« first day (3073 days earlier)      last day (2100 days later) » 

00:01
Hello !
@davedwards Cool, what kind of ML work do you do?
00:16
me? sorry, none. I was just recommending that room to Christopher as a resource
00:33
check out that room Mikhail, probably find a lot of people doing interesting ML work
01:10
One of my favourite of Raymond Hettinger's presentations: Easy AI in Python
daved thanks for that link, gregor too
@Mikhail if you want to do a few basic examples I'm in the process of writing ML tutorials
oops wrong person
@Christopher If you are so inclined, I'm actually writing some basic tuts you can get started on with regards to ML. I'm assuming only the most rudimentary python skills so youre a good test case to see if things are easy to follow
I just ask for questions and feedback so I can improve that work
01:57
Hi , I have a string "test1" and I am trying to do something like "test1"[-1:0] , to reverse the string.. Can you please let me know why its not happening please. I know this works "test1"[::-1], but I dont want to use the step , i just want to know why my initial query is not working .
@Gagan Notably, [start:end] has the requirement that start <= end (or one of the two must be undefined). If the default step is 1, how would you ever go "backwards" by adding that to a current index? [A la C: for ( i = start; i <= end; i += step ) { … }]
@amcgregor, that explains why in reversing a string a step size of -1 is important, right
Indeed; that's the only way for the "index" counter to move through the string "backwards".
02:12
awesome @amcgregor, much appreciated !!
It never hurts to help. :)
 
1 hour later…
03:28
hey guys, if you assign a lambda function how is it different then an actual function (minus the fact you can always reassign the parent variable)
03:43
In python the chief advantage is that it looks more elegant
@Skyler All functions have a __name__ attribute, which can be useful in various situations, including debugging. But lambdas get a useless default name.
actually that reminded me of another question i had, is there an easy way to print (say on a different thread) the current active function through some combo of __name__ and something else
A lambda is supposed to be an anonymous function. So it's considered rather poor style to create an anonymous function and then bind it to a name
There is some kind of inspect.stack thing you can use to print the context of a python function. If you will allow me to make a completely unsubstantiated claim, this will probably take a vertible dump on performance :-)
03:55
oh ok
 
2 hours later…
06:24
I want to set the price date either today or yesterday. This is my code to set the price.
now = dt.now()
if doby == 'today':
self.__date_of_price = now.strftime("%m%d%Y")
else:
self.__date_of_price = (now - timedelta(1)).strftime("%m%d%Y")

print(self.__date_of_price)

What is the elegant way to do this in python? a pythonic way
 
1 hour later…
07:52
@Mikhail no, not more elegant. Stop suggesting that.
elaborate
@Skyler that's actually mcgregor
4 hours ago, by PM 2Ring
A lambda is supposed to be an anonymous function. So it's considered rather poor style to create an anonymous function and then bind it to a name
Named lambdas are an anti-pattern
Yeah, that is exactly what the link says. I linked the reference to PEP 8.
Ah OK, from your answer to Skyler's question I got the opposite meaning
 
5 hours later…
14:14
@Skyler Also don't forget __qualname__ — lambdas, being anonymous, will never have a qualified name regardless of assignment (or the immediacy of such assignment). (lambda: 27).__qualname__ == '<lambda>' always.
(Essentially, if you need to look up the "import path" to a lambda, you'd need to exhaustively search its __module__ and hope the object is still referenced there.)
@SmithDwayne Simple code cleanliness dictates that you should deduplicate (DRY) the strftime call. Simple approach would be to conditionally subtract that delta from the value of now itself. if …: now -= timedelta(1) then just now.strftime for the "protected" attribute assignment.
Be careful of that, too, BTW. Double-underscore prefixed attributes are name-mangled.
I have this:

    def clean_password(self):
        user = super(UpdatePassword, self)
        valid = self.user.check_password(self.cleaned_data['password'])
        if not valid:
            raise forms.ValidationError("Password Incorrect")
And I get this error

  File "/mnt/d/adnewbies/website/forms.py", line 58, in clean_password
    valid = self.user.check_password(self.cleaned_data['password'])
AttributeError: 'UpdatePassword' object has no attribute 'user'
which can be the problem?
def clean_password(self):
    user = super(UpdatePassword, self)  # => self.user = ...
you need to define instance attributes
I think user is just a local name in that method right now
valid = self.user.check_password — where, exactly, is self.user coming from?
14:23
@amcgregor one line above
Except it's really not.
Even then, it's a leap into the dark because we can't see the whole picture
So either drop the self., or actually assign that attribute on the previous line by adding in self..
least-squares answer :P
@amcgregor well it's not, hence error
If the user hasn't logged in (which they haven't because you're doing a password check) what values does user have?
14:25
user = super(UpdatePassword, self) also looks weird, actually
I was expecting a mere brain fart but you're both right, we need more context.
all the code looks like this pastebin.com/77UY5Ri1
@AndrasDeak Not an unusual pattern, weirdly. My own authentication hook expects either (uid, user_object) on successful authentication, or None on failure. And while I haven't ever subclassed an authenticator implementation, that super() pattern would work for mine, albeit with a little more is None testing.
thanks a lot with that self.
if password1 and password2 and password1 != password2:
    raise forms.ValidationError("Passwords don't match")
:I
I'll just leave the password confirmation empty, then...
:cough:
14:30
return password2
Hooray, now I have no password
@Aran-Fey ( ͡° ͜ʖ ͡°)
Fun factoid, my password during highschool started with a null entered via Alt+Numpad. I never, ever worried about anyone ever getting into the account. XD
Hah, true, I'd be more worried about a poorly programmed website not being able to handle that character in the password!
I'm most deeply concerned with JSON-based APIs, no-SQL, and the abysmal "frugalness of time" of most developers. E.g. user=Alice&password=sekret — that's fine. user=Alice&password__$ne=unsekret — game over, man.
(Ref the same thing via JSON: {"user": "Alice", "password": {"$ne": "unsekret"}})
I'm afraid I'm not experienced enough in web dev to understand the problem there
Reasons to fear the safety of APIs 10485. I have no idea how that exploit works but I'm scared anyway
14:36
I get error password: ["This field cannot be null."], and it is not, but why?
@Aran-Fey github.com/MongoEngine/mongoengine/issues/… should introduce some of the concepts and link to useful whitepaper/guidelines for testing. "NoSQL injection" is what this is called. It's like SQL injection, but instead of exploiting variable substitution, you exploit the interpretation of structure to alter the meaning of the query.
With the two query strings I gave representing a normal query (the "fine" one) vs. the exploited query (using $ne to instruct MongoDB to match passwords that != the bogus value given.)
@OanaAndone I'm more than happy to try debug something if I'm given clear info on what the task is and what is not working. This is a disembodied error message. I cannot speak for others but I suspect others feel the same.
Wait, hold up, you're telling me people take a string of url parameters and interpret that as code/as a query?
I have a modelform here pastebin.com/77UY5Ri1
I use it in view
            a = User.objects.get(id=request.user.id)
            f = UpdatePassword(request.POST, instance=a)
            # check whether it's valid:
            if f.is_valid():
                f.save()
If a server expects to get a user and a password argument and I send it user=Alice&password__$ne=unsekret, I'd expect to get a "missing password" error. How do you screw up so bad that this turns into a vulnerability?
14:43
and says that "password: ["This field cannot be null."],"
@Aran-Fey Because there is a password being provided. The password is the Python literal {'$ne': 'unsekret'}, which is truthy.
>:D
Which will have been set on the database, and there's a form someone is filling out without presumably giving a password
parse_qs disagrees
>>> from urllib.parse import parse_qs
>>> parse_qs('user=Alice&password__$ne=unsekret')
{'user': ['Alice'], 'password__$ne': ['unsekret']}
>>> 'password' in parse_qs('user=Alice&password__$ne=unsekret')
False
@Aran-Fey Pity you're limiting yourself to a stdlib implementation of the raw encoding protocol instead of practical reality. PHP does this form of structured deserialization. My Python framework does, too. Additionally, there is the reality of JSON POST bodies.
@OanaAndone it's totally impossible to answer this as it is. Please give an MCVE. You posted all the code a while back but we need to get a grip on what you're trying to do and the circumstances of the error
14:49
Heck, WebOb itself multi-dicts repeated keys, which is a limited subset of this type of structured deserialization.
Unless I'm missing something here, you're both talking about GET requests to log people in rather than POST
Why would you be parsing URL strings in the first place for a login?
Hmm, alright, but that's not all it takes, is it? Even if that query string is parsed into something like {'user': ['Alice'], 'password': {'$ne': 'unsekret'}}, that still won't pass as the correct password unless you do something stupid
@roganjosh I'm referring to the general problem of structured data allowing for non-relational vulnerabilities as a result of the rich interpretation of that structure, regardless of input source, using urlencoding w/ popular conventions for inferring structure only as a light-weight inline example. Because nobody has time for multipart/form-data examples, and no endpoint should ever do anything on GET.
@Aran-Fey The query goes from "find me a user with matching name X and password Y" to "find me the first user who doesn't have name X and password Y" which will typically be the first user ever created in the DB, the admin.
Or, in my simplified example (the OWASP one exploits both fields ;) find me the first record whose name is "Alice" whose password is not "unsekret".
but why are you allowing the user to send you a query? why are you interpreting it as a query? that's clearly dangerous
As a demonstration of the vector.
14:58
I guess it's as ridiculously stupid as SQL injection and people keep playing into it for unfathomable reasons (like they do with SQL injection)
Obv, "don't be stupid, stupid" when it comes to security sensitive code. The lazy case of accepting **kw and passing those along down the chain does happen, as much as it makes me want to cheese-greater some faces.
I honestly still haven't accepted the fact that SQL injection still exists in 2019
Hell, on one project, our log out endpoint DID log out on GET. That meant every time our project manager typed 'm' into his address bar (top hit being our app, of course), he'd instantly be logged out.
@Aran-Fey For any developer worth their salt, SQL injections don't exist any more. Prepared statements and be relieved.
The era of "little bobby tables" is drawing to a close, thankfully.
I'm kinda of the opinion here of "you get what's coming to you". The attack vector really shouldn't exist, but then people continue the have SQLi-vulnerable code all over the shop so I can't really be surprised.
15:00
Little bobby tables is going strong, I assure you
"Mexican standoff? We Mexican deadlock 'round these parts!"
He'll soon graduate, just needs a few more takedowns under his belt
@roganjosh I ignore the existence of PHP and PHP developers. :cough:
Ha. Don't scapegoat on PHP for this. Check the SQL tags. Just make sure your heart is in good condition first.
15:05
@roganjosh Well, I've been lucky, and have also managed to ignore the existence of SQL for the last 8 years.
Well, ignore, other than occasional face-greatening when people come up with insane convoluted solutions where EAV would solve their problem instantly, and sensibly. XP
I actually think those questions might be your kryptonite mate. Don't do it.
@amcgregor Easier to Ask for Vulnerability?
Basically, NoSQL in SQL. ;^P
ah, for the glory of satan TLAs of course
For example, one organization giving a presentation one conference, presented on their ingenious Django data modelling approach. They were aggregating "events" occurring in space/time, e.g. home sale for $X, crime reported for crime Y, etc.
So, having a variety of data, instead of using an actual document store, or EAV (which would have worked great!) they came up with a virtual model layer that translated Django-side rich attributed objects to a single table containing 10 integer fields, 10 strings, 10 floats, 10 geopoints, 10… mapping individual back-end fields to attributes.
Sitting in the audience, I wanted to flip the table I was at. XD
99.5% of their data was repeated NULLs.
15:11
those should compress neatly, +1
Or EAV and store nothing at all for the NULLs. ;^P
But, hey, "we've got 10GB of event data" is way more impressive sounding in an elevator pitch than "we have a few hundred kilobytes of event data!"
Data storage is cheap. I record my own activity on millisecond basis. I'm either at work, at home, or in the pub. But we need precision on this, so it's all stored.
Heh, though what you just described sounds similar to the "weather in New York" example of Huffman coding. Also highly compressible.
Notably, I do similar, but I'm not constantly recording my current state. I only care about edges (state changes), not levels.
something something edge lord
Leads to far fewer event records to process, and, ultimately, for a given period of time X, constant time reporting for a constant duration of period. ;)
15:16
(edge lady sounds weird)
I hope it was obvious that I was being sarcastic :)
storing edges is basically RLE
I've grown used to line noise after I mention level or edge-triggering. At least here I don't actually have to explain what those are. ;^P
@AndrasDeak I have seen this line of thought before. Maybe the Big Crunch from yesterday? I do hope you have more material for academia :P
I'm and endless source of wisdom, if I may say so myself
15:23
Tbf, dark matter is "something, something", you just need the right buzzwords
Fortune cookie for the day: Subtlety in wisdom is saying one thing and meaning three, all true.
talk about dark matter
16:22
I have a list of objects and want to get multiple lists that contain all objects that fulfill a certain condition.
there might be objects that dont fit in any list
right now, i loop over the list of all objects and then use multiple if statements to filter and then append the current element to the resulting list
is there a better way?
I don't think so
there's no way to "unzip" a list comprehension into two output lists, for instance
(unless it's something trivial like separating each item mod 3 into 3 lists)
i mean i could do a list comprehension for each target list, but then i loop over the starting list multiple times... that is definitely slower
yup
loops are underrated
i think i am a bit sceptical when i use them because they can be substituted by something way faster in many cases ;)
Well, yeah. But there are situations where they make complete sense and you can't omit them.
16:36
the problem is you can not find out easily if you can omit them or not unless you have the right idea
I guess
or you can start with a loop and try improving later ;)
yeah, improving and optimizing the code while writing it might be the real problem here
17:20
can someoen help with a django quesiton?
or is this not the right chatroom?
It's the right room as long as you follow the rules
please read all of it to make sure :)
Django question as well....can I use the output of a method in a template? I'm getting the error "Invalid block tag on line 19: 'game.turn_color()', expected 'endblock'. Did you forget to register or load this tag?"
My template line looks like this: <p>Turn: {% game.turn_color() %}</p>
did you use an {% endblock %} tag?
no, I probably need a {% block %} tag to start it off as well?
yes
are you extending a template?
17:29
Yes. I do have a block/endblock...but my method is all messed up that's probably my problem
post it on pastebin or something
i can try to help, but i develop mostly on react
Got it. My method wasn't working and then I just changed it to {{ model.methodname }} instead of {% model.methodname() %}
 
2 hours later…
19:53
recbg
 
2 hours later…
21:58
im having an issue with my django app allowing the downloading of xlsx files via requests
response = HttpResponse(open(path, 'rb').read())
response['Content-Type'] = 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
response['Content-Disposition'] = 'attachment; filename=ProviderList.xlsx'
response['X-Sendfile'] = path
return response
is this not how the response object should look?
the file is downloading but the size is twice as big and is corrupted
I don't know anything about web stuff, but it's a bit suspicious that you both .read() the file at path and you pass on the path as the value for the X-Sendfile key
I would naively expect that the file only comes into play once, and the fact that you have it twice might have to do with your file being twice as large as necessary
removing the x-sendfile
still has the same issue
and vice versa
Is this the same as your question on main?
22:04
im thinking it has something to do with the 'rb' for an excel file
yes
@ValerioZhang are you returning the response directly with Django or there is some sort of reverse proxy like Nginx in front of it?
this is on my local machine
So when I asked you to read the rules you didn't actually read the rules
i haven't put it behind a webserver yet
22:36
I have an executable python file inside a module. The executable uses the module's internals. How do I resolve this relative import error? from .pie_slice import *.
I get ValueError: Attempted relative import in non-package, or ImportError: No module named pie_slice with __package__ = __name__.
Is your module a package?
I'm not sure? I don't know that a package is.
actually, what exactly do you mean by "file inside a module"?
It's a file inside a module in site-packages.
22:53
If you Google the error message, you’ll find multiple Stack Overflow QAs that can explain it much better than we can in a chat message here
there is a huge speedup in python 3.8 with the writing of class variables. will this also get ported to older versions?
It would help a lot if you could link the relevant bpo issue/proposal/PR request that you are looking at. But if not, that's fine tooo
23:09
What does "writing of class variables" entail?
Also what kind of "huge speedup"?
"Doubled the speed of class variable writes. When a non-dunder attribute was updated, there was an unnecessary call to update slots. (Contributed by Stefan Behnel, Pablo Galindo Salgado, Raymond Hettinger, Neil Schemenauer, and Serhiy Storchaka in bpo-36012.)
Reduced an overhead of converting arguments passed to many builtin functions and methods. This sped up calling some simple builtin functions and methods up to 20–50%. (Contributed by Serhiy Storchaka in bpo-23867, bpo-35582 and bpo-36127.)" https://docs.python.org/dev/whatsnew/3.8.html
23:58
so, what do you think? :) will this get ported to older versions?

« first day (3073 days earlier)      last day (2100 days later) »