Re: [fossil-users] Protection against timing attacks

2011-10-01 Thread Ron Wilson
On Fri, Sep 30, 2011 at 2:27 PM, Dmitry Chestnykh dmi...@codingrobots.com wrote: The attacker cannot supply hash, he supplies password. To do timing attack, the attacker have to find a such string, for which the hash has a few bytes changed. You and I seem to be talking about different use

[fossil-users] looking for feed back on /json/artifact output format

2011-10-01 Thread Stephan Beal
Hi, all, i've started to implement /json/artifact, which is analogous to the /info, /vinfo, etc. family of functions (but consolidated into one interface). It is called like this: /json/artifact/ID or /json/artifact?uuid=ID where ID may be any artifact ID or tag (in which case it resolves to

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread Lluís Batlle i Rossell
On Sat, Oct 01, 2011 at 02:14:38AM +0200, Stephan Beal wrote: Hi, all! Another minor milestone: the 2nd proof-of-concept non-HTML client, this time in Java. It's fairly basic, and only supports synchronous operation, but it's a start. Sorry, not that I care much about JSON, but can json be

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread Stephan Beal
2011/10/1 Lluís Batlle i Rossell virik...@gmail.com Sorry, not that I care much about JSON, but can json be used in a way that a program *spawns* fossil and talks to it using json, until it decides it's enough and fossil stops? In theory, yes. It just has to start fossil server --port XYZ,

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread Lluís Batlle i Rossell
On Sat, Oct 01, 2011 at 11:12:51AM +0200, Stephan Beal wrote: 2011/10/1 Lluís Batlle i Rossell virik...@gmail.com Sorry, not that I care much about JSON, but can json be used in a way that a program *spawns* fossil and talks to it using json, until it decides it's enough and fossil

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread Stephan Beal
2011/10/1 Lluís Batlle i Rossell virik...@gmail.com But that's only a hack. The spawner will not know when the server will be listening. And killing it, will not know if anyone else uses it and it is working. i don't see any other way to do it unless/until fossil is split up into a lib. The

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread Lluís Batlle i Rossell
On Sat, Oct 01, 2011 at 11:23:32AM +0200, Stephan Beal wrote: 2011/10/1 Lluís Batlle i Rossell virik...@gmail.com But that's only a hack. The spawner will not know when the server will be listening. And killing it, will not know if anyone else uses it and it is working. i don't see

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread alaric
I thought that was how fossil over ssh works already; on the far end fossil is started with some undocumented private command that talks http over stdin/stdout. you may well find your JSON work works transparently with that mechanism too due to it being baked into the fossil http stack! Sent

Re: [fossil-users] Protection against timing attacks

2011-10-01 Thread Dmitry Chestnykh
On Oct 1, 2011, at 9:24 , Ron Wilson wrote: On Fri, Sep 30, 2011 at 2:27 PM, Dmitry Chestnykh dmi...@codingrobots.com wrote: The attacker cannot supply hash, he supplies password. To do timing attack, the attacker have to find a such string, for which the hash has a few bytes changed.

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread Stephan Beal
2011/10/1 Lluís Batlle i Rossell virik...@gmail.com Maybe you could do some http-over-stdin/stdout, and speak json there. :) I think of people wanting to write frontends to fossil. i was just thinking about that while i was out shopping. It is, in principal, possible, but fossil's heavy use

Re: [fossil-users] delete a branch

2011-10-01 Thread Paul Ruizendaal
There is something unsatisfying about the mistake solution, at least that is my feeling. Conceptually, there is a difference between not deleting history (which I think is a very valuable asset in fossil) and always showing full history, rubbing mistakes in your face, especially when still

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread Stephan Beal
On Sat, Oct 1, 2011 at 3:07 PM, Paul Ruizendaal p...@planet.nl wrote: Maybe you could do some http-over-stdin/stdout, and speak json there. :) Isn't fossil cgi already doing that? A front-end could build the appropriate environment variables and fork/exec fossil cgi, feeding the post body

Re: [fossil-users] delete a branch

2011-10-01 Thread Stephan Beal
On Sat, Oct 1, 2011 at 3:19 PM, Paul Ruizendaal p...@planet.nl wrote: There is something unsatisfying about the mistake solution, at least that is my feeling. Conceptually, there is a difference between not deleting history (which I think is a very valuable asset in fossil) and always showing

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread Richard Hipp
On Sat, Oct 1, 2011 at 9:07 AM, Paul Ruizendaal p...@planet.nl wrote: after every command fossil runs, exit() is called somewhere, which makes it difficult or impossible to chain commands together in the same app session. Why? I built Fossil using the old-school unix design paradigm of a

Re: [fossil-users] minor milestone: Java client

2011-10-01 Thread Paul Ruizendaal
On 1 Oct 2011, at 15:28 , Stephan Beal wrote: On Sat, Oct 1, 2011 at 3:07 PM, Paul Ruizendaal p...@planet.nl wrote: Maybe you could do some http-over-stdin/stdout, and speak json there. :) Isn't fossil cgi already doing that? A front-end could build the appropriate environment variables