citizen428.blog()

Try to learn something about everything

Information Overload 2012-07-08

Shenanigans

About 1.5 month ago I finally packaged some of my Ruby extension methods into the aptly named Shenanigans gem. It’s similar to Facets or ActiveSupport, but probably less useful to most people. Also some of the methods actually are in Facets, although sometimes with different names or slightly different semantics. Anyway, since some people told me they actually do like the gem, here’s a quick summary of what the different methods do and how they can be useful.

  • Array#^: Ruby defines Set#^, which returns the elements exclusive between the set and a given enum. Since a lot of people use arrays instead of proper sets in Ruby, I found it makes a nice addition to Array#| and Array#&.

  • Array#random_subarray: Generates one or more random subarrays of an array, using the fact that Ruby can index integers to get the bit values to ensure fast uniform distributions. Similar to Array#sample, but can generate several subarrays at once.

  • Array#zip_with: The more general form of zip (e.g. in Haskell you could define zip = zipWith (,)). Like Ruby’s Enumerable#inject it can take a symbol argument or a block, and like Haskell’s zip it discards excess array elements if one list is shorter than the other, whereas Ruby’s Array#zip only does that if the receiver is shorter than the argument (it adds nils in the other case).

  • Hash#has_shape?: A quick way to check if a hash’s keys are of certain classes. This does feel a bit strange in a duck-typed language like Ruby, but someone asked for it on StackOverflow and it was easy enough to write. This could be useful in validations or unit tests though.

  • Hash#to_ostruct: I really like the rails_config gem. I therefore decided to write something that gives me similar functionality (although a lot simpler) for plain Ruby projects. Basically this recursively converts a hash and all nested hashes into OpenStruct instances. Populate the hash with Ruby’s YAML support and you have an instant settings object.

  • Kernel#fn: I admit, this was more of a “because I can” method. Originally I wrote this so I could compose blocks in pointfree style, but later added support for Proc instances too.

  • Kernel#prompt: While it’s great that Ruby’s IO#gets is so general, I always wanted something like Python’s raw_input for command line apps. Additionally you can also automatically call any of the numeric conversions, and I’m pondering adding support for every unary string method.

  • Kernel#with: I think Object#tap is great. However, I sometimes see it used as a replacement for Enumerable#inject or Enumerable#each_with_object, but for some reason I never really liked the semantics of it. And since I’m anal about that sort of thing I added this Pascal/ActionScript like with statement.

  • Object#display: Having no proper object-oriented way to print objects in Ruby always kinda bothered me, so I abused Object#tap as a wrapper around Kernel#puts and Kernel#print. Additionally this is aliased to the name d, which I stole from irbtools. The latter form makes it great for debugging method chains and the likes.

  • Object#it: I always disliked blocks of the form { |x| x } that sometimes crop up when using Enumerable#group_by or similar methods. Since Ruby lacks an identity method and id has historically been taken, I decided to name it it.

Information Overload 2012-07-01

It’s one thing to talk about tailoring content, in news or non-fiction, for ratings or traffic. It’s another to see the structures that governs profit-making online silence a discussion altogether. Ad servers who are literally providing a financial disincentive to discuss rape and sexual assault should be ashamed.

Information Overload 2012-06-24

It was like finding out your husband didn’t just cheat, but had a frequent-flier account with every brothel in North America for the past 10 years.

Review: The Tangled Web

Disclaimer 1: The good folks of No Starch Press were kind enough to provide me with a review copy of this book, but this did not influence the following text.

Disclaimer 2: Links to books are Amazon affiliate links.

I’ve been interested in IT security for a long time, but obviously even more so since I started working professionally in this area. Since web applications have become ubiquitous in recent years, they constitute a big part of our penetration testing work. This is a very broad topic, so The Tangled Web: A Guide to Securing Modern Web Applications by Michal Zalewski is an ambitious project.

The first thing I noticed was that the book is comparatively thin. At around 300 pages it’s only about one third of The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws. Don’t let that fool you though, this book is not a lightweight by any means. It’s logically structured in three parts, the first of which explores the various components that constitute the web as we know it today (URLs, HTTP, HTML, CSS etc.) and their security implications. This is followed by a look at the security features — and their shortcomings — of current browsers. After this part 3 deals with current developments and the future of browser and web application security. This is rounded off by a list of common security problems including references to the chapters of the book that cover them, as well as an epilogue with a surprisingly philosophical outlook on IT security and trust in human societies.

The writing was clear and to the point, with tons of footnotes and references to provide the interested reader with the chance to further research the presented topics. The author clearly knows what he’s talking about and manages to present it in a very approachable way. Due to it’s limited size the book still has to be a bit dense though, so I never really felt like reading more than one chapter at a time, otherwise it’d have been to much information to take in at once.

Whether you work in IT security or are a web application developer, this definitely is a book you don’t want to miss.

Information Overload 2012-06-17

[H]e worries that economic and ecological collapse will come much sooner than we think, and that the time to start behaving in an anarchic way—taking care of ourselves instead of deferring to government and big business—is now. He wants, in his words, for people to have a “soft landing” when the global shit hits the global fan.

Rails — Display Branch in Development Mode

At work we are building a Rails app that’s supposed to run on appliances instead of being hosted by us. To make it easier to deal with bug reports and feature requests, we always display the version number in the footer. A couple of days ago I thought it’d be handy to replace this with the current branch in development mode. Using Grit the solution couldn’t have been any simpler:

app/helpers/application_helper.rb 
1
2
3
4

def version_div
  version = Rails.env.development? ? ::Grit::Repo.new(Rails.root).head.name : ::OurApp::Application::Version
  content_tag(:div, content_tag(:span, version), :class => "version")
end

Call version_div in a view and you are good to go. If dragging in another dev dependency for just one call bothers you, you can also shell out to get the current branch: git rev-parse --abbrev-ref HEAD.

Information Overload 2012-06-10

[S]omeone who takes MDPV may find himself feeling extremely paranoid and panicky, but he’s unlikely to believe that a giant lizard wearing a tuxedo is about to eat his cat.

Review of Black Hat by Obi-Wan Kenobi: “You will never find a more wretched hive of scum and villainy.”

Information Overload 2012-05-25

Due to a trip this week’s Information Overload is a bit earlier and shorter than usual. There won’t be a new issue next week by the way.

You should never want to be average — unless you are below average. This is a cry for normalcy, when so many others wish to be abnormal.

Information Overload 2012-05-20