Managing database schema
I use clj-liquibase, https://github.com/kumarshantanu/clj-liquibase. It's a clojure wrapper for Liquibase. There is a function to load schema changes (changeset) from a file, along with many other functions to create changesets for your schema. -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en --- You received this message because you are subscribed to the Google Groups "Clojure" group. To unsubscribe from this group and stop receiving emails from it, send an email to clojure+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: Clojure Async/State Machine/Workflow Libraries?
> > but one would need option to stop the execution in some point of "go" > block, persist it, and continue it later. > Why would you need to stop execution? You could just have a chan, put what you need to persist on it, then then have different go block persist it. Main processing continues on happily. On Thursday, April 30, 2015 at 1:11:43 PM UTC-4, Vjeran Marcinko wrote: > > If you're looking for something similar to some BPM (BPMN, BPEL...) > engines in Clojure land, I *think* there is nothing similar here. I'm > actually researching that area occasionally, and thinking wishfully about > implementing one in Clojure someday. > > When core.async appeared first, since it also comes from "process area" of > IT (CSP, actors, process algebra...), I thought it would be sufficient for > that case also, but unfortunately it seems it has some strong differences > between BPM engines which are "session-based", meaning, each message that > is received over channel marked as 'session creator' spawns new async > process which is long, very long running (potentially years), and all > subsequent messages that have correlation value for that process are routed > to that session afterwards. > > Biggest similarity is that both approaches (BPM enginer and core.async) > invert control of execution, meaning, you write easy-to-grasp sequential > code which is executed asynchronously, but one would need option to stop > the execution in some point of "go" block, persist it, and continue it > later. In Java, Apache ODDE, which is BPEL engine, uses Pi-calculus engine > underneath, that uses continuations queue and is able to persist the > session on demand, and dehydrate it again when needed, even if that moment > comes a year later.. > > In other words, we need something like durable, restartable, GO blocks, > for each indivudual long-running session, and there can be hundreds of > thousands of them active in a system simultaneously (think about hundred k > of active purchase orders...). > > -Vjeran > > On Thursday, April 30, 2015 at 1:35:25 PM UTC+2, Tim Visher wrote: >> >> Hey All, >> >> Anyone have any tips on clojure 'workflow' libraries? >> https://github.com/relaynetwork/impresario is very close, but lacks some >> basic features like exception transitions, etc. >> >> Basically, I'm looking for a library that allows me to create a workflow >> that will happen asynchronously, recording it's progress in a db. I think i >> could probably whip something together without _too_ much trouble using >> core.async but this feels like something that's probably already been >> written. >> >> Thanks in advance! >> >> -- >> >> In Christ, >> >> Timmy V. >> >> http://blog.twonegatives.com/ >> http://five.sentenc.es/ -- Spend less time on mail >> > -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en --- You received this message because you are subscribed to the Google Groups "Clojure" group. To unsubscribe from this group and stop receiving emails from it, send an email to clojure+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: Newbie
I second, http://www.braveclojure.com. It's a great tutorial. I've switch from using Emacs as IDE to Cursive, an Intellij plugin. https://cursiveclojure.com On Thursday, April 30, 2015 at 4:03:47 PM UTC-4, Jeff Heon wrote: > > I quite like these two resources for total beginners. > > (Starts up assuming you know nothing about Lisp.) > aphyr.com/tags/Clojure-from-the-ground-up > > (Quite humorous) > http://www.braveclojure.com/ > > -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en --- You received this message because you are subscribed to the Google Groups "Clojure" group. To unsubscribe from this group and stop receiving emails from it, send an email to clojure+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [ANN] emacs-clojure-vagrant: a sane development virtual environment
Thanks Phil, I added a bit of context to the bug report and I am tracking it. brett On Tue, Jun 28, 2011 at 12:46 AM, Phil Hagelberg wrote: > Brett Morgan writes: > > > I just tried out your vagrant script, and it appears to be dying on an > > unmet dependency: > > > > [default] --2011-06-27 06:33:42-- > > https://github.com/downloads/icylisper/jark/jark-0.3 > > [default] 207.97.227.239 > > [default] > > [default] connected. > > [default] 404 Not Found > > [default] 2011-06-27 06:33:44 ERROR 404: Not Found. > > > > Any suggestions for working around this? > > I just opened an issue for this last night. For the time being it may be > best to just comment out the jark section of the script until it's fixed. > > https://github.com/icylisper/jark/issues/51 > > -Phil > > -- > You received this message because you are subscribed to the Google > Groups "Clojure" group. > To post to this group, send email to clojure@googlegroups.com > Note that posts from new members are moderated - please be patient with > your first post. > To unsubscribe from this group, send email to > clojure+unsubscr...@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/clojure?hl=en > -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en
Re: [ANN] emacs-clojure-vagrant: a sane development virtual environment
Hi Justin, I just tried out your vagrant script, and it appears to be dying on an unmet dependency: [default] --2011-06-27 06:33:42-- https://github.com/downloads/icylisper/jark/jark-0.3 [default] 207.97.227.239 [default] [default] connected. [default] 404 Not Found [default] 2011-06-27 06:33:44 ERROR 404: Not Found. Any suggestions for working around this? brett On Mon, Jun 27, 2011 at 2:50 PM, Justin Lilly wrote: > I've put together a simple development environment for those looking > for a stable place to work on clojure code. The idea was dual purpose: > a consistent environment for which to try out multiple code bases and > something that is familiar to me when working on a foreign operating > system. > > The included vagrant file will setup an Ubuntu 11.04 virtual machine > with clojure and clojure-contrib 1.2, emacs 24 (with emacs-starter-kit > 2 and all relevant clojure modes), tmux (similar to GNU screen), > Leiningen and Jark. > > Special thanks to Phil Hagelberg for his help getting things setup. > > Please check out the github project hosted by the Seajure user group > at https://github.com/Seajure/emacs-clojure-vagrant . Your forks and > contributions are appreciated. > > Thanks, > -justin > > -- > You received this message because you are subscribed to the Google > Groups "Clojure" group. > To post to this group, send email to clojure@googlegroups.com > Note that posts from new members are moderated - please be patient with > your first post. > To unsubscribe from this group, send email to > clojure+unsubscr...@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/clojure?hl=en -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en
Re: Clojure group in DFW area
I'd be interested as well. Thanks, Brett Bim On Apr 25, 11:29 am, Alex Robbins wrote: > That sounds good to me. > > On Mon, Apr 25, 2011 at 9:24 AM, ch...@rubedoinc.com > > > > > > > > wrote: > > I am interested as well and have office space in Addison near beltline > > and the tollway we can use. How about meeting next Monday may 2nd @ > > 630 pm? We can fo an organizational meeting about goals of the group, > > etc. > > > On Mar 10, 8:28 am, Alex Robbins > > wrote: > >> Anyone else in the north Dallas area using/interested in Clojure? I'd > >> love to get together. > > >> Alex > > > -- > > You received this message because you are subscribed to the Google > > Groups "Clojure" group. > > To post to this group, send email to clojure@googlegroups.com > > Note that posts from new members are moderated - please be patient with > > your first post. > > To unsubscribe from this group, send email to > > clojure+unsubscr...@googlegroups.com > > For more options, visit this group at > >http://groups.google.com/group/clojure?hl=en -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en
Re: Jesus, how the heck to do anything?
There is this genre of coming of age films that shows the hero getting beaten up by a bully, then a montage scene, then glorious victory. You are transitioning from the being beaten up by the bully scene to the montage scene. Time for lots of study =) On Wed, Mar 23, 2011 at 7:20 AM, ultranewb wrote: > On Mar 23, 9:10 pm, Aaron Cohen wrote: > > Did you search for getting started guides? If so and you didn't find > > these, how can they be made easier to find? If you didn't find them, > > why not? If you found them and they didn't help, why not? > > Yes, I had previously found all those guides, and much more > (screencasts, etc). They didn't help because they either showed you > how to get a REPL up and going, or they showed you how to download and > run something like NetBeans. In the first case, there is only so much > coding you can do in a REPL. In the latter case, fine - I have > NetBeans. NOW what do I do? > > -- > You received this message because you are subscribed to the Google > Groups "Clojure" group. > To post to this group, send email to clojure@googlegroups.com > Note that posts from new members are moderated - please be patient with > your first post. > To unsubscribe from this group, send email to > clojure+unsubscr...@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/clojure?hl=en > -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en
Re: Not quite getting for (newb question)
Ahh, got it. Thank you Andreas. On Sun, Mar 20, 2011 at 6:55 PM, Andreas Kostler < andreas.koestler.le...@gmail.com> wrote: > Hi Brett, > A :while clause continues the evaluation ONLY while it's expression is true > > (for [x (range 10) y (range 10) :while (< x y)] [x y]) will terminate as > soon as (< x y) is false. Since (< 0 0) is the first expr to evaluate, > evaluation stops right there. > > What you want is > (for [x (range 10) y (range 10) :when (< x y)] [x y]) > > Cheers > Andreas > > what you want is for ... :when > On 21/03/2011, at 11:43 AM, Brett Morgan wrote: > > Hey all, > > I'm not understanding why the following examples don't line up. In my mind > they should be identical. What am i not getting? > > (user=> (filter (fn [[x y]] (< x y)) (for [x (range 10) y (range 10)] [x > y])) > ([0 1] [0 2] [0 3] [0 4] [0 5] [0 6] [0 7] [0 8] [0 9] [1 2] [1 3] [1 4] [1 > 5] [1 6] [1 7] [1 8] [1 9] [2 3] [2 4] [2 5] [2 6] [2 7] [2 8] [2 9] [3 4] > [3 5] [3 6] [3 7] [3 8] [3 9] [4 5] [4 6] [4 7] [4 8] [4 9] [5 6] [5 7] [5 > 8] [5 9] [6 7] [6 8] [6 9] [7 8] [7 9] [8 9]) > user=> (for [x (range 10) y (range 10) :while (< x y)] [x y]) > () > > user=> (filter (fn [[x y]] (> x y)) (for [x (range 10) y (range 10)] [x > y])) > ([1 0] [2 0] [2 1] [3 0] [3 1] [3 2] [4 0] [4 1] [4 2] [4 3] [5 0] [5 1] [5 > 2] [5 3] [5 4] [6 0] [6 1] [6 2] [6 3] [6 4] [6 5] [7 0] [7 1] [7 2] [7 3] > [7 4] [7 5] [7 6] [8 0] [8 1] [8 2] [8 3] [8 4] [8 5] [8 6] [8 7] [9 0] [9 > 1] [9 2] [9 3] [9 4] [9 5] [9 6] [9 7] [9 8]) > user=> (for [x (range 10) y (range 10) :while (> x y)] [x y]) > ([1 0] [2 0] [2 1] [3 0] [3 1] [3 2] [4 0] [4 1] [4 2] [4 3] [5 0] [5 1] [5 > 2] [5 3] [5 4] [6 0] [6 1] [6 2] [6 3] [6 4] [6 5] [7 0] [7 1] [7 2] [7 3] > [7 4] [7 5] [7 6] [8 0] [8 1] [8 2] [8 3] [8 4] [8 5] [8 6] [8 7] [9 0] [9 > 1] [9 2] [9 3] [9 4] [9 5] [9 6] [9 7] [9 8]) > user=> > > -- > You received this message because you are subscribed to the Google > Groups "Clojure" group. > To post to this group, send email to clojure@googlegroups.com > Note that posts from new members are moderated - please be patient with > your first post. > To unsubscribe from this group, send email to > clojure+unsubscr...@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/clojure?hl=en > > > -- > "Test-driven Dentistry (TDD!) - Not everything should be test driven" > - Michael Fogus > -- > ** > Andreas Koestler, Software Engineer > Leica Geosystems Pty Ltd > 270 Gladstone Road, Dutton Park QLD 4102 > Main: +61 7 3891 9772 Direct: +61 7 3117 8808 > Fax: +61 7 3891 9336 > Email: andreas.koest...@leica-geosystems.com > > www.leica-geosystems.com* > > when it has to be right, Leica Geosystems > > Please consider the environment before printing this email. > > -- > You received this message because you are subscribed to the Google > Groups "Clojure" group. > To post to this group, send email to clojure@googlegroups.com > Note that posts from new members are moderated - please be patient with > your first post. > To unsubscribe from this group, send email to > clojure+unsubscr...@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/clojure?hl=en -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en
Not quite getting for (newb question)
Hey all, I'm not understanding why the following examples don't line up. In my mind they should be identical. What am i not getting? (user=> (filter (fn [[x y]] (< x y)) (for [x (range 10) y (range 10)] [x y])) ([0 1] [0 2] [0 3] [0 4] [0 5] [0 6] [0 7] [0 8] [0 9] [1 2] [1 3] [1 4] [1 5] [1 6] [1 7] [1 8] [1 9] [2 3] [2 4] [2 5] [2 6] [2 7] [2 8] [2 9] [3 4] [3 5] [3 6] [3 7] [3 8] [3 9] [4 5] [4 6] [4 7] [4 8] [4 9] [5 6] [5 7] [5 8] [5 9] [6 7] [6 8] [6 9] [7 8] [7 9] [8 9]) user=> (for [x (range 10) y (range 10) :while (< x y)] [x y]) () user=> (filter (fn [[x y]] (> x y)) (for [x (range 10) y (range 10)] [x y])) ([1 0] [2 0] [2 1] [3 0] [3 1] [3 2] [4 0] [4 1] [4 2] [4 3] [5 0] [5 1] [5 2] [5 3] [5 4] [6 0] [6 1] [6 2] [6 3] [6 4] [6 5] [7 0] [7 1] [7 2] [7 3] [7 4] [7 5] [7 6] [8 0] [8 1] [8 2] [8 3] [8 4] [8 5] [8 6] [8 7] [9 0] [9 1] [9 2] [9 3] [9 4] [9 5] [9 6] [9 7] [9 8]) user=> (for [x (range 10) y (range 10) :while (> x y)] [x y]) ([1 0] [2 0] [2 1] [3 0] [3 1] [3 2] [4 0] [4 1] [4 2] [4 3] [5 0] [5 1] [5 2] [5 3] [5 4] [6 0] [6 1] [6 2] [6 3] [6 4] [6 5] [7 0] [7 1] [7 2] [7 3] [7 4] [7 5] [7 6] [8 0] [8 1] [8 2] [8 3] [8 4] [8 5] [8 6] [8 7] [9 0] [9 1] [9 2] [9 3] [9 4] [9 5] [9 6] [9 7] [9 8]) user=> -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en
Re: Clojure in "Computing in Science and Engineering"
I'm currently using terracotta as both a message passing fabric in a cluster of four servers, and as a cache to store images and structured information. I'm not measuring performance hit, mainly because the machines i have are seriously over specified for the problem at hand =) On Fri, Jun 19, 2009 at 5:15 PM, Konrad Hinsen wrote: > > On 19.06.2009, at 00:07, Brett Morgan wrote: > > > Silly question of the week, clojure+terracotta be used to do > > scientific cluster computing? > > The big question is what the performance impact of terracotta is, > both for simple but large date (a big array, for example) and for big > complex data structures (such as a tree). Is there anyone here with > Terracotta experience? > > Konrad. > > > > > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Clojure in "Computing in Science and Engineering"
Silly question of the week, clojure+terracotta be used to do scientific cluster computing? On Fri, Jun 19, 2009 at 2:48 AM, Konrad Hinsen wrote: > > On 18.06.2009, at 16:47, psf wrote: > > > That is funny... I put a little Clojure plug into the article entitled > > "Trailblazing with Roadrunner" in the very same issue of CiSE. > > Great minds think alike ;-) > > > On 18.06.2009, at 18:16, Michel Salim wrote: > > > Really neat -- hopefully there will be a follow-up that demonstrates > > Clojure's concurrency features (perhaps contrasting it with Haskell). > > The problem is that neither one is particularly well suited for the > majority of scientific applications, which work best on distributed- > memory machines. Of course this may change with the increasing number > of cores-per-processor, shared-memory SMP may become fashionable > again even for number crunching. > > Anyway, if anyone has a scientific (in the widest possible sense) > application that exploits Clojure's currency, contact me if you want > to write about it! > > Konrad. > > > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Clojure as a Java lib documentation / examples?
Hi guys, I have some evil thoughts of using Clojure as a java library so that i can use both the STM and the persistent data structures in projects that my team of java developers can work with. As much as I'd like to get the team coding in Clojure properly, I have enough trouble selling the idea of using immutable data structures. If I hide the clojure magic behind interfaces, I can have the team coding in plain java, and wrap what they do in clojure transactions and what not. I'd like to do this in a way that the clojure repl can still be used to interact with the running server. So where do I start reading? =) -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Which paper discusses Henry Baker's (sp?) egal?
I've watched a lot of Clojure videos now, and keep hearing Rich mention "Henry Baker's egal". Does someone have the actual paper title where Baker talks about this? I have an ACM subscription (and assume that's where I'd find it) - but no dice on finding egal (sp?) and Henry G Baker has a hell of a lot of papers. ;) Thanks! Brett --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Reader + Macros on untrusted S Expressions: Security considerations?
On Fri, Oct 24, 2008 at 5:16 PM, Adam Jones <[EMAIL PROTECTED]> wrote: > > > > On Oct 22, 6:17 am, Chouser <[EMAIL PROTECTED]> wrote: > > On Wed, Oct 22, 2008 at 4:30 AM, Brett Morgan <[EMAIL PROTECTED]> > wrote: > > > > > I understand the lisp way is to use the reader plus macros to interpret > the > > > incoming data stream. This is hella cool in that it seriously cuts down > on > > > the amount of development work I have to do. The reader is already > done, and > > > using macros to build the tree walker? And have them applied to a stm > core? > > > Very lightweight in comparison to what I'd do traditionally. Very cool. > > > > I think that if you use "read" rather than "load" or "eval" on the > > incoming s-expressions, you'll have a lot less to worry about. > > Without the eval step there's no need to try to block arbitrary > > function calls and such, because they'll never be evaluated in the > > first place -- any symbols that match function call names will simply > > be returned from the reader as symbols. > > > > If you then want to call macroexpand on them to help process the > > expressions (I've got no sense of whether this would be a useful > > approach or not) then the only code being run would be your own macro. > > There'd be no way for the incoming s-expressions to define new macros > > or functions. > > > > Perhaps you'd still want to audit the LispReader.java code for > > security vulnerabilities and/or run the reader in some sort of Java > > sandbox, but I wouldn't be surprised if neither of these is actually > > necessary. > > > > --Chouser > > > > This is exactly the suggestion I was going to make. Dealing with > untrusted code doesn't seem to be one of the main design > considerations of Clojure. That I know of, there are no provisions to > keep someone from re-defing existing functions, reaching out of their > current namespace, or jumping into those aspects of Java land that are > available. The safest way to handle data from the client is to keep it > as data and write code to parse and react to it, anything else is > setting up a creativity contest between yourself and anyone trying to > break the application. If companies like Microsoft and Oracle can't > win those with all of their money, a single individual doesn't stand a > chance. > My understanding of the lisp way, and I am but a newbie in the land of lisp, is to deal with untrusted code by writing an meta-circular interpreter for a language that is appropriate for the situation at hand. If you don't trust the people generating the code not re-def functions, take def out of the interpreter. Or leave it in, and have it guard predefined functions. My excitement with clojure is that i get to make lots of dsls really easily, at least in comparison to the heavy engineering approach that is required in the java world... > > -Adam > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Reader + Macros on untrusted S Expressions: Security considerations?
I was heading in the direction of generating javascript on the server for page generation, so it makes some sense to keep using that technique for communication as well. In this model the webclient is trusting the javascript the server is generating, so I have to be diligent in my code generation not to allow external untrusted input become inline code. This gives me the power of macros to generate the boilerplate js and html that is required to build out a full UI. =) On Thu, Oct 23, 2008 at 12:27 AM, .Bill Smith <[EMAIL PROTECTED]>wrote: > > Would you have S-expressions going from the server back to the client > as well? > > Bill > > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Reader + Macros on untrusted S Expressions: Security considerations?
On Wed, Oct 22, 2008 at 9:54 PM, Parth Malwankar <[EMAIL PROTECTED]>wrote: > > > > On Oct 22, 3:42 pm, Parth Malwankar <[EMAIL PROTECTED]> wrote: > > On Oct 22, 1:30 pm, "Brett Morgan" <[EMAIL PROTECTED]> wrote: > > > > - Recently the #= reader macro was added. This makes the reader > > do the evaluation before using the value. You may want to > > disable this. E.g. > > > > user=> #=(+ 1 1) > > 2 > > > > I am not sure how to disable this. There is a > > similar thing #. in CL and it is important to disable it before > > reading potentially unsafe expressions. Maybe Rich or someone > > else can comment on how to disable this. > > > > Oops. The example I meant to give was: > user=> `(+ 1 1) > (clojure/+ 1 1) > user=> `#=(+ 1 1) > 2 > That's actually exactly the style of security breach capability that i was worried about. Thank you =) > > Parth > > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Reader + Macros on untrusted S Expressions: Security considerations?
I was honestly thinking of using S expressions purely as a replacement for the current trend to use JSON for everything. JSON basically is S expressions, except using hashmaps as the base type. The advantage being that I get a parser and tree walker language for free. On Wed, Oct 22, 2008 at 9:04 PM, Christian Vest Hansen <[EMAIL PROTECTED] > wrote: > > If your untrusted S-expressions are expected to be pure functions on > some input to some output, then you can use the existing java > sandboxing features[1] to execute/read/whatever them in threads that > are locked down tight. Then after sanitizing the output (which should > be raw data), and you're done. > > That's what I think, at least. > > [1]: http://java.sun.com/javase/6/docs/api/java/lang/SecurityManager.html > > On Wed, Oct 22, 2008 at 10:30 AM, Brett Morgan <[EMAIL PROTECTED]> > wrote: > > Hi all, > > > > I am thinking about a potential architecture for a webapp where in the > > server gets s expressions posted from an ajax web client. > > > > From a security standpoint, the s expressions are coming from an > untrusted > > computer, and thus are in need of careful vetting. > > > > With my java dev hat on, i'd move forward by building a lexer, a parser, > and > > a tree walker to interpret the incoming datastream, with careful > > consideration to the various potential attacks a malicious user can > submit. > > > > I understand the lisp way is to use the reader plus macros to interpret > the > > incoming data stream. This is hella cool in that it seriously cuts down > on > > the amount of development work I have to do. The reader is already done, > and > > using macros to build the tree walker? And have them applied to a stm > core? > > Very lightweight in comparison to what I'd do traditionally. Very cool. > > > > My concern is, what are the security considerations of this architectural > > choice? Do I have to worry about people submitting malformed s > expressions? > > Submitting s expressions that contain data that expands out reader > macros? > > Do I have to watch for any particular bad code practices in constructing > the > > macros? How do I go about error recovery and reporting on bad input? > > > > Thanks in advance. > > > > -- > > > > Brett Morgan http://brett.morgan.googlepages.com/ > > > > > > > > > > > -- > Venlig hilsen / Kind regards, > Christian Vest Hansen. > > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Reader + Macros on untrusted S Expressions: Security considerations?
Hi all, I am thinking about a potential architecture for a webapp where in the server gets s expressions posted from an ajax web client. >From a security standpoint, the s expressions are coming from an untrusted computer, and thus are in need of careful vetting. With my java dev hat on, i'd move forward by building a lexer, a parser, and a tree walker to interpret the incoming datastream, with careful consideration to the various potential attacks a malicious user can submit. I understand the lisp way is to use the reader plus macros to interpret the incoming data stream. This is hella cool in that it seriously cuts down on the amount of development work I have to do. The reader is already done, and using macros to build the tree walker? And have them applied to a stm core? Very lightweight in comparison to what I'd do traditionally. Very cool. My concern is, what are the security considerations of this architectural choice? Do I have to worry about people submitting malformed s expressions? Submitting s expressions that contain data that expands out reader macros? Do I have to watch for any particular bad code practices in constructing the macros? How do I go about error recovery and reporting on bad input? Thanks in advance. -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: offtopic - where are you come from? (poll)
Sydney, Australia On Sat, Oct 18, 2008 at 3:58 PM, Ande Turner <[EMAIL PROTECTED]> wrote: > Dunedin, Otago, NEW ZEALAND > > 2008/10/18 Craig McDaniel <[EMAIL PROTECTED]> >> >> also from Atlanta, Georgia >> >> > > > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Clojure at Boston Lisp Meeting videos
On Fri, Oct 3, 2008 at 4:00 AM, markm <[EMAIL PROTECTED]> wrote: > > > > On Oct 2, 11:47 am, Rich Hickey <[EMAIL PROTECTED]> wrote: >> On Oct 2, 10:05 am, markm <[EMAIL PROTECTED]> wrote: >> >> > On Oct 2, 7:51 am, Rich Hickey <[EMAIL PROTECTED]> wrote: >> >> > > On Oct 2, 3:56 am, scottjad <[EMAIL PROTECTED]> wrote: >> >> > > > Part 1 is stopping after about a minute of playback. I'm not sure if >> > > > it's just my computer. >> >> > > Given that they are very long, it's often best to download the >> > > screencasts first. Just select the .MOV format from the "Play episode >> > > as" dropdown menu, then select "Download playing" towards the bottom >> > > of the screen. >> >> > > Rich >> >> > What "Play episode as" dropdown menu? >> >> When I nav through those URLs I get a screen with a player, below >> which is a listbox labeled "Play episode as :" where the default says >> "Select a format". >> >> Rich > > Interesting, > > Going to the top level url (from the screencasts link on the clojure > home page) doesn't offer that pulldown -- it just starts showing the > latest movie (in flash format); same thing after choosing any movie > from the list on that page. Are you logged in? The file download links were dependent on being logged in at one point... > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Bug: self require -> stack overflow
On Wed, Sep 10, 2008 at 4:38 PM, ntupel <[EMAIL PROTECTED]> wrote: > > On Tue, 2008-09-09 at 23:57 +1000, Brett Morgan wrote: >> On Tue, Sep 9, 2008 at 10:31 PM, [EMAIL PROTECTED] >> <[EMAIL PROTECTED]> wrote: >> > >> > On Sep 9, 11:26 am, "Brett Morgan" <[EMAIL PROTECTED]> wrote: >> >> For C, protection against circular dependencies is on the head of the >> >> programmer, in the form of #ifdef guards. >> > >> > There is #import as a GCC extension (also used in Objective-C). >> > >> >> Which expand out to #ifdef guards, if memory serves. > > So what? It just shows you another effective way to tackle the cycle > problem. As a programmer I don't care if I use "include" or "import" or > "require" to load my dependencies. But I do care if I need to make extra > steps to not include stuff twice. I really can not believe that we have > to discuss this age old problem which has been solved so many times > already again and again. This is just plain stupid. > Well, you could code your own include macro to achieve the affect you are after. It is an open source project, after all. -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Bug: self require -> stack overflow
On Tue, Sep 9, 2008 at 11:58 PM, Randall R Schulz <[EMAIL PROTECTED]> wrote: > > On Tuesday 09 September 2008 01:51, Brett Morgan wrote: >> ... >> >> Would you kindly educate me in how you believe that Clojure would go >> about trapping your error and giving you an error message instead of >> running out of stack space, given that you had given it a >> non-terminating dependency list? > > In this case the matter is nothing other than cycle detection in a > graph. It's eminently decidable. > So what do you do about the macros that change the semantics of the included code between the two inclusions of said code? > > Randall Schulz > > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Bug: self require -> stack overflow
On Tue, Sep 9, 2008 at 10:31 PM, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > On Sep 9, 11:26 am, "Brett Morgan" <[EMAIL PROTECTED]> wrote: >> For C, protection against circular dependencies is on the head of the >> programmer, in the form of #ifdef guards. > > There is #import as a GCC extension (also used in Objective-C). > Which expand out to #ifdef guards, if memory serves. -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Bug: self require -> stack overflow
On Tue, Sep 9, 2008 at 10:20 PM, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > On Sep 9, 11:28 am, "Brett Morgan" <[EMAIL PROTECTED]> wrote: >> On Tue, Sep 9, 2008 at 8:20 PM, Mike Hinchey <[EMAIL PROTECTED]> wrote: >> >> > It doesn't seem *impossible* for require and use to keep a var set of >> > namespaces it's loading and check if the current is already in the set >> > then give an error. >> >> And that technique is itself open to stack overflow attacks. Oh, we >> could play this game all night. =) > > Care to give an example of such an "attack"? Anything that fills up the table. And i'm getting messy with my terminology. JVMs don't have stacks and heaps. Just memory. Too late at night. > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Bug: self require -> stack overflow
On Tue, Sep 9, 2008 at 8:20 PM, Mike Hinchey <[EMAIL PROTECTED]> wrote: > > It doesn't seem *impossible* for require and use to keep a var set of > namespaces it's loading and check if the current is already in the set > then give an error. And that technique is itself open to stack overflow attacks. Oh, we could play this game all night. =) > However, I don't think clojure supports circular dependency since > loading is sequential. I know there's a trick for functions to be > circularly dependent, and I suppose that could be done with files, but > you'd have to load the files manually, not with (ns). > > Unless I'm missing something, this is probably something people will > expect to work, so a friendly error message would be good. > > -Mike > > On Sep 9, 1:29 am, "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> > wrote: >> On Sep 9, 8:48 am, "Brett Morgan" <[EMAIL PROTECTED]> wrote: >> >> > You seem to be asking for the >> > compiler to be able to prove that your computation finishes, and if it >> > doesn't then give you a sane response. >> >> No. > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Bug: self require -> stack overflow
On Tue, Sep 9, 2008 at 8:12 PM, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > On Sep 9, 10:51 am, "Brett Morgan" <[EMAIL PROTECTED]> wrote: >> Would you kindly educate me in how you believe that Clojure would go >> about trapping your error and giving you an error message instead of >> running out of stack space, given that you had given it a >> non-terminating dependency list? > > First please note that circular includes are nothing specific to > Clojure and other compilers have solved this problem multiple times > already. For C, protection against circular dependencies is on the head of the programmer, in the form of #ifdef guards. For Java, circular dependency is not an issue, primarily because there is no macros, and thus an included file cannot be influenced by what is in the including file. Clojure has macros... > Second I am not insisting on a error message. As I said, the precise > semantics of require can be debated. For instance the ns macro can > always check a set of declared ns symbols before processing the ns > declaration further, putting a new ns symbol into this set as soon as > it is encountered. Wheather it silently stops then or issues an error > message is up to discussion. Also note that this is not a concrete > suggestion how to implement the ns macro, it should just illustrate > that this is not an instance of the halting problem. I think you will find it is, thanks to the presence of macros. > > > -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Bug: self require -> stack overflow
On Tue, Sep 9, 2008 at 7:29 PM, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > On Sep 9, 8:48 am, "Brett Morgan" <[EMAIL PROTECTED]> wrote: >> You seem to be asking for the >> compiler to be able to prove that your computation finishes, and if it >> doesn't then give you a sane response. > > No. Would you kindly educate me in how you believe that Clojure would go about trapping your error and giving you an error message instead of running out of stack space, given that you had given it a non-terminating dependency list? -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
Re: Bug: self require -> stack overflow
On Tue, Sep 9, 2008 at 5:36 PM, ntupel <[EMAIL PROTECTED]> wrote: > > On Mon, 2008-09-08 at 13:15 -0700, Rich Hickey wrote: > > Hmm, don't do that? > > > > Seriously, how is this a bug in Clojure, and not a bug in your > > program, which resulted in an exception which easily leads you to your > > problem? > > Well, first of all this bug in a users program results in undefined > behavior in the Clojure compiler which terminates due to a resource > exhaustion without any particular error message. This should never > happen. > > Then, please note that this somewhat contrived example, when extended to > circular requires, e.g. A requires B and B requires A might accidentally > (or by bad design) occur during development. One can argue whether this > should result in an error message or whether the semantics of require > are satisfied if the namespaces are loaded once each. But again, a > StackOverflowError and a "don't do that" can not be the answer. > > My 2 Cents. Unless I miss my guess, you are actually staring down the barrel of some reasonably old computer science. You seem to be asking for the compiler to be able to prove that your computation finishes, and if it doesn't then give you a sane response. Gödel, Escher, Bach by Douglas Hofstadter is a good starting point. http://en.wikipedia.org/wiki/Gödel,_Escher,_Bach -- Brett Morgan http://brett.morgan.googlepages.com/ --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/clojure?hl=en -~--~~~~--~~--~--~---
