« first day (3867 days earlier)      last day (1064 days later) » 
05:00 - 20:0020:00 - 00:00

5:55 AM
cbg
 
6:25 AM
@Kevin 100% it is. Even the title credits have that slight shake to the log as it zooms in on it. It's all deliberately retro, I think.
 
6:37 AM
hey guys when loading into pandas as dtype=str why would it still load an int that is set as 0148 as 148.0
loading it in I am using
df = pd.read_json(path + 'laboralkutxa.jsonlines', lines=True, dtype = str)
 
@ParitoshSingh I have also tried with a dict as here
df = pd.read_json(path + elem, lines=True, dtype={
            "ID_ATM": str,
            "TIPO": str,
            "ENTIDAD": str,
            "DIRECCION_COMPLETA": str,
            "DIRECCION": str,
            "TIPOVIA": str,
            "LITVIA": str,
            "NUMVIA": str,
            "LOCALIDAD": str,
            "MUNICIPIO": str,
            "PROVINCIA": str, "EMAIL": str,
            "HORARIO": str,
            "CODENTIDAD": str,
            "CODSUCURSAL": str,
            "NOMBRESUCURSAL": str,
yet still same result
 
try str in quotes.
perhaps try with one or two columns first just to test
(i dont really know the proper way to specify dtypes.)
import pandas as pd

from io import StringIO

df = pd.DataFrame({"a": [1, 2, 3],
                   "b": [4, 5, 6]}
                  )

temp = StringIO()
df.to_json(temp)

temp.seek(0)
df2 = pd.read_json(temp, dtype={"a": str, "b": float})
print(df2.dtypes)
#out
a     object
b    float64
dtype: object
works just fine for me here.
 
7:02 AM
hmm its really wierd right now importing with dtypes='O' helps import as python object but then when converting to strings it does the perhaps they are floats to begin with not ints as I thought o.O
 
7:57 AM
cbg
 
 
1 hour later…
9:25 AM
@Kevin As the subtitles from Netflix says, very ominous
 
@Kwsswart 0148 is neither a valid int nor a float in native python
 
@AndrasDeak I realized the error was further back when setting the variables originally I needed to set withing quotes currently fixing entire lot
 
pip install qlogging if you guys are interested in colored logging in console and notebook
 
@SinkingTitanic I would only use such a package if I could re-use my logger configs with it, which doesn't seem to be the case
 
@Arne its based on python logging, I guess you could use your logger configs? correct me if I am missing something.
 
9:33 AM
i.e., I want to keep using stdlibs logging.getLogger and have your package bound as a formatter class
I'll try if it just works, one sec
 
The logger you get from calling qlogging.get_logger(level='debug') is based on python's logging library, I guess you could!
tell me if it works for you
 
ok, a bit more than one sec, colleagues started calling and I have to work =(
 
no worries buddy!
 
@Arne the gall!
 
10:03 AM
@SinkingTitanic can't get it to work naively, do you see what I'm doing wrong? gist.github.com/a-recknagel/238cd768ccbac31c98d2118834788f06
 
@Arne let me take a look
 
feature request if this way of using it were supported: add ColoredFormatter to top level imports, and set the default colors as defaults in its constructor if None are given, so that I don't have to read the code and import colorama in my config
and documenting it, of course
@AndrasDeak right? the things I have to endure, just because they pay me..
 
10:18 AM
@Arne I am adding that feature currently, just give me a couple of mins
 
10:37 AM
@Arne I figured it out, pushing new version...
 
🎉 i'll retest once it's live
 
cabbages
 
10:55 AM
@Arne done, just pip install qlogging==1.0.5
@Arne check my reply on how to put your config gist.github.com/a-recknagel/238cd768ccbac31c98d2118834788f06
basically you just pass it on like this logger = qlogging.get_logger(logger_config=you_config_here)
@Arne did it work for you?
 
11:10 AM
@SinkingTitanic please don't post screen shots of code. If it's too large to paste in chat, use a pastebin service like dpaste or etc
 
for what it's worth the coloured logging at the bottom is the point here
 
oh sorry nvm then
 
it's not obvious without context :)
 
@tripleee sorry :/
 
11:28 AM
cbg
For the poor souls that regularly tune in to Typing and Order (every day in rooms/6 when I feel like it):
The problem from yesterday can be restated that adding/removing unrelated junk affects other things.
class Foo(Protocol[T]):
    # removing this method breaks the Protocol, because T becomes contravariant
    def a(self, some: T) -> T: ...
    def b(self, some: T): ...
And... that's fully in line with the spec. :/
 
Umm... first time I've seen from used like this: from ....discount.utils import fetch_active_discounts
 
That's a lot of dots!
 
... is a no-op so that's equivalent to
from ...
.discount.utils import fetch_active_discounts
@MisterMiyagi this always feels like the 12th season of an anime I don't watch, and I have no idea who the characters are or what they are doing and why. I don't even know whom to root for.
 
11:44 AM
The only winners are people like you, who don't watch the anime
 
finally, the success in life I've been hoping for
 
@SinkingTitanic it probably will, but I'd rather call logging.config myself. My applications get kind of complex, and I need to separate get-logger calls from their initial configuration. I'd say adding the option to pass a config to get-logger is a design mistake, if you want to enable my use-case then changing ColoredFormatter's init to this would serve me best instead:
    def __init__(self, *args, colors: Optional[Dict[str, str]]=None, **kwargs) -> None:
        """Initialize the formatter with specified format strings."""
        if "fmt" in kwargs and "%(color)s" not in kwargs["fmt"]:
            kwargs["fmt"] = "%(color)s" + kwargs["fmt"]

        super().__init__(*args, **kwargs)

        self.colors = colors if colors else {
                    'DEBUG': Fore.CYAN + Style.BRIGHT,
                    'INFO': Fore.GREEN + Style.BRIGHT,
                    'WARNING': Fore.YELLOW + Style.BRIGHT,
 
@AndrasDeak You've just summed up both typing and German entertainment. Guess that's telling...
 
12:05 PM
that's a good show though
writers lost their marbles after one season, but good none the less
 
yeah that typing plot twist is why I went over to take a look at what Rust did with types, and never looked back
 
 
1 hour later…
1:12 PM
how it happen that python room was one of the most active
and loose activity
 
We have active days and inactive days
 
Active and inactive portions of each day really
 
to me this seems the same since I started logging in here, and I would say it is active than the language agnostic regex room
 
oh but regex is so much fun, how could that be? ;)
 
lol, I just checked the room and the only active user seems to be a bot
 
1:28 PM
Truth be told, most problems that people ask about these days just aren't interesting. That's especially the case for SO main, but chat tends to be affected by the activity/mood of main.
 
I think most problems have always been inherently uninteresting. That's why the whole SE Q&A model is incentivized via imaginary internet points, or even more important, one's imaginary internet "reputation"
 
l o o s e
 
Problems were interesting back when we still had the same problems
 
cbg @davidism
 
The challenge of solving a well defined problem is inherently interesting, however. I might also note that given the ubiquity of the web, internet reputation is no longer imaginary.
 
1:44 PM
cbg
I started solving "interesting" problems in Pallets/Flask instead :-)
 
@Dodge Let me put it this way: These uninteresting problems at least were novel once. Explaining "how to filter X by Y" can actually be a nice task, if not for technical then educational merit. But facing a slew of questions only differing by X now being x, χ, u03c7 or whatever that just go straight to drowing in the trash heap... nah.
It doesn't help that a sizeable number of people now doesn't have the background knowledge to understand their own code, least of all an answer.
 
@MisterMiyagi Why is the latter any different than the former from a purely technical or educational standpoint? If it's well defined it's not bad. But I agree that most people do not try very hard.
 
2:00 PM
@Dodge It's not, that's the point. Many people don't care about the answer-to-a-problem-that-is-theirs already existing. That's... not motivating to provide yet another answer.
 
Hi everyone. I have an actually simple question but not able to find the answer for. I have a categorical variable I am plotting against a binary variable additionally with a third categorical variable
 
cabage
 
sns.barplot(x="churned", y="subscription_game", hue="gender", data=user_data)
 
stops ranting
 
the variable 'subcription_game' has 41 unique values which are making it difficult for me to analyze. My question is whether there is a better plot to use for this or any adjustments I can make?
 
2:08 PM
churned is categorical?
That's a bit..weird as a first impression
 
yeah churned is a categorical binary variable (1,0 for values)
 
Knee jerk reaction without context: sometimes you can aggregate categorical variables to make more sense out of them
 
Yeah I am aware of that but if I wanted to include all 41 unique values, is there a better way ?
 
2:21 PM
cabbage
 
cbg
 
babbage
 
2:39 PM
Hi everyone, I couldn't find anything in the rules about it - is it ok to ask here for a wiki review on a Python-related tag?
 
sure. which tag?
 
Anyone here written a REST API that uses OAuth for authentication?
 
@Tomerikoo yeah, that's fine
 
structural-pattern-matching Thanks! I just know that wiki reviews take forever in the queue and I really feel this is an improvement (of course you're free to reject:))
 
Hmm, not sure we need that tag
Or if we do it should be language-agnostic
 
2:43 PM
@Code-Apprentice No, but it sure doesn't sound like an easy task! I've wondered a few times if there are any modules for that kind of stuff
 
@AndrasDeak I was also not fully sure, but thought it could be useful...
 
@Aran-Fey implementing the OAuth itself isn't difficult. python-social-auth does all the heavy lifting.
 
@AndrasDeak There is the that I've seen used with Python before the new feature
 
@Tomerikoo that sounds wrong
 
2:46 PM
The part I'm trying to figure out is how to authenticate each REST request. Typically, I do it by having a specific endpoint to get a token by posting username/password credentials. But with OAuth, I won't know the credentials on the backend in order to verify they are correct.
so I need to figure out what should be posted to the /token/ endpoint instead.
or find a different approach entirely
 
@Tomerikoo I'd prefer to synonymise "your" tag into and adding shorter language-specific stuff there
But that's just my two cents
 
@AndrasDeak I tend to agree. The tag wiki I wrote can be migrated into the one...
 
Yeah, that could work
 
Well, the PSA docs are doing exactly nothing for me... guess previous experience with web servers is required
 
@Aran-Fey must have been written by wikipedians
 
2:54 PM
To be fair, we're all wikipedians, to some degree
The documentation I write also assumes previous knowledge of python ¯\_(ツ)_/¯
 
@Code-Apprentice What is your site's role? Are you the identity provider, or the third party that wants to access data that the identity provider possesses?
 
@Kevin I'm a third party. I don't necessarily need to access data for other services. My idea here is to allow users to sign up with my service via an oauth provider, such as Google.
 
Ok, makes sense
I'm currently reading up on https://oauth.net/articles/authentication/ which discusses pitfalls of using oauth for authentication by itself
 
so basically the user clicks on the Google icon, the app makes a REST request to my "login" route which redirects to the Google OAuth pipeline, and they enter their username/password for their Google account. So the final part is I need some kind of token to use with other REST endpoints.
@Kevin thanks for the resource. I'll take a look at it. Looks like it's a good high-level view of some concepts.
 
The impression I'm currently getting is "oauth won't authenticate for you out-of-the-box, but identity providers with robust APIs might have implemented authentication in addition to what oauth requires"
 
3:08 PM
hmm...I guess that makes sense. I'm using python-social-auth in a Django app. After the user goes through the OAuth process, the library creates a User object in Django. So in theory I might be able to use that object for the actual authentication with my service.
 
cool...that gives me some reading to go over
my first use case for this REST API is with an Android app, so Google will be the first provider. I may add others later if users ask for it.
 
Hmm, not sure if I like that the final step of the "authenticating the user" process is called 6. Authenticate the user. Possible "draw the rest of the owl" situation going on there
The good news is, this protocol should be the same for all OpenID providers, so you only need to draw one owl
 
3:25 PM
Is single sign-on not a related concept?
 
Wikipedia says: "Other shared authentication schemes, such as OpenID and OpenID Connect, offer other services that may require users to make choices during a sign-on to a resource, but can be configured for single sign-on if those other services (such as user consent) are disabled."
So, yes, I think it is a related concept. I'm not sure I exactly understand what it's describing here though
If single sign on is just "user authenticates with service A, which calls its friends services B through Z and tells them the user is trustworthy", I don't see how the OpenID configuration could interfere with that in any case
 
3:42 PM
I don't get why they draw such a strict line between "user" and "client" here. Why does the API/server care if an actual person (i.e. a "user") is there or not?
 
In other words, if service A asks the user to authenticate through google, what's stopping them from emailing the authentication token to everyone it knows saying "hey, any user that connects using this token is John_Smith, don't bother asking them to authenticate"
 
Also this:
> In OAuth, the token is designed to be opaque to the client, but in the context of a user authentication, the client needs to be able to derive some information from the token.
Why would the client need to extract any kind of information from the token?
 
Good question. I don't see an obvious reason for the client needing that data in the most basic use case.
I'm trying to visualize the client as a program (or even a person) that the user has authorized to take certain actions on their behalf. I imagine that most of the time, a client is not granted 100% authorization to do anything to the user's account. Maybe it's simpler for the relying party to say "I don't want to deal with a client, with their limited abilities. let me talk to the user"
 
The problem is that users (i.e. people) don't tend to speak HTTP :P
 
Especially if the relying party also wants authorization to perform some action on behalf of the user. I speculate that it's doubly rare for clients to have authorization to give authorization to other clients
 
3:53 PM
There is always a client between the user and the server
 
Right. I'm trying to figure out where the turtles stop going down
Perhaps the user's personal web browser is as close to "totally authorized client" as programs usually get
 
On the plus side, I'm starting to understand why people still store passwords as plaintext. It's certainly less of a headache than this
 
Hmm, I think I misunderstood what the "client" was in that article. I first thought it was the client's software talking to the other parties via HTTP. But now I think it refers to the application that wants the user to authenticate themselves.
 
@Kevin The later is my internal definition of "client" in the proceeding conversation.
 
So if I open Apprentice's application and it asks me to sign in via Google, then my meatspace body is the user, my local Firefox process is also the user, ApprenticeApp is the client, and Google is the protected resource
 
4:06 PM
I'd define "user" as the object in my code that represents you in my app.
 
When I sign in via OAuth, by default the token that Google sends to ApprenticeApp will be opaque. It will say "yep, the person or robot you just redirected to me indeed has the ability to log in to my system. Regards, Google". This is less than totally helpful if ApprenticeApp wants information such as the user's gmail address.
 
at this level, I'm only concerned with the acknowledgement that the "user" is able to log into google.
 
Ok... I'm trying to envision whether that means you can use just OAuth and skip OpenID. I want to say yes, but...
 
Hmm, I'll have to re-read the article and see if it makes more sense with that interpretation
 
The mere presence of a page that says "here's all the ways people usually screw up using OAuth" implies that I shouldn't make hasty proclamations of safety
 
4:11 PM
fwiw, python-social-auth gets the first name, last name, username, and email address from Google somehow.
 
In particular I worry about the gap in between "Google sends REST packet to ApprenticeApp saying 'yeah this guy is legit'" and "ApprenticeApp tells user 'ok, you can come in'". I think a bad guy can wedge themselves in there if you're not careful
On one of my many open tabs, I saw some talk about CSRF tokens and randomly generated nonces that are supposed to help in that case, but I forget if it's an OAuth thing or an OpenID thing
@Code-Apprentice Interesting. If it's using only OAuth, then I'm surprised it can get that information. On the other hand, if it's using OpenID on top of OAuth, then that information should be simple to get.
 
hi kevin
 
Hello
python-social-auth definitely can talk to Google via OpenID, I'm just not sure if it does that by default if you don't specify. Admittedly I have not looked at a single line of code yet.
 
it got the user details by default...IDK how exactly.
 
I'll put 50/50 odds on "Google is doing something weird" and "Kevin doesn't know how any of this works"
 
4:21 PM
neither Kevin nor google knows how any of this works
 
Ok, new theory: the opaque authorization token that Google's OAuth hands to ApprenticeApp allows it to send additional requests to Google asking for user information.
To use a terrible analogy, you can't figure out someone's name just from their house key, but you can use it to go into their home and rifle through their mail.
Here is where I dearly hope that Apprentice does not reply saying "nope, I've been watching the network with Wireshark and I'm definitely only getting a single packet from Google that must somehow contain both the token and the user's information"
 
@Kevin I haven't looked at the details of how this happens at all. I just see the end result in my own database.
which is running locally for now, but will eventually be deployed to a server somewhere
 
OpenID's auth response contains details about the user. OAuth's response doesn't, so the library has to hit the provider API to ask for more info
 
4:40 PM
makes sense
 
Ok, I feel pretty good about all this... I think OpenID is the right way to go for your use case
 
I'm still reading these two articles you sent me.
 
Excellent. I feel more secure when people independently verify my counsel. (not sarcasm)
I'm less an expert, and more a mad oracle whose funny dances can sometimes be interpreted as auspicious signs from the gods
 
Is switch case implementation in python a myth ?
no official syntax ?
or is it not necessary conceptually ?
 
I don't know what you mean by "myth". There is no switch statement in Python.
Mythologized or not.
 
4:49 PM
@PIngu you can edit/delete messages for 2 minutes in chat
 
i see some articles saying p3.10 has it, some say python has it
@AndrasDeak much needed
 
@PIngu switch is not a thing. Starting with python 3.10 we'll have structural pattern matching which can be used as such, but is way more powerful.
 
@PIngu Python 3.10 has a match statement that can be abused as a switch statement, but is not the same thing.
 
how is the O(n) difference between if-elif model and the so called proposed switch model
am i losing something in terms of cpu when i implement a long say 1000 rules in if-elif syntax
 
@PIngu don't have 1000 rules in if-elif. And I saw that question within the last 24 hours, it's on the main site.
 
4:53 PM
@AndrasDeak what is ?
 
I saw that a few hours ago, to be precise
@PIngu there's no so-called proposed switch model
 
@Aran-Fey In context, I read the quoted statement as the author's argument why the access token isn't proof of authentication. He's saying that the client needs additional information that isn't directly available from the returned access token.
 
as far as i could comprehend from the PEP 634, Pattern matching is an aesthetic skin to the chained if-elif's in terms of computational competency, let alone its use case improvements and wildcard matches. Am i wrong in jumping into this conclusion?
 
No, I agree with you
 
@PIngu the usual term is "syntactical sugar", but yeah
 
5:02 PM
By "aesthetic improvement", do you mean that you can do the same things with current syntax?
 
From the PEP: "The match example version and the traditional Python version without match translate into similar code under the hood"
@Code-Apprentice Yes, although the current syntax is quite wordy
 
Can anyone help me access an api from Python? I've managed to get it working in Postman but no matter what I try, I can't get it to work in Python :/
 
the real kicker is doing things like Point(0, y) or something similar which would need you to do if isinstance(obj, Point) and obj.x == 0 and obj.y == y or similar
 
I wonder if any languages with switch-case blocks sacrifice flexibility for speed by only allowing static hashable expressions as cases... Then you could effectively power it with an O(1) dispatch dict
 
actually that last part is dumb, y would probably be a wildcard
 
5:08 PM
@JamesMcIntyre don't ask to ask, just ask. In this case, you need to include some more details if you want help.
 
@AndrasDeak i was aware of the term, but using the same might project me as a full time developer, and i don't want that as my title card.
 
@PIngu using jargon doesn't make you look like a python dev, only more understandable
 
You can use full-time-developer jargon in here, we promise not to tell anyone ;-)
 
I don't know much about APIs but I'm using a postman collection jason to connect in postman but even though I've looked inside this file and have been looking in the postman settings and googling to try and find out the nature of the api and how I connect to it with Python, I've been having no joy
 
In the absence of evidence I assume all users are unemployed 12 year olds
 
5:11 PM
*13, or 16 in the EU
 
Good point. I assume they're minimally old enough to legally click through the "yes, I agree" prompts necessary to get here
 
@JamesMcIntyre I don't follow any of that sorry
 
Same
 
is there a way I can connect to an API with Python, using a postman collection jason?
 
@JamesMcIntyre I assume by "jason" you mean "JSON". What troubles are you having trying to implement this in Python? Do you have documentation available for the API?
 
5:15 PM
What is a "postman collection jason"? I echo Code-Apprentice that you probably mean JSON but why you'd want to access something from postman is beyond me. Is this some weird scraping XY problem?
 
@JamesMcIntyre what is this Collection JSON? (see my previous assumption) How do you expect to use it? Do you understand how HTTP works? Do you know what a request and a response is?
 
It's an in house API. There is a doc on how to create it but as yet not to connect to it and I'm the main one in the team who use Python

A file which you can import into Postman to access the api
 
If the question is "I have this software called Postman, and I'm using it to talk to a web API. I'm getting meaningful data back, and now I want to do this same thing in Python. How do I make Postman tell me what queries it has been using?", then this may be outside our area of expertise
 
And what is in that file?
It's presumably just setting headers for you
 
That was the question Kevin
possibly. I've used thing like cx_oracle before in Python but never raw requests i.e. import requests
 
5:18 PM
KevinScript (abbreviated "KS") is a programming language inspired by Python and Javascript. of what i see itis python only
 
It looks like a collection is a Postman feature. I'm not familiar with them, though, so have no idea how they might be useful in implementing any Python code.
 
@JamesMcIntyre That's not what we need to know. What we need to know is what the file is doing
 
my api contains a header which has a "key", a "type" and a "value".

Is there any way I can use this information to get access to the api via Python?
 
Have you opened the file in an editor to look at what it contains?
 
@JamesMcIntyre You can use urllib2 or requests or another HTTP library to implement the same requests in Python as you have in your Postman project. If you have a file that describes these requests, then you can definitely consume that file to make the requests. For documentation purposes, that seems less helpful that explicit requests examples.
 
5:20 PM
Those packages better to use than requests then?
 
Peronsally, I'd use requests.
 
No. You only need requests and you just need to look how to set headers
 
@JamesMcIntyre also POSTMAN GUI tool can export requests and actions into neccessary languages of your choice, python being one. Thought this might help you with the initial templating, just in case.
 
I've set headers to my headers in the JASON file and then I've ran the following but I'm still getting an error message

test = post(Endpoint, headers=Headers)
 
@JamesMcIntyre what is the error?
 
5:24 PM
Two hours from now, we'll discover that the config file wasn't being recognized because it was named config.jason instead of config.json ;-)
 
@Kevin or vice versa
 
SSLError: HTTPSConnectionPool(host='coreapi-dev.ugl.local', port=443): Max retries exceeded with url: /PostDataPackageAccessRC/PK_AUTO_LANDLORDSUI/GET_DATA (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1125)')))
 
"What, you guys have never heard of Postman's custom human-readable data serialization protocol, JASON? It's named after Jason Postman, the main developer"
 
PIngu, that sounds amazing. I'm gonna try and find how to do this!
 
@JamesMcIntyre I suggest googling this error message to see if you can find a solution.
 
5:29 PM
@AndrasDeak Oh! I was thinking about C++ but I dismissed the possibility because it has case fall-through. In hindsight I guess it's not too hard to code that into a jump table too.
Or organize your chunks of generated assembly so fall-through happens naturally without needing jumps
 
I have tried this Code.

What's really odd is that I've just found where to export the Python and I'm getting the same error message when I run the export from Postman even though it works in Postman... I'm starting to wonder if our admins have blocked Python as a way of connecting
 
@Kevin I'm getting advent of code flashbacks
 
Ok, so requests doesn't work but http.client does!
 
@AndrasDeak I'm probably describing it more complicatedly than it is
 
Thank you very much PIngu! Postman gave me two options for exporting Python code, one was with requests, which resulted in the same error but the other was with http.client which worked!

Also thanks for eveyone else's time as well. I really appreciate it
 
5:34 PM
I'm glad you got it working :-) network problems can be real frustrating.
There's always a dozen points of failure and you can only get good diagnostic data for a quarter of them. Half of them if you own bolt cutters and a fake mustache.
 
Haha, very true Kevin, thanks
 
yah, troubleshooting a SSL error is not fun because there's so many places it can happen.
 
6:08 PM
@Kevin After reading those two links, my working hypothesis is that python-social-auth already takes care of all those details for me.
and it's almost certainly using Open ID under the hood even though it's labeled as "oauth"
 
That's the feeling I had too
 
which doesn't solve my current problem
My current issue is figuring out how to request authorization with each REST API request. Normally I send a JWT token in the Authorization header. So then the problem is where do I get such a token from. In other projects, I have a /token/ route where I can post username/password credentials. I think I can make a similar route, but use credentials returned from the OAuth/OpenID process instead.
 
anyone use algoexpert? do you guys recommend it?
 
Maybe this library is the way to go. It hasn't been updated for 2 years, though...
 
So you want the user to post username/password credentials to ApprenticeApp? Doesn't that defeat the purpose of OpenID?
 
6:18 PM
the websites I've seen with oauth ask for your password themselves
 
I'm 75% sure you're not supposed to do that
 
Assuming I understand what oauth is. I mean "sign in with google/github/etc.".
 
Short answer: yeah
 
Or maybe they didn't? Now you're making me uncertain with 75% probability.
The last two places where I used this were with github as the authenticator(???), but my session is already logged in there so I didn't have to provide a password in the first place.
I'll backpedal to the comfortable region of "I don't know if they ask for passwords"
But yeah, not asking for it would make sense. I was fixating on not storing your credentials, but then asking for them to throw away after auth is also silly.
 
@Kevin Ultimately, I want to secure the endpoints for ApprenticeApp without requiring a user to register directly. I think I have the registration figured out using python-social-auth. I'm now trying to figure out how to do the authorization part for my own endpoints.
@AndrasDeak For example, if you are signing into SO and click the "sign in with google" link, you are redirected to a google login form. SO doesn't ask for your google username/password directly.
 
6:27 PM
authorization or authentication?
 
@Aran-Fey atm, I'm trying to figure out the authorization part.
I think I have the authentication part finished.
 
@Code-Apprentice makes sense, thanks
 
@Code-Apprentice There are multiple others just like it
 
This article seems to describe the same thing I'm trying to do.
@12944qwerty do you have any experience with any of them? any suggestions which one to use?
 
Let me try to find the one I tried using
I know it works, but I myself, wasn't able to understand and use it fully
 
6:31 PM
even attempting to get it to work and not fully succeeding counts as "experience" in my book
 
"How to do authorization" is a bit fuzzy here because it could either mean "how ApprenticeApp gets authorization to look at or change information in the user's Google account" or "how ApprenticeApp decides which users are allowed to make changes to data that belongs to ApprenticeApp". Or maybe a third thing?
 
the later is what I'm trying to figure out
s/make changes/access in any way/
 
What's ApprenticeApp?
 
It's the imaginary app where I am implementing OAuth
 
6:35 PM
Kevin gave it a name for clarity in our discussion
 
Ohk
I'm really messing up links today
 
I'm imagining something like: randomly generate a session key and bundle that with the Oauth process. Once Oauth succeeds, both ApprenticeApp and the user know the session key. On all subsequent page loads, the user provides the session key in a header or something. You look up that session key in the database and verify that it belongs to a user that has permission to view the current page.
I'm basically just paraphrasing the step described at developers.google.com/identity/protocols/oauth2/…
 
I'm not even gonna pretend to understand this "wacky version of hello world"
 
Short version: @decorators act a lot like function calls.
 
@12944qwerty thanks I'll look at it
 
6:40 PM
It may be interesting to experiment with dis to see precisely what a decorator is doing
 
Don't decorators technically get called bottom to up?
 
@Kevin yah, something like that sounds about right. Now to figure out the "generate a session key" part...
 
dis?
 
@12944qwerty Much in the same way that nested functions get called inside to out :-)
@12944qwerty The built-in module that displays Python's compiled bytecode in semi-human-readable form
 
@12944qwerty It is more helpful to imagine a decorator as wrapping one function around another. When you call the first function, it delegates the processing to the wrapped function.
 
6:42 PM
Hmm, and I'm assuming that it first gets the vars, which is in dictionary format. Then turns into dict and gets the values. It then converts to iterator and gets the first/next item and then prints it out
@Kevin dis.dis(Foo) returns a RuntimeError
no last traceback to disassemble
 
Yeah you'd probably have to put all of Aran-Fey's code inside one function, and then dis() that function
 
@12944qwerty I think I understand it
@Kevin print(next(iter(dict.values(dict(vars(Foo)))))) like this
I'm sure there is a faster way: print("Hello World")
 
print("Hello, world!") is even faster :-)
 
I didn't know that iter() was even a function until now lol... I just assumed it was a type and never a callable
Though I should've known
 
Many types are callable. (But not all, for example type(None))
 
6:53 PM
@12944qwerty where did you see iter in a non-call context?
 
@Code-Apprentice (totally naive on this subject) is this what you could use JWT for?
 
@AndrasDeak I meant iterable type
 
@roganjosh I think so. That's what I'm most familiar with in this kind of situation.
 
@Kevin isn't type() callable?
 
Yep
 
6:55 PM
@12944qwerty what is "iterable type"?
 
The type iterable? lists, tuples, dicts, etc
 
There's also an OAuth guide from Miguel for Flask. I know you're using django but I wonder if there's cross-over in approaches
 
@roganjosh thanks I'll look at it
 
I really need to learn decorators... I'm testing one out right now, but it makes no sense :(
Like, why, if you call a decorator, it's different than when you don't call it.
 
You mean @decorator vs @decorator()?
 
6:59 PM
just remember that @foo def bar() is the same as def bar()... and bar = foo(bar)
 
yes
@ThiefMaster hm, that's good to know
 
so with a called decorator that's bar = foo()(bar) or bar = foo(someargs)(bar)
 
For the same reason why calling a function is different from not calling a function :|
 
so the actual decorator is what foo() returns
 
@12944qwerty can you provide a code example to illustrate what you are asking?
 
7:04 PM
I've got to go right now, I'll send when I come back
 
If you're saying "you know, the iterable type? The base class for everything you can use in a for loop?", that's not actually a real type. list and dict both inherit straight from object, for instance
 
it's a duck type
 
collections.abc.Iterable is a thing, but it uses trickery to make isinstance([], collections.abc.Iterable) return True, rather than being a real part of its inheritance hierarchy
 
7:49 PM
I thought that if we open the complied exe(with pyinstaller) on a hex editor we would get the source code. I feel like I have done it in the past, too
 
I'm not too well acquainted with how executables store data, but it doesn't sound too far fetched that the plain python source would be right in there. Maybe there's a command line flag for that.
 
Actually I think Recover code from Pyinstaller build and .spec file is the only way to get source code back. But still I feel like I have a weird memory of using hex and seeing the source code :P
 
i used to compile program into .exe and deploy it, most importantly to prevent it from getting reverse engineered.
 
A sufficiently determined bad guy could almost certainly reverse engineer it anyway, but at least it stops 99% of low-effort script kiddies
 
@PIngu Hmmmm following my answer above, I think it is possible to get most of the code
 
7:56 PM
It's impossible to obfuscate a program so thoroughly that its logic is incomprehensible. If you did, the computer wouldn't be able to run it.
 
@Kevin even if the code is not written in Python?
 
Sure, programs that aren't written in Python are reverse-engineered every day.
 
@Kevin I mean, almost 100% reverse engineered
 
Speaking of executables and bad guys, I dipped a toe into miniconda, and the python3.8 folder for my env is 2.1 GB large. The one I built from source is 300 MB...
OK, the equivalent venv is also 2.2 GB large. I guess that explains it.
 
@Marco Depends on how you're measuring. A C program compiled with minimal diagnostic data will completely discard all your variable names, and no bad guy could possibly recover them. But they can still see all your function calls and conditionals and assignments, and maybe that's enough.
 
05:00 - 20:0020:00 - 00:00

« first day (3867 days earlier)      last day (1064 days later) »