• 6:50 - 7:20 - Ryan Djurovich: Idiomatic Design Patterns in Go
• 7:20 - 7:50 - Vasko Zdravevski: Security in Go
• 7:20 - 7:50 - Peter P. Gengler: gRPC Queue
• 7:50 - 8:20 - Florin Pățan: Build a Go micro-service with net/http
• 8:20 - 8:35 - Saurabh Sethi: Fair Scheduling in Go
• 8:35 - 8:50 - Steven Bogacz: Go Serverless
> * Everyone who clones the git repo either forgets or doesn't know that they have to do 'git submodule init' (and maybe update too? even I'm forgetting ...)...
‘git clone --recursive’ Add that to your README’s getting started section. Sounds a bit like you aren’t providing a good onramp for contributors.
> * You cannot add downstream patches to Linux this way...
> * The link is to a non-fast-forward branch of Linux, so the commit hash sometimes becomes invalid... You'd think that because both the module and submodule are hosted on github, that github wouldn't garbage collect the old commit hash, but that's apparently not how it works.
Commits will not get GCed if you have a ref pointing at them. Relying on commits that do not have a ref means they are not part of the official history of that project. You should fork linux and have a branch where you land your custom changes. You can track whatever upstream you want, third party or mainline linux, and rebase your changes on top of them.
You don't get it. Emails were encrypted at rest with the user's password. This was publicly disclosed by lavabit on their site. With the SSL key material the state could decrypt the user's password from network traffic. The encrypted emails and SSL key material are obtained through the courts, SSL encrypted passwords via surveillance, bob's your uncle they can read a user's email. Lavabit wouldn't need to "build" anything and couldn't argue they didn't have the technical capability to turn over SSL keys and encrypted email data. This is why he shut down, so that user's wouldn't continue to submit their passwords over the wire using a compromised SSL key.
It is intended to be connected to a television set via Composite or HDMI. I'd assume most families in the UK already have a television set so really the only additional cost is the keyboard+mouse.
In order to exploit this an attacker would need to be MITM on the network or on a subdomain by setting a wildcard cookie. The site would still keep the nonce check. I don't see any way around this without poking a tiny hole in the CSRF protection. Guess you gotta weigh the cost/benefit.
Humm.. I'm thinking you could write a middleware that checks for Referer over https and if not set, go ahead and set it to https://yourdomain.com That would allow you to continue to use CSRF middleware for the nonce check (just make sure yours is before theirs).
If I'm blocking cookies/referer by default then the onus is upon me to enable them for sites that require them for stuff like this. I wouldn't worry about users who have this issue. Maybe customize django's CSRF failure page to say they need to enable both to use your service and call it a day.
Yeah this is something I run into often as I don't accept cookies from sites by default and don't send Referer header (both are required for django's CSRF middleware if over https). This is a good read if you are interested in the rational behind these decisions -> https://code.djangoproject.com/wiki/CsrfProtection
As far as a solution for your users, I'd just let them know that you require cookies to login (obviously) and if you are posting over https make sure they have the Referer header which can be forged to just be the domain and not the entire URL if they prefer. I use https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ set to forge for django sites.
So web2py introduces new members to __builtins__? Coming from a general Python programmer with no "vested interest" I have to say that isn't the best of ideas. len/dict/list are builtins because they are part of the language. They can be assumed to be present in any Python program. Teaching people that these web2py objects are available globally w/o importing them is setting a false expectation. This is pretty much monkey patching even if you aren't overriding stuff. Generally a no-no in the Python community.
I so LOL'd when someone in the webinar pointed out that their measurement wasn't a vector so their paper should be titled neutrino speed not velocity. http://arxiv.org/abs/1109.4897
