Interesting. I guess it matters which part of the language you look at. Thanks for the reply. Good points, except for the closures bit -- inner classes (which didn't come about until around Java 1.1) don't really compare to closures.
Seems like if he really wanted to bring Smalltalk to C++ folks, he really should have found a way to popularize Objective C though. Especially since Sun was a part of OpenSTEP, which included what's probably the best GUI framework around to this day. It sure beats AWT and Swing. I suppose the mixed syntax of Objective C is a problem for folks not familiar with Smalltalk.
I still think Java has the Ada "feel" to it. It feels "big", with its large library, and has a syntax that's overly verbose in some places. I can't think of anything in Java that reminds me of Eiffel though. (Could be because I never used Eiffel; I only read the book.)
I'm sure this guy has some valid ideas. But the obvious sign that he can't see the forrest for the trees is that he really thinks such medical technology will be available to everyone on the planet. That's so ridiculous. AIDS is now more or less treatable, and yet millions in Africa are dying of it every year. Everything has a cost, and most of the people in the world can't afford much.
Nitrous oxide as a by-product? Sweet! Not only can that be used to improve the performance (power) of gasoline engines, but it can give you a good buzz. Unfortunately, it's also a greenhouse gas -- which means it wouldn't be an improvement over the current situation.
I had an old Dell notebook that overheated (enough to stop PCMCIA cards from working). I found it odd that the fans never really ran much. I found a BIOS update that lowered the temparature thresholds of when to start and stop the CPU fans. That helped a bit. Then I found a program called i8kfan that allowed me to choose the temperatures at which to turn the fans on, or to force them on. This helped a lot -- I never had problems again except for when I wasn't running i8kfan. The program works on most Dell laptops. I've seen similar programs for other vendors. There's also an i8kfan driver available for Linux, and I think Linux' APM and/or ACPI drivers have some generic fan controls that work for some notebooks.
The Libet link was quite interesting. I also took a look at the Wikipedia article. But the conclusion seems to not be the simplest explanation. The simplest explanation would seem to be that our consciousness is not immediately self-aware of the decisions that it is making.
Perhaps you meant that the 1-time license fee costs more than your monthly mortgage payment. That's a serious case of comparing a bushel of apples to bag of oranges.
And their pricing model allows you to gain all the experience you want in using their software, as long as you're not building a commerical product. Heck, I usually build a separate throw-away program when I'm learning a new framework anyway.
I'm using Rails for a project I've been working on for a month. It's better than anything I've used, but I can still see some room for improvement.
I've seen mention of a few alternatives that look quite interesting. In particular, TurboGears and Django for the Python crowd, and Nitro as another Ruby platform. Others exist for other languages. (I don't know if anyone has exactly defined what makes a system Rails-like; it seems to be one of those things that you can identify without being able to easily describe.)
I'd prefer to use Python, just on language preference, and a potentially larger selection of libraries to use on the back end. But I'm wondering if Ruby has some features that Python doesn't that allow a lot of the magic to happen behind the scenes without having to add code.
I'm also very interested in anyone's experience with Nitro+Og. Og looks like a lot better ORM framework than ActiveRecord.
I'm tempted to try using TurboGears or Nitro, because they look better from a technical perspective. But Rails has so much momentum that I'm not sure they'd be able to surpass Rails' community support, which is in many ways more important.
The Pragmatic Programmers Rails book covers securing an app quite well. They take an unsecure app, and apply authentication and authorization to it. It's a pretty simple process.
As others have pointed out, Bruce Perens is working on a module to add security at the model level. The standard method is to apply security at the controller level, but applying it lower in the stack helps prevent mistakes from letting data leak out. I'm not sure if it will completely bubble-up to the controller layer though, or if you'll have to duplicate some logic up at that level.
Seeing as how the information is already in the users' browsers, the cat is out of the bag. There's no technological way to completely protect the information from being spread around. But if you just want to make sure that other AJAX scripts don't grab your data, the Referer field should be able to restrict 95% of those cases. And if they do work around it, it's clear that they intentionally were using your content in ways you did not intend to allow. For the other 5% of cases where you REALLY want to keep people out, use the session token, like I mentioned. But thinking you're going to "secure" your content from being used anywhere else is ridiculous.
Widespread popularity is a very important distinction. While the automobile was invented in the late 1800s, everyone thinks of the automobile as a product of the early 1900s. I think "product of" is actually more important than when it was originally invented.
Also, a good name for something can have a serious impact on its popularity. (For one, it makes it easier to communicate about it.) And a good name in this case is more about having a clear (and hopefully easily-expressed) meaning, much more than the name having a good relationship to the meaning. A catchy, easy to remember name is also a plus.
Agreed. Squirrelmail really isn't cutting it for my needs any more. But even more than that, I really need server-side rules to sort my messages into folders for me. The only web-based app I've seen that does that is Horde's Ingo, which works with Sieve.
First of all, I don't see much security-related content on that site. Second, the issues that are raised all seem to be issues in non-AJAX web development as well.
For example, in AJAX Considered Harmful, using HTTP GETs to change state is a well-known no-no. (Google Accelerator recently broke some sites that violate this principle, but it's been known since at least HTTP 1.0 times that infrastructure would break sites that were coded incorrectly.) But XMLHttpRequest supports POSTs (and PUT, and probably all the rest). It also supports HTTPS.
As far as stealing content, that can be addressed (well enough for 95% of cases) by checking the Referer field. (I think that should work -- I wasn't able to find any documentation whether the browsers add/override that header when submitting XMLHttpRequests, like they should.) Although the random session token he suggests is a pretty good solution as well.
Well, seeing as how Microsoft invented ("innovated"?) XMLHttpRequest specifically for Outlook Web Access, I'd have to say it should be first on your list.
Javascript is an accepted WWW standard. There is no reason for any app developer to not use javascript to his heart's content.
That's ridiculous. JavaScript may be a standard, but that doesn't mean that you should expect every user's browser to support it. How about blind people using screen-reader? How about search engines? Don't you want them to be able to read your page? (Well, perhaps not if it's personal email sitting behind a login screen.)
And may I remind you that the whole basis of AJAX - XMLHttpRequest - is NOT a standard. Don't you want your site to work on all the new cell phones coming out that a lot of people will soon be using to browse the web and read email? How about hand-held devices?
Gracefully degrading is a best practice for a lot of good reasons. And frankly, it's not that difficult, if you apply the principles of unobtrusive JavaScript.
I agree with you, except for the "how does it feel" part. I think they're asking how it feels to be somewhat isolated (more than usual) in among all the white folk. Or whether they're being treated with respect or not. For example, when I go to a party and I'm the only white person there, it's perfectly fine for people to refer to me as "the white guy" and ask how it feels to be the only white person there. I guess it all depends on how it's phrased.
BTW, white people should make an attempt every once in a while to be the only white person in a group of black people, just to see how it feels. White people tend to think it's very uncomfortable. Many black people face that kind of situation every day of their lives.
OK. I'm going to attempt to figure out the logic in this method.
Let's say we have a population of 2x mosquitos, x males, and x females. Let's collect 2y mosquitos. Half of those will be male, and half female.
If we kill all of the mosquitos we collect, you end up with 2x-2y mosquitos left in the population.
Now, instead of killing all the mosquitos we collected, let's use the proposed method of killing all y females, and releasing y sterile males. The population of mosquitos is now 2x-y, which is worse than if we had just killed them all.
But let's see what we get in the next generation. Let's assume that the mosquito population is steady across generations. (That seems like a fair assumption -- it's unlikely to be increasing too much, since we killed y females.) So we can therefore assume that each mating pair would produce 2 surviving offspring. Let's also assume monogamous pairings (which could just be the result of death soon after mating). So each male can mate only once, and only x-y males will be potent, so the next generation's population would be 2(x-y) = 2x-2y mosquitos. Hmm. So either this way is no more effective than killing all that you collect, or I've made an invalid assumption about mating pair's monogamy or the steady (non-increasing) population.
Can anyone verify which assumption I made was incorrect? Or did I miss something else? Perhaps the sterile males are more likely to survive than the wild males (since they were well-treated in the lab)?
Maybe it's just late, but that's one of the funniest things I've seen all week. I wish I had some moderator points. I think it's funny because it pretty much mirrors what I was thinking. I can't quite make out the logic that says that sterile dads will kill off more offspring than having no moms and no dads.
If we can barely see things the size of Pluto in our own solar system, what makes us think we should see any of what's at the outskirts of the galaxy (besides bright stars)? So if the data shows that there's probably a lot of stuff out there, wouldn't the simplest explanation be that there's a lot of ordinary matter floating around in "empty" space? Especially given that there's quite a lot of junk floating around in our solar system, even after the sun's gravity has "cleared out" probably a substantial portion of what used to be here.
I think the thing about dark matter that most of us don't understand is why scientists think that it's got to be made up of either large pieces or exotic new components. I mean, look at the make-up of the Kuiper belt and the Oort cloud -- just lots of small(ish) pieces of rock. And it seems like the whole "dark matter" conjecture is just the result of an incorrect assumption regarding how much matter is in "empty space". Maybe those 2 things are saying the same thing, but the way that dark matter is presented makes it seem like something new.
Yes. The whole idea of dark matter was a kludge to explain why they weren't seeing what they expected. I always figured that they were interpretting things incorrectly, or measuring incorrectly. For one thing, it's mainly based on how much ordinary matter we expect in "empty space", or the space between stars. Recent discoveries suggest that there may be a lot more matter in the Oort cloud than we originally thought. (Although still pretty small, compared to the sun -- but I think we're still under-estimating by far.) This cloud around our solar system extends a good light-year out.
I still don't think it quite follows. I'd agree with you if you said that "expensive things" have a value to the customer. But that doesn't mean that things with excessive mark-ups have a value to the customer. For one, your own statements contradict that idea. "I have nicer things than you" does not apply if we both get the same thing, but you paid a lot more than I did. And you will not "die with the most toys" if you spend more on the same toys than I do.
Slashdot Mirror
Interesting. I guess it matters which part of the language you look at. Thanks for the reply. Good points, except for the closures bit -- inner classes (which didn't come about until around Java 1.1) don't really compare to closures.
Seems like if he really wanted to bring Smalltalk to C++ folks, he really should have found a way to popularize Objective C though. Especially since Sun was a part of OpenSTEP, which included what's probably the best GUI framework around to this day. It sure beats AWT and Swing. I suppose the mixed syntax of Objective C is a problem for folks not familiar with Smalltalk.
I still think Java has the Ada "feel" to it. It feels "big", with its large library, and has a syntax that's overly verbose in some places. I can't think of anything in Java that reminds me of Eiffel though. (Could be because I never used Eiffel; I only read the book.)
Actually, I'd say Java has a lot more in common with Ada than it does with Smalltalk. Especially the way packages and threads work.
I'm sure this guy has some valid ideas. But the obvious sign that he can't see the forrest for the trees is that he really thinks such medical technology will be available to everyone on the planet. That's so ridiculous. AIDS is now more or less treatable, and yet millions in Africa are dying of it every year. Everything has a cost, and most of the people in the world can't afford much.
Nitrous oxide as a by-product? Sweet! Not only can that be used to improve the performance (power) of gasoline engines, but it can give you a good buzz. Unfortunately, it's also a greenhouse gas -- which means it wouldn't be an improvement over the current situation.
I had an old Dell notebook that overheated (enough to stop PCMCIA cards from working). I found it odd that the fans never really ran much. I found a BIOS update that lowered the temparature thresholds of when to start and stop the CPU fans. That helped a bit. Then I found a program called i8kfan that allowed me to choose the temperatures at which to turn the fans on, or to force them on. This helped a lot -- I never had problems again except for when I wasn't running i8kfan. The program works on most Dell laptops. I've seen similar programs for other vendors. There's also an i8kfan driver available for Linux, and I think Linux' APM and/or ACPI drivers have some generic fan controls that work for some notebooks.
The Libet link was quite interesting. I also took a look at the Wikipedia article. But the conclusion seems to not be the simplest explanation. The simplest explanation would seem to be that our consciousness is not immediately self-aware of the decisions that it is making.
Your house cost less than $1800?
Perhaps you meant that the 1-time license fee costs more than your monthly mortgage payment. That's a serious case of comparing a bushel of apples to bag of oranges.
And their pricing model allows you to gain all the experience you want in using their software, as long as you're not building a commerical product. Heck, I usually build a separate throw-away program when I'm learning a new framework anyway.
I'm using Rails for a project I've been working on for a month. It's better than anything I've used, but I can still see some room for improvement.
I've seen mention of a few alternatives that look quite interesting. In particular, TurboGears and Django for the Python crowd, and Nitro as another Ruby platform. Others exist for other languages. (I don't know if anyone has exactly defined what makes a system Rails-like; it seems to be one of those things that you can identify without being able to easily describe.)
I'd prefer to use Python, just on language preference, and a potentially larger selection of libraries to use on the back end. But I'm wondering if Ruby has some features that Python doesn't that allow a lot of the magic to happen behind the scenes without having to add code.
I'm also very interested in anyone's experience with Nitro+Og. Og looks like a lot better ORM framework than ActiveRecord.
I'm tempted to try using TurboGears or Nitro, because they look better from a technical perspective. But Rails has so much momentum that I'm not sure they'd be able to surpass Rails' community support, which is in many ways more important.
The Pragmatic Programmers Rails book covers securing an app quite well. They take an unsecure app, and apply authentication and authorization to it. It's a pretty simple process.
As others have pointed out, Bruce Perens is working on a module to add security at the model level. The standard method is to apply security at the controller level, but applying it lower in the stack helps prevent mistakes from letting data leak out. I'm not sure if it will completely bubble-up to the controller layer though, or if you'll have to duplicate some logic up at that level.
Seeing as how the information is already in the users' browsers, the cat is out of the bag. There's no technological way to completely protect the information from being spread around. But if you just want to make sure that other AJAX scripts don't grab your data, the Referer field should be able to restrict 95% of those cases. And if they do work around it, it's clear that they intentionally were using your content in ways you did not intend to allow. For the other 5% of cases where you REALLY want to keep people out, use the session token, like I mentioned. But thinking you're going to "secure" your content from being used anywhere else is ridiculous.
Ha. That also makes my point, I suppose. Thanks for becoming my Fan.
Widespread popularity is a very important distinction. While the automobile was invented in the late 1800s, everyone thinks of the automobile as a product of the early 1900s. I think "product of" is actually more important than when it was originally invented.
Also, a good name for something can have a serious impact on its popularity. (For one, it makes it easier to communicate about it.) And a good name in this case is more about having a clear (and hopefully easily-expressed) meaning, much more than the name having a good relationship to the meaning. A catchy, easy to remember name is also a plus.
Agreed. Squirrelmail really isn't cutting it for my needs any more. But even more than that, I really need server-side rules to sort my messages into folders for me. The only web-based app I've seen that does that is Horde's Ingo, which works with Sieve.
Just a quick clue for you -- XHTML is in fact XML.
First of all, I don't see much security-related content on that site. Second, the issues that are raised all seem to be issues in non-AJAX web development as well.
For example, in AJAX Considered Harmful, using HTTP GETs to change state is a well-known no-no. (Google Accelerator recently broke some sites that violate this principle, but it's been known since at least HTTP 1.0 times that infrastructure would break sites that were coded incorrectly.) But XMLHttpRequest supports POSTs (and PUT, and probably all the rest). It also supports HTTPS.
As far as stealing content, that can be addressed (well enough for 95% of cases) by checking the Referer field. (I think that should work -- I wasn't able to find any documentation whether the browsers add/override that header when submitting XMLHttpRequests, like they should.) Although the random session token he suggests is a pretty good solution as well.
Well, seeing as how Microsoft invented ("innovated"?) XMLHttpRequest specifically for Outlook Web Access, I'd have to say it should be first on your list.
That's ridiculous. JavaScript may be a standard, but that doesn't mean that you should expect every user's browser to support it. How about blind people using screen-reader? How about search engines? Don't you want them to be able to read your page? (Well, perhaps not if it's personal email sitting behind a login screen.)
And may I remind you that the whole basis of AJAX - XMLHttpRequest - is NOT a standard. Don't you want your site to work on all the new cell phones coming out that a lot of people will soon be using to browse the web and read email? How about hand-held devices?
Gracefully degrading is a best practice for a lot of good reasons. And frankly, it's not that difficult, if you apply the principles of unobtrusive JavaScript.
I agree with you, except for the "how does it feel" part. I think they're asking how it feels to be somewhat isolated (more than usual) in among all the white folk. Or whether they're being treated with respect or not. For example, when I go to a party and I'm the only white person there, it's perfectly fine for people to refer to me as "the white guy" and ask how it feels to be the only white person there. I guess it all depends on how it's phrased.
BTW, white people should make an attempt every once in a while to be the only white person in a group of black people, just to see how it feels. White people tend to think it's very uncomfortable. Many black people face that kind of situation every day of their lives.
OK. I'm going to attempt to figure out the logic in this method.
Let's say we have a population of 2x mosquitos, x males, and x females. Let's collect 2y mosquitos. Half of those will be male, and half female.
If we kill all of the mosquitos we collect, you end up with 2x-2y mosquitos left in the population.
Now, instead of killing all the mosquitos we collected, let's use the proposed method of killing all y females, and releasing y sterile males. The population of mosquitos is now 2x-y, which is worse than if we had just killed them all.
But let's see what we get in the next generation. Let's assume that the mosquito population is steady across generations. (That seems like a fair assumption -- it's unlikely to be increasing too much, since we killed y females.) So we can therefore assume that each mating pair would produce 2 surviving offspring. Let's also assume monogamous pairings (which could just be the result of death soon after mating). So each male can mate only once, and only x-y males will be potent, so the next generation's population would be 2(x-y) = 2x-2y mosquitos. Hmm. So either this way is no more effective than killing all that you collect, or I've made an invalid assumption about mating pair's monogamy or the steady (non-increasing) population.
Can anyone verify which assumption I made was incorrect? Or did I miss something else? Perhaps the sterile males are more likely to survive than the wild males (since they were well-treated in the lab)?
Maybe it's just late, but that's one of the funniest things I've seen all week. I wish I had some moderator points. I think it's funny because it pretty much mirrors what I was thinking. I can't quite make out the logic that says that sterile dads will kill off more offspring than having no moms and no dads.
If we can barely see things the size of Pluto in our own solar system, what makes us think we should see any of what's at the outskirts of the galaxy (besides bright stars)? So if the data shows that there's probably a lot of stuff out there, wouldn't the simplest explanation be that there's a lot of ordinary matter floating around in "empty" space? Especially given that there's quite a lot of junk floating around in our solar system, even after the sun's gravity has "cleared out" probably a substantial portion of what used to be here.
I think the thing about dark matter that most of us don't understand is why scientists think that it's got to be made up of either large pieces or exotic new components. I mean, look at the make-up of the Kuiper belt and the Oort cloud -- just lots of small(ish) pieces of rock. And it seems like the whole "dark matter" conjecture is just the result of an incorrect assumption regarding how much matter is in "empty space". Maybe those 2 things are saying the same thing, but the way that dark matter is presented makes it seem like something new.
Yes. The whole idea of dark matter was a kludge to explain why they weren't seeing what they expected. I always figured that they were interpretting things incorrectly, or measuring incorrectly. For one thing, it's mainly based on how much ordinary matter we expect in "empty space", or the space between stars. Recent discoveries suggest that there may be a lot more matter in the Oort cloud than we originally thought. (Although still pretty small, compared to the sun -- but I think we're still under-estimating by far.) This cloud around our solar system extends a good light-year out.
I suppose I can agree with you on that point, at least.
I still don't think it quite follows. I'd agree with you if you said that "expensive things" have a value to the customer. But that doesn't mean that things with excessive mark-ups have a value to the customer. For one, your own statements contradict that idea. "I have nicer things than you" does not apply if we both get the same thing, but you paid a lot more than I did. And you will not "die with the most toys" if you spend more on the same toys than I do.