Readit News logoReadit News
jbjohns commented on OpenID Connect specifications published as ISO standards   self-issued.info/?p=2573... · Posted by u/mooreds
drdaeman · a year ago
Identity provisioning is an abomination that shouldn't have been invented. I used to be a fan back in mid-'00s, self-hosting an OpenID server, without realizing how the whole concept is so fundamentally flawed.

Identity is an innate and inalienable property of individual, not something that anyone else (another person, company/website, government or whoever else) can "provide". They can merely attest by providing a credential, by e.g. issuing a passport.

At least Webauthn got this right.

jbjohns · a year ago
But does this not make the assumption that the Identity being provisioned is exactly you and only you? I've always seen these identities as my pseudonym on some identity provider and use them in that manner.

I suppose I've used some identities in enough places that it would be hard to deny to certain entities that the identity was mine, but even in that case it's a small subset of entities which have seen the identity that could prove that it's me.

jbjohns commented on Hazel: A live functional programming environment featuring typed holes   hazel.org/... · Posted by u/deepakkarki
jbjohns · a year ago
Interesting. I didn't notice any reference to Idris [1] but that was the first place I saw this style of development.

[1] https://www.youtube.com/watch?v=mOtKD7ml0NU

jbjohns commented on Platform Strategy and Its Discontents   infrequently.org/2024/10/... · Posted by u/wmanley
pjmlp · a year ago
Just tried the site, and already the first problem is isn't as interactive as the Websites for any JavaScript framework, because naturally there is a whole contraption to make the code run into the browser.
jbjohns · a year ago
That's odd. I have been following along here [1] and it seems just as interactive as Svelte, Angular or any of the others I've tried. There might be a few more tools that have to be installed, but that's a one time step.

[1] https://book.leptos.dev/01_introduction.html

jbjohns commented on Platform Strategy and Its Discontents   infrequently.org/2024/10/... · Posted by u/wmanley
DeathArrow · a year ago
I agree with points about openness and gate keeping. But from my point of view, the web is the worst platform to run apps.

I worked on microcontrollers, system software, desktop software, mobile apps, games and now I am a full stack web developer who mostly does backend and defers most of the front-end tasks to colleagues.

I don't like JS frameworks and it was far more enjoyable for me to use QT, Borland C++Builder, Windows Forms XCode and Android Studio than to use Angular and React and even Vue.

Aside from Web front-end to being a less enjoyable experience for me, the Web was designed for websites, not for apps. Web as an app platform means subpar experience for the users, too.

We tried with Flash and Java applets running in the browser. Those died and now we have the Javascript mess.

When, if ever, Wasm will have full access to browser DOM, maybe we can get rid of the Javascript mess. But then, again, why bother running a binary app in the browser when you can run it on the desktop or phone?

And even if web as an app platform is said to promote openness and impede gatekeeping it still has a terrible downside for the end user: it makes the user rent the software instead of owning it.

jbjohns · a year ago
The founder of Leptos makes a pretty good argument [1] that the bottleneck for WASM isn't really the DOM and that they are already faster than some popular JS frameworks even with the current constraints.

[1] https://youtu.be/4KtotxNAwME?si=IEZ5kRHR_W2o9i_k

jbjohns commented on Firewall rules: not as secure as you think   haskellforall.com/2024/08... · Posted by u/jnord
siamese_puff · a year ago
I mean, couldn’t any semi popular, transitive dependency installed with <insert package manager here> do the same thing with a reverse tunnel? Imagine a simple go module that kicks off a background routine that just keeps a tunnel open with a direct call to os.exec. Seems like an easy way to cat env and pipe back secrets to the attacker
jbjohns · a year ago
That's what I was thinking. Or any application at all. If MS word started doing this, how long would it take to recognise? Especially if it's only periodic and only some small percentage of their install base.
jbjohns commented on Future Ford's May Detect Speeding and Report You to the Cops   motorauthority.com/news/1... · Posted by u/rmason
jbjohns · a year ago
I used to get a lot of tickets until I cruise control got reliable traffic detection. Now I have it on almost exclusively. The only places I get tickets now are usually places that the speed changes and I don't notice.

I would like to set my cruise control to just be "current speed limit". If these cars are going to start monitoring the speed limit to the degree of being able to tell if you're breaking the law, they better have such a setting. If they don't then it seems almost like some sort of entrapment.

jbjohns commented on Apple must open iPadOS to sideloading within 6 months, EU says   arstechnica.com/apple/202... · Posted by u/rezonant
beretguy · 2 years ago
> This move means the end of an enforced, curated walled garden for iOS.

Great! (Imagine having wallgardened Windows computer where you could not install whatever you want).

> This will mean a race to the bottom for iPad apps. Which, of course, means even more ads

iOS store is already at the bottom. Everything is with ads or subscription based. More ads won’t scare me because I won’t use app with any ads. If app offers one time purchase - I’ll buy it if I like it. Examples of apps I bought: Structured, Bobby, ArtStudio, MusicStudio.

> if I want to install things outside the walled garden, I use a my Mac not a mobile device

What if Apple decided you cannot install apps outdide off their App Store on a Mac neither? What would your “Apple-defending” argument be then? It’s NOT a far fetched idea. Microsoft tries it with Windows S Mode and they currently constantly threaten people when they download software from internet about how dangerous it may be, trying to scare people into using their store.

jbjohns · 2 years ago
>Great! (Imagine having wallgardened Windows computer where you could not install whatever you want).

Again, you are presenting this as if it has only one side to it. I need a computer that has no walled garden for certain kinds of work. For other kinds of work I'm happy to know I can't break it. Even more important, I'm happy when my parents can't break the one I buy them.

>More ads won’t scare me because I won’t use app with any ads. If app offers one time purchase - I’ll buy it if I like it.

As long as such an option exists. But in a true race to the bottom situation, there may not be anyone willing to invest in developing an app and then selling for a one time purchase. One time purchase is a model that's nearly dead anyway.

>What if Apple decided you cannot install apps outdide off their App Store on a Mac neither?

This I wouldn't accept because I can't. It's a development machine for me. But an iPad is a consumption device, I need the thing to just always work.

jbjohns commented on Apple must open iPadOS to sideloading within 6 months, EU says   arstechnica.com/apple/202... · Posted by u/rezonant
beretguy · 2 years ago
Why are you defending having less ownership over devices that you own? It’s like your employer wants to give you a salary increase but you complain and say you don’t want more money.
jbjohns · 2 years ago
Why are you presenting something that happened as entirely one sided? This move means the end of an enforced, curated walled garden for iOS. This will mean a race to the bottom for iPad apps. Which, of course, means even more ads (since everything must be paid for one way or another). It likely means iPad prices go up even more because now they're forced to support configurations they've never tested.

For me personally, all of the above is the cost and what I get is something I wasn't using and didn't miss (if I want to install things outside the walled garden, I use a my Mac not a mobile device).

jbjohns commented on Coroutines and effects   without.boats/blog/corout... · Posted by u/todsacerdoti
codethief · 2 years ago
Can anyone explain what exactly the author means by "dynamically scoped" vs. "lexically scoped"?
jbjohns · 2 years ago
https://github.com/Chalarangelo/30-seconds-of-interviews/blo...

Exception handling, for example, uses dynamic scoping since you don't know what will be handling your exception when you write code which throws it.

Another way of thinking about it is, with dynamic scoping the value of the dynamic variable must always be on the stack and the closest one is the value that will be used. This is a really good behaviour for global variables since a common source of bugs is some global variables (and I'm considering class members "global" for this) getting changed unexpectedly. If the variable is lexical then it can be very hard to figure out what changed the value (especially when threads are involved) but if the variable is dynamic it's easy: the culprit is in the stack trace.

jbjohns commented on Coroutines and effects   without.boats/blog/corout... · Posted by u/todsacerdoti
amluto · 2 years ago
This touches on something I’d like to see in more mainstream languages, but it doesn’t quite get there.

> For example, Koka has a “diverging” effect, which means that an expression may diverge (that is to say, it may not finish evaluating). An expression containing a diverging expression is also diverging. So you can distinguish in the type system between a function that is guaranteed to finish and a function that may not finish (this is imperfect, of course, because of the undecidability of the halting problem; some functions that do not diverge will be marked diverging).

As I think about it (and I’m not a programming language theorist, nor have I done much serious work in any language with any sort of effect system), there are two vague categories of effect: control-flow effects like exceptions, yields, async waits (Pending, sleep, or however you feel like modeling it) and non-control-flow effects (divergence, various forms of unsafety, nondeterminism, impurity, reads or writes of global state, syscalls in models that don’t treat IO in and of itself as an effect), etc.

I would like to be able to run and write code that is definitely free of certain kinds of effects. Xz should not be unsafe or do IO, for example. Leftpad is an entirely pure, non-diverging function. And I should be able to ask my language to enforce that, ideally with trivial code. Maybe even by default.

But mainstream languages seem to mostly limit their use of effect-like systems on the control flow part, like this:

> Overall, coroutines strike me as the most promising way to handle many kinds of effectful functions because they seem to be in the design sweet spot: They are statically typed, lexically scoped, and unlayered.

jbjohns · 2 years ago
> Leftpad is an entirely pure, non-diverging function. And I should be able to ask my language to enforce that, ideally with trivial code. Maybe even by default.

I think you can do this in Idris with "total" functions.

u/jbjohns

KarmaCake day421December 13, 2008View Original