fun thing I am working on
I have an array
and I want to pick two distinct mutable references to random elements in the array
it is annoying
 
11:03 PM
Hah!
I'd split_at_mut somewhere in between. :>
Probably.
 
@E_net4 yup, but then I have to think about which one to split at
cause i want to "move money" between the two
so the source and destination is important
 
Does that matter w.r.t the split?
 
well, i pick two indexes
and I need to know which to split at so that I can manage the index correctly afterwards
and then I do another RNG hit to know do i move from the left half to the right half or vice versa
very close to just using get_unchecked_mut
 
You're right, that is fun.
(Meaning unsafe here is like Doom's IDDQD)
 
11:26 PM
Hmm... I'm starting not to like my own question.
It's a two-in-one where I sort of know the answer to the second.
 
11:40 PM
> Suggested tags:
Go home SO you're drunk.
 
11:50 PM
Ouch, karma. I clicked the "Post Question" button before writing the title.
It's on.
> The documentation format tho feels like I am reading MSDN.
Interesting.
 
what the hell is a sign-aware XD
 
@Stargateur It means it has sign awareness.
As in, it is aware that the integer is in two's complement, and should be formatted as a signed integer.
Pretty much unlike what's happening with the standard formatter implementations. :>
 
ok I finally understand after use google trad :p
 

« first day (982 days earlier)      last day (2490 days later) »