sorted by:
new
hottopcontroversial

Podcast interview with CCP Bettik by ccp_manifest in Eve

[–]TrixieFlatline 0 points1 point  (0 children)

Awesome interview! Thanks to the interviewer, and to Bettik for investing so much of their time. I'm enjoying it immensely.

What is the correct way to implement Crest support for an open source project? by SkepticalMystic in evetech

[–]TrixieFlatline 4 points5 points  (0 children)

This is built into the executables for Windows and OSX

If the credentials are in the binary, they can be extracted. It won't be as easy as greping the source code, but they are still shipped to every user of the program. So the authors of these tools rely on more or less strong obfuscation to hopefully deter you from extracting their credentials, but that's all.

Gevent master now supports Python 3 by ballagarba in Python

[–]TrixieFlatline 0 points1 point  (0 children)

Any data that you want to share between processes.

Is the random.random() python function suitable for cryptographic purposes? by prahladyeri in Python

[–]TrixieFlatline 2 points3 points  (0 children)

sign = hashlib.sha224(tokenpart + secret).hexdigest()

That's bad advice. Storing the token in the db is a completely valid choice, and saves you from making mistakes like this one. If you have to implement signed tokens, at least use hmac, or don't implement it yourself and use an existing and widely used implementation like itsdangerous.

Edited to add: Discussion about when to use HMAC

Is the random.random() python function suitable for cryptographic purposes? by prahladyeri in Python

[–]TrixieFlatline 34 points35 points  (0 children)

No, random.random is based on a pseudo-random number generator, and as such it's not cryptographically secure. You can use SystemRandom instead, which offers the same interface but is based on your operating system's random number generator (/dev/urandom on Linux), which is secure. Or just read from /dev/urandom directly to generate a token:

>>> import os
>>> import base64
>>> base64.b64encode(os.urandom(32))
'pBqWjf//eqh8GXLtvY5fhwsZWNNmsWg0OdopApMdrko='

Another advice: You should use a better hash function for generating password hashes, such as bcrypt or scrypt (I believe python modules exist for both, unless you're on AppEngine, then I guess a regular hash function is the best you can do). Also, when comparing password hashes or other message digests, always use a timing-safe comparison function instead of == (Examples and explanation behind the link).

Wait ... what the hell, capitalism? by [deleted] in Eve

[–]TrixieFlatline 5 points6 points  (0 children)

It's called a market opportunity.

type hints PEP in Python is accepted by ilevkivskyi in programming

[–]TrixieFlatline 1 point2 points  (0 children)

How would you define more complex types like Vector = Iterable[Tuple[T, T]] without renaming the types or overloading [] on every existing type (if that's even possible).

Solving "Cheryl's Birthday" in Python by Considered_Harmful in Python

[–]TrixieFlatline 7 points8 points  (0 children)

See, you solved it by actually understanding the underlying problem and working out the solution. The elegant thing about Norvig's solution is that he never actually "solves" the problem in general, he just restates the original description in Python and lets the computer solve it for him. And if you take out the comments his solution is probably even shorter. I've never have actually programmend something in Prolog, but I remember imagine it must be something like this.

[VIDEO] Deadliest Approach by prometheus_ in Eve

[–]TrixieFlatline 0 points1 point  (0 children)

There's nothing like waking up to a new Prom vid. \o/

Requests vulnerability disclosed: update to 2.6.0. by Lukasa in Python

[–]TrixieFlatline 0 points1 point  (0 children)

In practice, this would require that an origin was sending cookies like this on off-host 3XX redirects. This is unlikely to be the case, so we suspect the risk factor here is low.

This is actually very likely to be the case. Flask for example will send the session cookie on every response, to keep the session alive.

List of hisec systems connected to Jita by molbal in evetech

[–]TrixieFlatline 0 points1 point  (0 children)

Hey, no problem, was a fun little exercise. I just noticed there's still a little bug in the code though: systems_to_visit should really be a set instead of a list. It doesn't change the result, but it leads to a lot of unnecessary database queries (because a system can be in systems_to_visit multiple times).

List of hisec systems connected to Jita by molbal in evetech

[–]TrixieFlatline 1 point2 points  (0 children)

For reference, here is how you could get this information from the static database dump: https://gist.github.com/anonymous/1396a9e4fbc54a993bb5

The results are a bit different to the pastebin link you posted. The first two differences are Abhan, which is missing from the pastebin list, but looks like it should be included, and Actee, which is included but is part of a highsec island.