I wonder if this argument against open maps has ever been discussed before https://twitter.com/chris__martin/status/1075213406582571010

That sounds like that would deserver to be a completely different function, or you'd at least have to opt in to get the credit card number

I'd have thought the moment you start handling sensitive data, you need to bring a whole new level of rigour to the entire program

the “solution” is this: don’t operate on the whole map, use select-keys to pick out the parts that are relevant for that particular context

then you can add keys freely without worrying about stuff like that

the funny thing about this argument is that in statically typed languages, println-like functions accept anything as input, so in the scenario he describes the compiler will basically break all legitimate usages but not the dangerous one

ha!

@leonoel not sure what you mean?

you can't have a "generic" toString a -> string function in languages like ocaml/haskell

oh!

how do you log anything

even with records?

I vaguely remember you make the type printable, and in it you define what it prints

e.g. in ocaml you do

# type t = A|B;;
type t = A | B
# Format.printf "%a" (fun fmt -> function | A -> Format.fprintf fmt "a" | B -> Format.fprintf fmt "b") A;;
a

right but if the println was already there, the type was likely to implement some kind of stringifiable protocol

I guess but then it would only print the bits it knew about

in haskell you have a showable typeclass

which I think the GHC compiler can auto-implement for you

but letting the compiler do some auto code generation is different than saying there exists println like functions that accept anything as input & break type safety

well this is exciting

I'm learning new things

\o/

Anyone here just write math in APL notation instead of standard math notation?

so in a web framework, if you switch on logging of requests, say, what happens

supposedly the request would be a closed record, so it'll have a printer defined for that type

so for each set of query-params/form-paramse etc, you define the type, and then if you want it to log, you implement Show

I think that tweet didn't make a good point TBH, you can still print the return value of whatever you return and if you rely on the compiler to generate your printer for you (which haskellers do a lot, ocaml is starting to go in that direction too with ppx) it won't make any difference in clojure vs haskell/ocaml

which I guess may be what @leonoel was saying now that I read it again :)

yes but thanks for this precision, actually I read that tweet from a scala mindset !

I don't know anything about scala :)

it's a format for microtonal musical scales

it's really great

there's a library of about 3000 scales it provides

haha

http://www.huygens-fokker.org/scala/

it also means "stairs" in italian so I guess I do know something about it

haha

Honestly that tweet is the reverse of what strengthening a promise is to me.

It’s breaking a promise.

I promised I would return a name and (implicitly) only a name.

Yeah, I think that's what I was kind of getting at. Like the domain has completely changed, this is now a completely new kind of thing

yep

even if you were returning {:name foo} and now you're returning {:name foo :credit-card bar}?

you can do this kind of stuff (scope expansion), but you do it in parameter types, not return types

Yeah - in my head before it might have been in a user namespace, now it's in a finance namespace, and it's a whole different kettle of fish

oh makese sense

https://wiki.php.net/rfc/covariant-returns-and-contravariant-parameters <- example 🙂

so you're saying it would be just a new function

I'd at least make getting the extra data opt in

i.e. (get-user {:user-id <blah> :include-financial-info? true}

I think

but yeah, it feels more like a new function entirely

I wonder if a stronger argument along the same lines of the original tweet could be constructed though

Like is there a realistic case where you'd want an additive (stronger promise) change to be breaking

On the topic of printing credit card numbers, I think we should stop using String for representing those. Same for other secrets. Instead create a SecureString wrapper, which: • has a opaque pr representation by default • cannot be =ed against a string: you are forced to explicitly use a constant-time equality predicate

@danieleneal sensitive information aside, do you think it would be okay to start returning, eg age or favourite colour from a function in addition?

I like the concept of SecureString but worry that people will expect more security from it than it actually delivers. The expectation of magical protection is a real risk, even for security professionals.

especially when it’s just a wrapper

then OpaqueString it is 🙂

Yay! That fixes it!

Actually, it really does. Names matter.

Isn’t this why many places use char[] rather than Strings?

Anyone have experience with Akka from Scala-land? I’m debugging a legacy app and have some noob questions

hello guys! what's the options to go mobile with Clojure, besides React Native via re-natal?

react-native is the best bet imo. There's a few options within that - @bhauman has a brand new hot off the press thing which might be worth a look if you're starting fresh https://github.com/bhauman/react-native-figwheel-bridge. I use expo which means I can avoid the xcode/android studio setup

I'm having a good amount of fun with fennel, but my inability to write decent macros is annoying

(Partially (mostly) my stupidity probably, but also maybe because the docs are eh on that)