z3t0 has quit [Read error: Connection reset by peer]
z3t0 has joined #commonlisp
Devon has joined #commonlisp
tophullyte has joined #commonlisp
phossil has quit [Ping timeout: 268 seconds]
nature has quit [Ping timeout: 256 seconds]
peterhil_ has quit [Remote host closed the connection]
peterhil_ has joined #commonlisp
Lord_of_Life has quit [Ping timeout: 256 seconds]
theBlackDragon has quit [Ping timeout: 250 seconds]
Lord_of_Life has joined #commonlisp
theBlackDragon has joined #commonlisp
asen has quit [Quit: Leaving]
gioyik has quit [Ping timeout: 276 seconds]
servytor has quit [Quit: Connection closed for inactivity]
gioyik has joined #commonlisp
gioyik has quit [Ping timeout: 276 seconds]
nature has joined #commonlisp
CrashTestDummy has quit [Quit: Leaving]
gioyik has joined #commonlisp
gioyik has quit [Ping timeout: 276 seconds]
varjag has quit [Ping timeout: 268 seconds]
CrashTestDummy has joined #commonlisp
nature has quit [Ping timeout: 256 seconds]
ec has quit [Ping timeout: 276 seconds]
ahlk has quit [Remote host closed the connection]
Catie has quit [Quit: going home]
gioyik has joined #commonlisp
nature has joined #commonlisp
gioyik has quit [Ping timeout: 276 seconds]
phossil has joined #commonlisp
tophullyte has quit [Ping timeout: 245 seconds]
karlosz has joined #commonlisp
nature has quit [Ping timeout: 245 seconds]
akoana has quit [Quit: leaving]
s-liao has quit [Quit: Client closed]
gioyik has joined #commonlisp
poselyqualityles has joined #commonlisp
zephyr has joined #commonlisp
karlosz has quit [Quit: karlosz]
zephyr has quit [Client Quit]
zephyr has joined #commonlisp
dre has joined #commonlisp
gioyik has quit [Ping timeout: 276 seconds]
poselyqualityles has quit [Remote host closed the connection]
poselyqualityles has joined #commonlisp
no-output-detect has quit [Ping timeout: 264 seconds]
gioyik has joined #commonlisp
gioyik has quit [Ping timeout: 276 seconds]
ec has joined #commonlisp
Bike has joined #commonlisp
Alfr has quit [Ping timeout: 268 seconds]
Catie has joined #commonlisp
Oladon has quit [Quit: Leaving.]
dec0d3r has quit [Quit: Leaving]
pranavats has joined #commonlisp
Guest7430 has joined #commonlisp
Alfr has joined #commonlisp
Bike has quit [Quit: Connection closed]
taiju has quit [Ping timeout: 245 seconds]
aartaka has joined #commonlisp
taiju has joined #commonlisp
Bike has joined #commonlisp
<beach>
Good morning everyone!
<lisp123>
Good morning Beach
s-liao has joined #commonlisp
Inline has joined #commonlisp
gioyik has joined #commonlisp
s-liao has quit [Ping timeout: 256 seconds]
Bike has quit [Quit: Connection closed]
s-liao has joined #commonlisp
gioyik has quit [Ping timeout: 276 seconds]
gioyik has joined #commonlisp
Josh_2 has quit [Remote host closed the connection]
gioyik has quit [Ping timeout: 276 seconds]
White_Flame has quit [Remote host closed the connection]
White_Flame has joined #commonlisp
gioyik has joined #commonlisp
gioyik has quit [Ping timeout: 276 seconds]
rain3 has joined #commonlisp
phossil has quit [Quit: Leaving]
phossil has joined #commonlisp
tophullyte has joined #commonlisp
phossil has quit [Ping timeout: 264 seconds]
Catie has quit [Quit: "good]
s-liao has quit [Quit: Client closed]
ec has quit [Ping timeout: 276 seconds]
tyson2 has quit [Remote host closed the connection]
asarch has joined #commonlisp
asarch has quit [Ping timeout: 245 seconds]
gioyik has joined #commonlisp
no-output-detect has joined #commonlisp
fbmnds has joined #commonlisp
fbmnds has quit [Quit: Client closed]
frgo_ has joined #commonlisp
frgo has quit [Ping timeout: 260 seconds]
frgo_ has quit [Ping timeout: 256 seconds]
pillton has quit [Quit: ERC (IRC client for Emacs 27.2)]
poselyqualityles has quit [Ping timeout: 256 seconds]
karlosz_ has joined #commonlisp
Cymew has joined #commonlisp
gaqwas has joined #commonlisp
waleee has joined #commonlisp
karlosz_ has quit [Quit: karlosz_]
Spawns_Carpeting has quit [Quit: WeeChat 3.3]
lisp123 has quit [Quit: Leaving...]
waleee has quit [Quit: WeeChat 3.3]
waleee has joined #commonlisp
lisp123 has joined #commonlisp
cosimone has joined #commonlisp
pve has joined #commonlisp
amb007 has quit [Ping timeout: 264 seconds]
amb007 has joined #commonlisp
VincentVega has joined #commonlisp
Cymew has quit [Quit: Konversation terminated!]
varjag has joined #commonlisp
<VincentVega>
I just thought, if we could specify the library version for asdf's :use, then adding new symbols to API wouldn't be a problem - it would only import the symbols from the specified version (if those can be accessed somehow). Because I do end up importing whole packages symbol-by-symbol anyway, like iterate, just carrying the whole thing around from project to project. Be nicer if I didn't have to.
s-liao has joined #commonlisp
<beach>
It is a much better idea not to import at all, but to use explicit package prefixes, possibly with package-local nicknames.
<beach>
To a person reading the code, it is then much more obvious where each symbol comes from.
Cymew has joined #commonlisp
<VincentVega>
Yes, but for some ever-used things like iterate, I do use imports anyway, because it ends up being so much shorter.
<VincentVega>
Most libraries - not, I agree, but not all.
<beach>
That sounds to me like a reason not to use ITERATE.
<VincentVega>
: D
<flip214>
VincentVega: for ALEXANDRIA, I ended up with the usual ALEXANDRIA package, and then an ALEXANDRIA-1 (only the old API, like with the legacy name) and a ALEXANDRIA-2 package with more stuff.
<flip214>
so it's then just a matter of changing the :USE clause to get the newer functionality.
amb007 has quit [Ping timeout: 260 seconds]
amb007 has joined #commonlisp
<VincentVega>
flip214: that's an interesting approach, but that's ends up being up to the maintainer (if I understood you correctly), but the version control would give a guarantee without much fuss
<flip214>
VincentVega: well, but having multiple different versions of a software means to me that common code and data should be shared... and that ends up not so easy
<flip214>
with one software and multiple packages each other package can choose what to import
<VincentVega>
flip214: I didn't mean keeping multiple versions. It's just one version, but defsystem has a field called :version, so I meant just picking up those symbols which were relevant for that particular version.
Nselm has joined #commonlisp
<VincentVega>
This wouldn't require multiple packages, just some way to look up the specified set of exported symbols.
<flip214>
ah, okay
stacksmith has quit [Ping timeout: 264 seconds]
stacksmith has joined #commonlisp
amb007 has quit [Ping timeout: 260 seconds]
amb007 has joined #commonlisp
varjag has quit [Ping timeout: 256 seconds]
dre has quit [Ping timeout: 268 seconds]
shka has joined #commonlisp
<Nilby>
The view that you should never use ‘use’ or ‘import’ seems extreme.
nature has joined #commonlisp
<beach>
Luckily, very few people hold that view.
amb007 has quit [Read error: Connection reset by peer]
amb007 has joined #commonlisp
rain3 has quit [Read error: Connection reset by peer]
<jackdaniel>
a plus benefit is that you may use finally t for time
<jackdaniel>
arguably most annoying symbol name conflict in cl package
<Nilby>
like a Malkovichian dream where everything starts with cl
<jdz>
VincentVega: Even if _you_ load a particular version of a system with ASDF, some other dependency may load a different version, and we're back to square 1.
frgo has joined #commonlisp
frgo has quit [Ping timeout: 250 seconds]
s-liao has quit [Ping timeout: 256 seconds]
attila_lendvai has joined #commonlisp
poselyqualityles has joined #commonlisp
<VincentVega>
jdz: That's not what I meant. You load all the same (latest) version of a system. However, only the symbols exported for the specified (earlier) version of that system are :used. E.g. if package (version 1.0) exports A and B, and package (version 1.1) exports C (additionally), and the package you are writing does something like (:use (#:some-system :version 1.0)), then it will only import symbols A and B, even though version of the
<VincentVega>
library you are loading is 1.1 and also exports C.
<jdz>
VincentVega: So you're suggesting adding versioning to Common Lisp packages?
<lisp123>
Can't you just use shadowing-import (forget the exact clause, might be :shadowing-import-from)
<lisp123>
It was :shadow, it doesn't work?
<jdz>
VincentVega: It looks you're confusing ASDF systems and packages.
<VincentVega>
jdz: No, to imports of :use. Systems are already versioned, and that's what's looked up I guess.
<lisp123>
VincentVega: Try :use ITERATATE and then shadow the symbols you want to re-define?
<jdz>
Packages already support your use case: (:use #:some-system-version-1.0).
<jdz>
The only part missing is system authors to start using versioned package names.
<VincentVega>
lisp123: It's not quite about redefinition. It's about the case when iterate adds a new symbol and causes a conflict in your package, which makes you manually deal with the problem. The reason why :use isn't used.
<VincentVega>
jdz: they do?
<VincentVega>
jdz: cool, I didn't know that.
<lisp123>
VincentVega: Oh okay. One alternative is to programatically make al ist of all the symbols and then shadow everything in ITERATE that is not there
<jdz>
Looks like we're talking past each other.
<lisp123>
so (:shadow (any-new-symbols "ITERATE" *pre-existing-list*)
<jdz>
As cute as Iterate is, it introduces more problems than it solves.
<lisp123>
VincentVega: You can create a "package-snapshot" file where you store all the symbols at a particular snapshot, and then do a lookup against that in all your projects
<VincentVega>
jdz: this doesn't seems to work (defpackage #:my-package (:use #:iterate-1.5.2)), what am I missing?
<VincentVega>
jdz: what problems does it introduce?
frgo has joined #commonlisp
<jdz>
VincentVega: How does it not seem to work exactly? Is there a package named "ITERATE-1.5.2"?
<VincentVega>
lisp123: A lookup sounds like an interesting solution, but you would have to carry that snapshot if you were to publish some package as a seperate entity, right?
<VincentVega>
jdz: You said "(:use #:some-system-version-1.0)", so I am just trying to understand what that means exactly.
<jdz>
It means that package authors have to start using versioned packages.
<lisp123>
I usually have a large personal utilities file in all my projects, which I put inside a :depends-on within an ASDF. If you are doing the same, just create a file called snapshot.lisp and have it part of your utils system definition
prxq has joined #commonlisp
<pve>
VincentVega: It's just the name of a package that happens to end with "1.0"
<VincentVega>
pve: I see.
<lisp123>
If you are not already doing it, IMHO make a utils.asdf for your utils.lisp or equivalent
<jdz>
Versioned systems without versioned packages don't really solve any problems.
<jdz>
Maybe even introduce some.
<VincentVega>
lisp123: I gotcha. That sounds workable, yeah. Not ideal, but workable.
<pve>
VincentVega: so somebody has to make that package, like the author of some-system
<VincentVega>
jdz: Why, I don't understand why you would version a package if you are already versioning a system, of which part that package is.
<VincentVega>
Just assume package version = system version, no?
<jdz>
VincentVega: How do you use a particular _system_ version, then?
<jdz>
And if there is only a single _package_ name, then loading two different versions of the same system will not work.
<lisp123>
VincentVega: The initial setup is a pain (if you struggle, let me know, I'll write something for you), but afterwards, as long as you are importing your utils file in every project, you just need to change your :shadow in your defpackage, so very straightforward
<VincentVega>
lisp123: Thanks, man : ) I already have a util library, but some libraries are so small and self-sufficient, that making them rely on my util packack isn't so authetically pleasing, especially that my util library also loads a bunch of stuff.
<lisp123>
Ah gotcha. That makes sense
poselyqualityles has quit [Ping timeout: 264 seconds]
<VincentVega>
jdz: But, bruh, loading two different versions of the same system is not what I had in mind. It maybe anything, it's only the exports which are looked up differently. Could you please explain what I missed here, if I did, step by step?
gioyik has quit [Ping timeout: 276 seconds]
<VincentVega>
* looked up differently according to the system version
<jdz>
VincentVega: Maybe _you_ do not load different versions, but some dependency might.
s-liao has joined #commonlisp
<beach>
And this is why we need first-class global environments.
<VincentVega>
jdz: I don't see how that's a problem. I don't specify which system version I want to _load_, only what exports I want to pull (from such and such version, which doesn't imply loading it, but rather looking it up somewhere. Where? Dunno, seems like a job at the level of ql).
<jdz>
VincentVega: So if you stick to a particular version of a _system_ (e.g., ITERATE, version 1.5.2), and that system only has an "ITERATE" package, and some library you depend on also uses Iterate _system_, but without specifying version number (which defaults to newest; or maybe it also specifies a version, but different from _your_ version), then that other version of the _system_ will have the same _package_ name: "ITERATE", but with
<jdz>
different exports. So, trouble.
<lisp123>
beach: It would be one of the most significant improvements in CL. Wish it was there to begin with :(
<lisp123>
VincentVega: I thought of a better way - write some elisp that handles the calculation and then inserts the relevant symbols to shadow from (I assume you are using Emacs). You would need to use both Elisp & CL (via swank/slime) to do it
<beach>
There is no great point in wishing there were different from what they are. But we could figure out a strategy for improving things.
<VincentVega>
jdz: I also _load_ the latest version of iterate, even though I specify that I want the exports of version 1.5.2.
<VincentVega>
jdz: or whatever the loaded version of iterate there is
<VincentVega>
lisp123: i will that right to my emacs checklist
<VincentVega>
* add
<jdz>
VincentVega: Exports are part of package, version is part of system. If packages are not versioned, package exports will depend on what order two different versions of systems are loaded.
<jdz>
VincentVega: So in your case it seems the only way is to use a manually curated list of imports.
<lisp123>
beach: Will a "portability layer" similar to Closer-MOP need to be developed to export this feature from SICL to other implementations?
<VincentVega>
jdz: It doesn't matter what package is loaded / active and to what system it belong. All that matters is the list of the actual symbols that I want to import.
<hayley>
The problem is that other implementations would have to implement first class global environments too.
<jdz>
VincentVega: Yes, so it is about imports, not exports.
* hayley
hides
<hayley>
Hm, there's a Common Lisp implemented on Prolog, and Lispkit in Squeak. Perhaps you'd consider implementing CL in Newspeak?
<jdz>
VincentVega: So what is the problem, again?
<VincentVega>
jdz: sorry if I messed up my wording that could've made that confusing
<beach>
lisp123: What hayley says. It is not generally possible to emulate this feature in implementations that don't have it.
kuao has quit [Quit: Connection closed for inactivity]
<beach>
lisp123: You could go with the AST evaluator of SICL, but you then take a significant performance penalty. But perhaps that penalty could be minimized.
<VincentVega>
jdz: The problem is that you can't use :use for the same reasons as always - packages of newer systems might start exporting symbols that might cause a conflict within your package. So you just say, well, import whatever was exported in system of _that_ particular version. That doesn't require loading the system of that version, only looking up the exports that a particular package had and using those exclusively.
<jdz>
VincentVega: Yes, and this could be made more convenient if systems had versioned packages.
<jdz>
Or, as beach said, using explicit package qualifiers, which does not really work in case of Iterate.
<VincentVega>
jdz: Maybe? But I don't see how you would update the version of a package, but not the version of a system, though. AFAIS system version would be enough.
<jdz>
Different set of exports are introduced in different versions of the system, right?
<VincentVega>
I am pretty sure that's how it is.
<lisp123>
beach & hayley: Thanks understood. What if there was 1 global environment that had a global variable which was an a-list of other global environments and their special variables and a lookup was done against that at compile-time?
<lisp123>
And to the extent possible, one could could transcribe environment:symbol to environment-symbol
<Nilby>
Old lisp machines had a various things like global environments, as well as hierarchical packages, I'm pretty sure you can simulate f-c-g-e with the normal CL package system (and maybe some symbol macros).
<VincentVega>
jdz: One problem with that though is the maintainer might add a new export, but forget to bump the version. So, maybe, don't specify a system version, but rather a date/time and let the system figure out what exports were relevant to that date.
<jdz>
So, if the set of exports system provided package changes, a new package is defined within the system, with the new set of exports. So, in case of Iterate, package "ITERATE-1.5.2" would have one set of exports, and package "ITERATE-1.6.0" would have a different set. And the latest version of the system might have a package nickname "ITERATE" assigned to the latest package. So if you previously had (defsystem ... (:use
<jdz>
#:iterate-1.5.2) ...), everything would still work once Iterate-1.6.0 system is released.
* hayley
presses X to doubt
<hayley>
lisp123: It would suffice to just lookup against a constant environment object. I _think_ the AST evaluator in SICL does what you describe, more or less.
<hayley>
...except that, again, lookup is done against the global environment object, and no alist of anything is necessary.
<beach>
lisp123: That's basically what we do. But consider a reference such as (F ...) in code to be compiled. Currently, in most implementations, when you compile this code, lookup is going to be through the symbol object for F.
<lisp123>
If the other implementations repalce their READER with yours (or a modified version), would that work?
<beach>
lisp123: So what we do is we basically modify such calls to (funcall (car (load-time-value (find-function-cell 'F))) ...) and then compile that instead.
<beach>
I don't think renaming is a good idea.
<lisp123>
Got it, thanks
<beach>
But since the native compiler may no longer be able to optimize such code, there is a performance penalty.
<VincentVega>
jdz: Sounds reasonable, as long as the programmer doesn't have to do bumps himself. Make it all rely on dates, or some sort of autogenerared tags maybe?
<lisp123>
beach: So the approach just noted does sound much better. Renaming for other non-SICL compilers may be a way to let them continue to optimize the code?
<beach>
lisp123: I think you are going to get into all kinds of trouble with that approach.
<flip214>
jackdaniel: you can easily use one of ţťƫțᵗṫṭṯṱẗₜｔ for time... the last one being FULLWIDTH LATIN SMALL LETTER T
<jdz>
VincentVega: Then there would have to be a package for each date?
<lisp123>
Got it (yeah wasn't even sure if its possible when coming to non-trivial things like CLOS and packages)
<jdz>
VincentVega: System build scripts may have code to check if package exports have changed, and not allow to create a release without creating a new package. But in the end it is the responsibility of the system author to decide what packages the system defines.
<flip214>
jdz: ALEXANDRIA-1 vs. ALEXANDRIA-2 uses that already.... the latter one might still be expanded.
cosimone has quit [Remote host closed the connection]
<jdz>
flip214: As long as the documentation says so.
<VincentVega>
jdz: Not necessarily, just choose the latest system up to that date. Or rely on the system's version indeed, just add a modifier when the programmer forgets to bump it. Like iterate-1.5.2/1 or smth. It could be reasoned through.
cosimone has joined #commonlisp
gioyik has joined #commonlisp
<lisp123>
It would be good to have the ability to specify versioning within ASDF tbh
<VincentVega>
jdz: dates are better because defsystem doesn't require :version to be specified, so that's to be considered as well for the existing packages
<jdz>
lisp123: What I'm trying to argue is that ASDF versioning does not work without the cooperation of system authors (and versioning packages defined within the systems).
<lisp123>
jdz: Yes, I agree. But if the feature was there, I would use it if I ever wrote decent packages. Perhaps it there and nobody uses it (sorry for bringing it up in that case)
s-liao has quit [Quit: Client closed]
<jdz>
Together with package local nicknames, versioned packages would (as soon as authors start making them) work wonderfully, in my opinion.
Nselm has quit [Ping timeout: 256 seconds]
<pve>
VincentVega: it may have already been mentioned, but you're free to create the package "vincent-vega-iterate" yourself that exports exactly what you need.
gioyik has quit [Ping timeout: 276 seconds]
notzmv has quit [Ping timeout: 245 seconds]
<jdz>
Versioned packages is also the only way to use different _incompatible_ versions of the same system.
<jdz>
Well, not necessarily versioned, but differently named.
s-liao has joined #commonlisp
<VincentVega>
pve: yeah, but that's kind of a pain and requires typing and stuff. we are here for the cool or what?
<jdz>
Besides first-class global environments.
<lisp123>
jdz: Got it, and agree now (took me a while to get my head around)
<pve>
VincentVega: nah, just print all external symbols in the repl and copy them into the defpackage form, and edit as needed.. not a lot of typing really
<VincentVega>
pve: sure, I already have an item waiting on my emacs todo list, #207 or smth
<lisp123>
Nilby: Do you recall how the Lisp Machines of Lore did it?
<VincentVega>
jdz: but how are you to load different versions of the same system since you can load just one system? that would require first class environments to begin with
<lisp123>
VincentVega: You can load 100s of systems :)
<VincentVega>
* of the same designation
<lisp123>
As long as they have different package names
<Nilby>
in one implemtation there was a "global" package and hierarchical packages, in another there were different "users", but that shared the system packages
<VincentVega>
lisp123: ah, yees
<jdz>
VincentVega: In ASDF system dependencies can specify version numbers.
<VincentVega>
jdz: I see
<lisp123>
jdz: Can I specify them as well during a :depends-on?
<Nilby>
before CL, the way packaging worked seemed to be constantly chaning
<Nilby>
changing
<jdz>
lisp123: That's exactly where you specify them.
<pve>
VincentVega: M-x slime-eval-print-last-expression is an easy way to get started on that.
<lisp123>
jdz: well I didn't know :-/ That's very useful - do you know how it is done (otherwise I will read through the ASDF manual)
<Nilby>
A late enought version of the "CHINE UAL", and a late enough version of the Genera documentation might explain them.
<lisp123>
jdz: Thanks!
<lisp123>
Nilby: Thanks, will add to my read list :)
<jdz>
lisp123: But again, there's not much point in asking for particular versions, if two different versions define the same packages (hence loading both systems in the same image will overwrite each other).
s-liao has quit [Ping timeout: 256 seconds]
<lisp123>
VincentVega: while we are it ("Build Your Own Lisp because the IDE doesn't do what you need it to"), you can use this to get all the exported symbols in a package. Then you just need a set-difference form somewhere to compare two sets of symbol lists, (defun all-external-symbols (package) (let ((all-external-symbols nil)) (do-external-symbols (s (find-package package)) (push s all-external-symbols)) all-external-symbols))
<lisp123>
jdz: Thanks, but for me its still useful because I will never use two different versions of the same system
<jdz>
lisp123: How do you know?
<jdz>
lisp123: Well, you can, if you specify versions for all of your dependencies, and check that those dependencies (recursively) do not depend on different versions of _any_ of the systems loaded.
<lisp123>
jdz: I try to minimise dependencies as it is. CL-PPCRE, CMU-INFIX and soon to be MCCLIM will hopefully be the extent of what I need. But I guess if one of your dependencies uses the latest version of a package, then you are in trouble
<jdz>
Right.
s-liao has joined #commonlisp
<lisp123>
Oh and PARACHUTE and IBCL + STEPPER. I guess the list starts to get large eventually
s-liao has quit [Ping timeout: 256 seconds]
<VincentVega>
lisp123: I see, but why limit yourself to a few libraries? I often time notice folks don't like extra dependencies, but better use someone elses code than your own the way I see it.
<hayley>
At least it's not npm(tm)
<lisp123>
VincentVega: I just wrote my own unit test framework, so I'm not a good example tbh. A week's worth of work without any notable improvement apart from doing it myself. Unfortunately quite a few lisp programmers have this mindset - I think the language encourages it implicitly :-/
<lisp123>
hayley: When the Lisp takeover is complete, QuickLisp will become the new NPM
<lisp123>
But the good thing about QL is that its somewhat tested each month
<jdz>
VincentVega: Supply chain attacks are real. Common Lisp community is small, but it's only a matter of time till something bad happens.
<Nilby>
(ql:quickload :left-pad)
<jdz>
VincentVega: For instance, all of this is not exclusive to Rust, and since CL can also run code during compilation, most of this applies to CL https://kerkour.com/rust-crate-backdoor/.
<hayley>
It's 2021, can we have object capabilities already?
<jdz>
Almost 2022!
<hayley>
Even worse!
<flip214>
jdz: well, one advantage of CL is that there are much fewer LOC, and so there's less to check.
<flip214>
and since a lot of (older) libraries don't change that often, the diff for a newer version is very small, typically...
<jdz>
flip214: I agree. Now let's count the people who actually _do_ check?
<Nilby>
but for real, a bunch of people mildly audit new quicklisp packages
* hayley
continues grumbling about ambient authority.
<jdz>
I would look at the diffs if it was easy enough to do, though.
<flip214>
jdz: yeah, of course. perhaps there should be something done by the CL foundation??
<flip214>
jdz: well, if you get your QL stuff directly from a git repo, it's easy ;)
<jdz>
I'd volunteer my time to review changes to QL dist updates.
<lisp123>
jdz: I don't use quickload (just at the start to get the files), and then I skim through most of the code
<lisp123>
(and recommend others to do the same / similar, or operate in a sandbox evnironment)
<hayley>
I couldn't be bothered to audit every library that I transitively use. Hence, I'd rather just make it impossible for libraries to do Bad Things.
<jdz>
hayley: But how?
<hayley>
Don't give libraries unnecessary capabilites. How many actually have to touch the filesystem? How many actually have to use networking?
<jdz>
Heh, just this morning I was thinking of running my everyday development SBCL in a sandbox.
<jdz>
With unexpected events logged.
<Nilby>
But I have to put some things on a quicklisp excluded list.
no-output-detect has quit [Ping timeout: 245 seconds]
<hayley>
I guess logging is nice after things go wrong, but they aren't a security mechanism; they don't stop bad things from happening.
<hayley>
s/they aren't/logging isn't/
<hayley>
(Never got the cyber-security class. Between showing the class how to use single DES, that flow analysis doesn't exist, and putting time into fancy logging rather than even a hand-wavy proof that any code is secure...)
<Nilby>
But I've also loaded everything in QL in a sandbox, so I've seen most of what can happen at least on loading. Actully trying to use something is whole different story.
<jdz>
Well, by logging I mean disabling, and logging attempts to do the bad thing.
<hayley>
Oh, okay.
<hayley>
(FWIW, it was only worse that the semester before was solely teaching students how to write SQL injections. "Don't write your database code like this." "But that's harder than using prepared statements, why would you write it like that?" "It's more common, that's just how it is." "Cause you teach students that?" "..." I'll stop complaining.)
<jdz>
Ouch.
<Nilby>
sql injections & xss are like 90% of worldwide security issue, very few people can do actually hard hacks
Nselm has joined #commonlisp
<flip214>
jdz: hayley: you can use (sb-perf:write-perfmap) to export your address/symbol map, and then use BPF to filter which call chains may use which syscalls...
<flip214>
filter and/or log, that is
<flip214>
so the next thing to worry about is a kind of RET-in-CL-based attach that fakes a callstack ;)
<jdz>
flip214: That's probably for production deployment. For the first cut it would be enough for me limit the process to a single directory for file access, and remove all internet access (probably with some whitelisting), and know if those constraints are tried to be violated.
<Nilby>
Just don't make CL popular or any easier to use and we'll be safe.
gxt has quit [Remote host closed the connection]
gxt has joined #commonlisp
<hayley>
Capabilities are literally right there.
<jdz>
Should be easy enough to do by starting a SWANK server in a sandbox, but that means I myself must do stuff.
<jdz>
hayley: I know, that's part of the problem.
<hayley>
I can understand that they are non-trivial to implement (as you want first class global environments, if you want to preserve CL semantics), but hampering oneself to avoid the problem is stupid.
<Nilby>
But for capabilities to be useful first you have to bloack off everything fun in CL.
<Nilby>
Of course another thing my precious one ring of *read-intern* can do.
<hayley>
Not even close. You just need to make sure untrusted code can't "jump" to environments with capabilities, which is not hard.
voltron has joined #commonlisp
amb007 has quit [Read error: Connection reset by peer]
amb007 has joined #commonlisp
voltron has quit [Remote host closed the connection]
<Nilby>
I'm pretty sure I shouldn't let untrusted code run. I'd like to prevent dangerous code from being compiled.
<hayley>
Good luck with that.
<flip214>
jdz: Nilby: blocking off via CL sounds less secure than using the BPF kernel facilities. But of course, then you're restricted to Linux.
<flip214>
I wrote a short white-paper once that describes that (unexpected) ENOENT should make a process (or the whole container) freeze immediately (via SIGSTOP, for example), so that it can be analyzed
amb007 has quit [Read error: Connection reset by peer]
<flip214>
or do a full container process-dump to disk or so
amb007 has quit [Read error: Connection reset by peer]
amb007 has joined #commonlisp
amb007 has quit [Read error: Connection reset by peer]
amb007 has joined #commonlisp
<flip214>
Nilby: well, if it's in the kernel (and so available for an attacker) anyway, you can just as well use it for your purposes also.
<flip214>
as long as it needs uid 0 and your CL process is less-priviledged...
<flip214>
but there will always be bugs, right
<Nilby>
At this point I don't consider anything close to arbitrary machine code can be secure.
<Nilby>
Too bad nothing useful is secure, since I imagine a secure lisp compiler proof of concept using something the simplicity like brainfuck or similar as a target, even with just input and output bytes, unfortunately if the i/o is in a terminal, I already know a few escape hatches.
<flip214>
well, even javascript was used to exfiltrate data (spectre etc.)
s-liao has joined #commonlisp
<Nilby>
and even with the kernel mitigations turned on, 1 byte echoed to a "file", can turn them off.
heisig has joined #commonlisp
<Nilby>
But I've actually been thinking about a cffi interface to EBPF, Unfortunately every time I just think a technique like Varjo for shaders.
sixtyfour has joined #commonlisp
aartaka has quit [Ping timeout: 268 seconds]
sixtyfour has quit [Remote host closed the connection]
amb007 has quit [Read error: Connection reset by peer]
amb007 has joined #commonlisp
aartaka has joined #commonlisp
attila_lendvai has quit [Ping timeout: 260 seconds]
notzmv has joined #commonlisp
<hayley>
Does FFI count as ambient authority? If so, it would be somewhat ironic.
hhdave_ has quit [Ping timeout: 240 seconds]
hhdave has joined #commonlisp
edgar-rft has quit [Quit: Leaving]
heisig has quit [Ping timeout: 260 seconds]
tyson2 has joined #commonlisp
abrantesasf has joined #commonlisp
aartaka has quit [Ping timeout: 260 seconds]
aartaka has joined #commonlisp
Nselm has quit [Quit: Client closed]
random-nick has joined #commonlisp
aartaka has quit [Ping timeout: 264 seconds]
aartaka has joined #commonlisp
Nselm has joined #commonlisp
gioyik has joined #commonlisp
attila_lendvai has joined #commonlisp
gioyik has quit [Ping timeout: 276 seconds]
igemnace has joined #commonlisp
s-liao has quit [Quit: Client closed]
ec has joined #commonlisp
kuao has joined #commonlisp
yewscion has joined #commonlisp
Bike has joined #commonlisp
Nselm has quit [Quit: Client closed]
gioyik has joined #commonlisp
<etimmons>
jdz lisp123 VincentVega: I'm sad I missed the versioning discussion! A quick clarification: specifying a version in an ASDF dependency does not request that specific version. It requests a minimum version of that dep.
<etimmons>
And request may still be a string word there since ASDF does not search for a dep that satisfies the version constraint
<etimmons>
s/string/strong/
<jdz>
etimmons: Thanks for clarification!
<etimmons>
ASDF only evaluates those constraints. So if the first instance of a system it finds does not meet the version constraints, it signals an error
<etimmons>
There is actually an ongoing discussion about more expressive version strings and version constraints for ASDF 3.4. If you're interested, see asdf-devel or MR !169 on ASDF's Gitlab
<jdz>
etimmons: So, as I understand it, there is currently no way to load two different versions of a system with ASDF?
<jdz>
That kind of makes sens in the absence of first class global environments.
<etimmons>
jdz: Correct, depending on exactly what you mean. You can load v1 of foo, then mess with ASDF's registry so that it finds v2 of foo and then load foo again. In ASDF's mind, only one version of a system is ever loaded (the last one loaded).
waleee has quit [Ping timeout: 268 seconds]
<etimmons>
But the global effects of loading v1 are still around, unless v2 cleans them up. As far as I know, UIOP/ASDF are the only libraries that go through great pains to clean up after previous versions of themselves because it's quite painful
<Guest7430>
I find it strange that version and feature have reversed semantics.
Inline has quit [Remote host closed the connection]
Inline has joined #commonlisp
<Guest7430>
good thing is that since almost no one uses it, and it doesn't really work as people expect, it should be open to being changed.
<lisp123>
etimmons: Thanks!
<Guest7430>
I definitely prefer the :feature feature object.
<lisp123>
I will read up on the ongoing discussion on Gitlab. Its good that there is a minimum version requirement
Inline has quit [Remote host closed the connection]
Inline has joined #commonlisp
<etimmons>
That's quite a bold statement. I know of systems that use both. There's about zero chance that the order of arguments in :version will be changed.
<Guest7430>
well, it SHOULD be changed to at least :minimum-version if that's what it is.
<Guest7430>
that's just bad naming.
<etimmons>
lisp123: Great! You should mostly look at the texinfo changes at the moment. The other changes are a bit old and will be made to match what the texinfo says it should be.
<etimmons>
Guest7430: For ASDF 3.4, we want to extend the language of :version so you can provide more than a minimum version
<Guest7430>
I wonder why asdf complains about leading zeros in version numbers.
<lisp123>
etimmons: Thanks! Will do
<Guest7430>
minimum version and version are two separate things, most likely used for two separate reasons. They probably shouldn't be conflated.
<etimmons>
Although, we won't recommend that most people use that extended grammar!
<etimmons>
Ideally, providing a minimum version is all that folks should need to do. Because developers should always maintain backward compatibility :)
abrantesasf has quit [Read error: Connection reset by peer]
Inline has quit [Ping timeout: 268 seconds]
abrantesasf has joined #commonlisp
<etimmons>
But this is the real world, so a big motivation for adding more than a minimum version is so that you can state known incompatibilities and ASDF can provide useful errors when that happens
<etimmons>
Guest7430: I could see adding another keyword in parallel, but :version and its syntax are here to stay for a while
ec has quit [Ping timeout: 276 seconds]
<Guest7430>
why is "0.03" and invalid version specifier?
<Guest7430>
s/and/an
<etimmons>
Guest7430: I don't think that it's invalid, per se. ASDF just parses it the same as "0.3" And may yell at you for using a non-canonical way of writing it
<jackdaniel>
it is good that if it yells, I'd be surprised if it had considered 0.03 and 0.3 as the same version :)
<Guest7430>
WARNING: Invalid :version specifier "0.03" for component "cl-svg"
<Guest7430>
using NIL instead
<etimmons>
I stand corrected. The manual should probably be updated then. Because it currently reads as if that's valid and a warning may be issued
<Guest7430>
It seems weird to warn on leading zeros as well.
<etimmons>
ASDF's current version scheme treats everything between dots as integers, because most people agree that 0.9 comes before 0.10.
ec has joined #commonlisp
<etimmons>
So the theory behind the warning is that 0.03 is parsed the same as 0.3 and we should make sure the user realizes that. Well, that's what I would assume the theory is if it didn't decide to just treat it as invalid
<etimmons>
But if you really want 0.03 to be distinct from 0.3, ASDF 3.4 should also let you do that by providing a custom version parser and orderer
<Guest7430>
huh, I thought they meant the first 0 before the period by that warning.
<etimmons>
oh, no! a 0 by itself is fine
<etimmons>
(it's not "leading" as it has no other numbers following it)
Inline has joined #commonlisp
<Guest7430>
leading zeros can be before the decimal point, which isn't a decimal point in this case, at least from what you said.
<etimmons>
It is not a decimal point. You can have any number of period characters. Everything between each period is parsed as a non-negative integer.
<Guest7430>
welp, now I know how to use a feature that isn't useful for me since it's not an actual version :)
Josh_2 has joined #commonlisp
<Josh_2>
'ello 'ello
<jackdaniel>
versioning usually goes without floats and dots indeed separate integers, see i.e semantic versioning or how other software is versioned
<jackdaniel>
s/floats/ratios/ for all practical purposes
Inline has quit [Remote host closed the connection]
Inline has joined #commonlisp
<Josh_2>
give it cool names
waleee has joined #commonlisp
Cymew has quit [Ping timeout: 256 seconds]
<lisp123>
Hey, quick question. Does anybody know how to "request" data from Hunchentoot (e.g. receiving JSON from a third party API)?
<Josh_2>
Use dex or drakma
<lisp123>
Josh_2: Hunchentoot :) Unless not possible by HT
<Josh_2>
Well its a HTTP server
<Josh_2>
if you want to make HTTP requests then use Dex (with the use-connection-pool key as nil) or drakma
<lisp123>
So HT can't do it?
<Josh_2>
Not that I'm aware of
<lisp123>
Josh_2: Thanks! That will save me an hour of searching. Seems strange it doesn't have it but I'm no expert on web technologies
Inline has quit [Quit: Leaving]
<Josh_2>
Well the author of Hunchentoot also wrote Drakma
<lisp123>
I just saw :) I'm a lot happier now haha. Ediware is premium stuff ;)
<jackdaniel>
and both have cool names that relate to each other
<Josh_2>
There is Dexador, but you have to use to :use-connection-pool nil or you will occasionally get odd errors
<jackdaniel>
I have a clim application (not published) for managing my hunchentoot acceptors and I've called it Durk :-)
<etimmons>
Josh_2: 'tis sad that Dexador's connection pool is badly broken.
<etimmons>
jackdaniel: nice!
<Josh_2>
I've started using Ningle again
<Josh_2>
Gotta go fast like sanic
<Josh_2>
Its always a wild ride reading through Fukamachiware source code, could really do with heavy use of inlining so that the mammoth functions can be broken up
<etimmons>
That reminds me... I should bug the schannel author about its stability/why it's not on QL.
<etimmons>
The only reason I use Dexador is on Windows.
<etimmons>
If Drakma's Windows story could be improved by using schannel instead of cl+ssl there, it would make my life a lot easier
<etimmons>
At a high-level, it's kind of equivalent to cl+ssl, but uses Windows provided .dlls
<Josh_2>
Nice
<Josh_2>
I wonder if a wrapper over the two could be written
<jackdaniel>
trivial(-haha)-ssl
<Josh_2>
xD
<Josh_2>
I wish all this stuff was in a single library honestly
<Josh_2>
like Ironclad
<etimmons>
That's the "kind of" part. I think cl+ssl provides *a lot* more than schannel. But it does look fairly easy to use if all you want is a TLS enabled socket.
<jackdaniel>
I'm waiting for a sane crypto standard for masses (without corpofeatures)
<Guest7430>
thanks. need to memorize that double colon stuff.
<jackdaniel>
l1sp.org is my goto search engine for clhs and clim symbols
<lisp123>
Josh_2: Hmmm don't quite follow, but don't mind me, its been a while since I looked at JSON
<Josh_2>
You could write a macro like (destructure-hash (|json1| |json2|) <my hash> <body>) which would bind the string values of "json1" and "json2" to those keywords
<lisp123>
Josh_2: Ah! Thanks for sharing, that's a pretty cool idea
vats has joined #commonlisp
<Guest7430>
jackdaniel yeah, i've supposedly written a search for that somewhere that i always forget about. :)
specbot has quit [Remote host closed the connection]
minion has quit [Read error: Connection reset by peer]
minion has joined #commonlisp
specbot has joined #commonlisp
paule32_ has joined #commonlisp
<Guest7430>
oh right, I need something to extract text from websites.
<jackdaniel>
Guest7430: you've mentioned a few times about the gui library you are working on - do you have screenshots?
paule32 has quit [Ping timeout: 245 seconds]
<Guest7430>
yeah, i was going to write one that didn't parse to structs or classes first but got distracted by other stuff.
<Guest7430>
jd: not yet. Still working on cleaning up all the supporting libraries.
<jackdaniel>
I see
frgo_ has joined #commonlisp
john__ has joined #commonlisp
sm2n_ has joined #commonlisp
<Guest7430>
but it's themable. so it should look like whatever you want, with a very simple clean default. I'm not sure if I should change the theming though. right now it uses drawing functions, like squircle, rectangle, and not sure if those should all be under the same thing?
JoshYoshi has joined #commonlisp
JoshYoshi has quit [Remote host closed the connection]
<jackdaniel>
beats me. by themable you mean that you may locally declare a shape or that you may declare a default shape for all buttons?
djuber has joined #commonlisp
stylewarning has quit [Ping timeout: 245 seconds]
<jackdaniel>
(and, i.e, change it as an afterthought without recompiling things)
<Guest7430>
shape for all buttons, or any subclass of button.
<jackdaniel>
I see
<Guest7430>
no recompiling, just everytime it rerenders something.
waleee has quit [Ping timeout: 250 seconds]
<JoshYoshi>
Use clim ;)
<JoshYoshi>
rip this name when am I gonna timeout
Catie has quit [*.net *.split]
cage has quit [*.net *.split]
Josh_2 has quit [*.net *.split]
hhdave has quit [*.net *.split]
frgo has quit [*.net *.split]
lisp123 has quit [*.net *.split]
gaqwas has quit [*.net *.split]
Lord_of_Life has quit [*.net *.split]
Jing has quit [*.net *.split]
X-Scale has quit [*.net *.split]
lagash has quit [*.net *.split]
sm2n has quit [*.net *.split]
djuber` has quit [*.net *.split]
dale has quit [*.net *.split]
scymtym has quit [*.net *.split]
zagura has quit [*.net *.split]
Nilby has quit [*.net *.split]
jcowan has quit [*.net *.split]
Lord_of_Life_ is now known as Lord_of_Life
X-Scale` is now known as X-Scale
zagura__ is now known as zagura
Noisytoot has quit [Ping timeout: 245 seconds]
drmeister has quit [Ping timeout: 245 seconds]
Noisytoot has joined #commonlisp
cage has joined #commonlisp
drmeister has joined #commonlisp
waleee has joined #commonlisp
Jing has joined #commonlisp
jcowan has joined #commonlisp
Nilby has joined #commonlisp
stylewarning has joined #commonlisp
lagash has joined #commonlisp
Catie has joined #commonlisp
dale has joined #commonlisp
lagash has quit [Max SendQ exceeded]
lagash has joined #commonlisp
cosimone has quit [Remote host closed the connection]
cosimone has joined #commonlisp
varjag has joined #commonlisp
vats has quit [Ping timeout: 256 seconds]
waleee has quit [Ping timeout: 250 seconds]
JoshYoshi is now known as Josh_2
<Josh_2>
I am back, stronger than ever
amb007 has quit [Read error: Connection reset by peer]
amb007 has joined #commonlisp
cosimone has quit [Remote host closed the connection]
cosimone has joined #commonlisp
Oladon has quit [Quit: Leaving.]
tyson2 has quit [Remote host closed the connection]
amb007 has quit [Ping timeout: 245 seconds]
amb007 has joined #commonlisp
X-Scale` has joined #commonlisp
X-Scale has quit [Ping timeout: 265 seconds]
X-Scale` is now known as X-Scale
amb007 has quit [Ping timeout: 245 seconds]
amb007 has joined #commonlisp
phireh has joined #commonlisp
<Guest7430>
what are peoples thoughts on the different connotations of name and id?
jealousmonk has joined #commonlisp
Catie has quit [Remote host closed the connection]
Catie has joined #commonlisp
edgar-rft has joined #commonlisp
paule32_ is now known as paule32
Colt has joined #commonlisp
dre has joined #commonlisp
Guest7430 has quit [Quit: Connection closed]
<VincentVega>
Is there no way to see current element index/position of any of the cl-containers iterators?
aartaka has quit [Ping timeout: 260 seconds]
waleee has joined #commonlisp
tyson2 has joined #commonlisp
amb007 has quit [Read error: Connection reset by peer]
amb007 has joined #commonlisp
Bike has quit [Quit: Connection closed]
no-output has joined #commonlisp
<Josh_2>
I have never used cl-containers
<Josh_2>
do you find it useful?
<VincentVega>
Sure, for data structures. I have already used it for a red black tree. Now I am needing an iterator and it gives me the closest thing to what I need as far as I am aware.
<VincentVega>
Eh, I figured I am going to subclass and keep track of the index myself.
beach` has joined #commonlisp
leef1 has joined #commonlisp
<Josh_2>
VincentVega: does cl-containers allow you to abstract away distinctions between various datastructures?
nature has quit [Ping timeout: 256 seconds]
cosimone has quit [Ping timeout: 245 seconds]
beach has quit [Ping timeout: 268 seconds]
<VincentVega>
Josh_2: Yeah, it does that. There was this one diagram depicting the hierarchy. It's pretty extensive, let me see if I can find it.