Unlimited Novelty

Another "great" interview question like the creme brulee story http://www.unlimitednovelty.com/2011/12/can-you-solve-this-problem-for…

>> Spamming the input with an array of whatever OpenSSL algorithms Ruby happens to make available, rather than using a memory hard KDF like scrypt, is a bad smell. Sooner or later key-derivation schemes gets outdated and requires a better version as happened to bcrypt [1] and will happen to scrypt [2]. It is not "whatever OpenSSL provides" but just combining strong algorithms over to spread the "getting outdated" risks. Think like you are investing your money? Would you prefer betting on just one thing or spreading it over various different investment opportunities? [1] http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html [2] http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html

First entry on the svbtle network sure. I've blogged extensively here before http://unlimitednovelty.com And while it shouldn't be news to anyone using crypto, I still feel like it's a poorly-known subject.

I think the sweet spot for this kind of thing is when doing websockets. For a "normal" site, Rails is fine; it does a ton out of the box, and I like the language more than Javascript. However, the websocket story with Rails is not as clear as with something like Node, Erlang, or Go. This is worth repeating: http://www.unlimitednovelty.com/2012/08/debunking-nodejs-gish-gallop.h…

Somebody please correct me if I'm wrong, as I'm still reading the readme and the code, but I think Elixir is closer to Erlang (the language) intents, being immutable and 'more functional'. Reia has some object-orientation built in, with stateful objects and "types" that mix data and code. Here's a very good blog post by Reia's author talking about the 'non-Erlang' things in Reia: http://www.unlimitednovelty.com/2009/03/is-reia-object-oriented-langua… I personally think that they're both amazing from what I've been seeing. I gotta dive-in more and do some tests, but it will be a joy to see Erlang getting more adopters. :D

> The argument for evented concurrency assumes threads work. Async design isn't a reaction to MRI's crappy green threads. Truly? To my understanding, event loops require inversion of control (and likely callbacks and broken exception handling). This is a large cost that requires a benefit to be worth it. I understand that benefit to be: you don't have to deal with threads (or bad implementations of such). This blog post comes to mind: http://www.unlimitednovelty.com/2010/08/multithreaded-rails-is-general…

I write it fully acknowledging that programming language flamewars are pointless, but this article just shows that you don't even have to try hard to create a biased comparison. Here's the essential difference between Go and Erlang: Go gets most of the things right, Erlang gets way too much wrong. So what does Go gets right but Erlang doesn't: * Go is fast. Erlang isn't * Go has a non-surprising, mainstream syntax. You can pick it up in hours. Erlang - not so much. * Go has a great, consistent, modern, bug-free standard library. Erlang - not so much. * Go is good at strings. Erlang - not so much. * Go has the obvious data structures: structs and hash tables. Erlang - no. * Go is a general purpose language. Erlang was designed for a specific notion of fault tolerance - one that isn't actually needed or useful for 90% of the software but every program has to pay the costs * Go has shared memory. Yes, that's a feature. It allows things to go fast. Purity of not sharing state between threads sounds good in theory until you need concurrency and get bitten by the cost of awkwardness of having to copy values between concurrent processes So sure, if you ignore all the major faults of Erlang (http://damienkatz.net/2008/03/what_sucks_abou.html, http://www.unlimitednovelty.com/2011/07/trouble-with-erlang-or-erlang-… http://ferd.ca/an-open-letter-to-the-erlang-beginner-or-onlooker.html, http://sacharya.com/tag/erlang-sucks/) it compares very favorably to Go. You…

One of the reply tweets linked an allegorical article about the pitfalls of whiteboard interviewing that I enjoyed quite a bit: http://www.unlimitednovelty.com/2011/12/can-you-solve-this-problem-for…

A pair of good articles on just this kind of thing: http://www.unlimitednovelty.com/2011/12/can-you-solve-this-problem-for… http://sockpuppet.org/blog/2015/03/06/the-hiring-post/

I don't know if it's the lack of types Ruby is a dynamic language, so no, there are no types as such. There are ways to create types, but if you're doing that a lot, you're probably doing Ruby wrong. It's not meant to have types. Different way of thinking. the abysmal performance of the default VM That's a myth, a pervasive one. I'll point you to one source that debunks this, but there are many. http://www.unlimitednovelty.com/2012/06/ruby-is-faster-than-python-php… the heavy reliance on monkey patching Monkey patching is generally considered an anti-pattern. I'm not sure what in particular has "heavy reliance" on it, but it's not Ruby's libraries themselves, and it's not Rails. (Metaprogramming is not the same thing as monkey patching.) Ruby is not aging very well. IMHO Ruby is just now coming fully into its own, and is, for a young language, just reaching maturity.

Someone else explicitly says "Don't use bcrypt" [1] [1] http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html

LinkedIn, that's not how to hash passwords. http://codahale.com/how-to-safely-store-a-password/, or for the more advanced http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html.

I wonder if this inspired DRb[1]. It sounds very similar. The biggest problem is that it's synchronous even across machine boundaries. Celluloid and Dcell[2] are the same basic idea but more explicit. [1]: http://segment7.net/projects/ruby/drb/introduction.html [2]: http://www.unlimitednovelty.com/2011/05/introducing-celluloid-concurre…

Interestingly enough, this long-time Erlang developer is contemplating switching to Clojure for a variety of reasons. ('Erlang is a ghetto') http://www.unlimitednovelty.com/2011/07/trouble-with-erlang-or-erlang-…

First, links for context. Guido's take: http://www.artima.com/weblogs/viewpost.jsp?thread=147358 Arcieri's take: http://www.unlimitednovelty.com/2009/03/indentation-sensitivity-post-m… It's not hard if we disallow statements, and make everything into an expression that returns a value -- something that Ruby does right. The value of a block of statements is just the value of the last statement in the block. So, whether you call it a function, or a method, or a lambda, or a block, whitespace with multi-line expressions can be made to work. The commonly-cited lambda-with-multiple-prints example, in CoffeeScript: count: -> print 'one' print 'two' print 'three'

It can be educating to look at the history of Reia (Python/Ruby-like language for Erlang VM). At first its author tried to hard to make Reia indentation sensitive (like Python). Finally he reconsidered after discovering several limitiations: http://www.unlimitednovelty.com/2009/03/indentation-sensitivity-post-m…

Erlang's VM is unmatched scaling above 16+ cores (for example process migration http://unlimitednovelty.com/2009/01/cutting-edge-of-vm-design.html ) this is something that the java vm hasn't even begun to look at.

You know, you HN guys are super buzzword and design blind. This company slaps "bcrypt", "SSL", and "open source" on a decently designed bootstrap page and the response is "this will totally work!" Sad. For example, this statement "Credentials are stored as salted hashes using bcrypt," means passwords are being passed to this provider, so you better trust them to not be snooping passwords all the time. Also, bcrypt is questionable http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html Finally, it looks like your server is talking to them via SSL through a library https://github.com/hstove/omniauth-dailycred#ssl-error. If that's the case then when you try to do this with some SSL clients they don't validate the cert. Take Python's, where you have to do a backport http://pypi.python.org/pypi/backports.ssl_match_hostname/ to get that enabled. I found these problems in just scanning through some links off that first page. Seems like this crowd would be able to pull up more, and definitely shouldn't just saying "Oh SSL, well then that whole thing is totally solid."

Agreed. I wrote this blog post: http://paulbjensen.co.uk/posts/2012/07/11/thoughts-on-rails-node-and-t… Then Tony Arcieri wrote this rebuttal: http://www.unlimitednovelty.com/2012/08/debunking-nodejs-gish-gallop.h… He made some good points in his post, but the snarkiness was in my opinion a bit uncalled for. Being labelled a Rails Enthusiast when I had worked with Rails for over 4 years (2007-2011), 2 of those at New Bamboo (a big Rails agency in the UK) was cheap. I then tried to deduce why he was so rude, so I looked through some of his older blog posts, and found this: http://www.unlimitednovelty.com/2012/03/why-critics-of-rails-have-it-a… but then this tweet summed it all up: http://twitter.com/bascule/status/274281490437767168 The issue I see here is that there are some in the Ruby community who hate Node, but who then extend that hatred of Node to being rude to people involved with Node.js. Tony has been rude in the past to both Substack and Isaac Schlueter (major figures in the Node community) over Twitter. I can only reason that the rudeness towards Substack was because he made this comment on his blog post: http://www.unlimitednovelty.com/2012/08/debunking-nodejs-gish-gallop.h… As for his replies with Isaac, see this: http://twitter.com/bascule/status/281932459719921664 I'd like to say it stops there, but it doesn't. I actually had someone email me because Tony had been…