<martinium>
I am new to pony. how can I perform an http GET request and parse json if the response returns a json array?
kiswe has joined #ponylang
kiswe has left #ponylang [#ponylang]
dipin has joined #ponylang
dipin has quit [Quit: dipin]
tscho has quit [Read error: Connection reset by peer]
tscho has joined #ponylang
bimawa1 has quit [Read error: Connection reset by peer]
bimawa1 has joined #ponylang
_whitelogger has joined #ponylang
<SeanTAllen>
there's an http client that is part of the standard library and a json parsing library (although i'm not a fan of the json library) martinium
bimawa has joined #ponylang
3NAABN487 has quit [Ping timeout: 255 seconds]
dipin has joined #ponylang
dipin has quit [Quit: dipin]
endformationage has quit [Ping timeout: 248 seconds]
kulibali has quit [Ping timeout: 248 seconds]
user10032 has joined #ponylang
sarna has joined #ponylang
user10032 has quit [Quit: Leaving]
samuell has joined #ponylang
samuell has quit [Remote host closed the connection]
samuell has joined #ponylang
sarna has quit [Quit: Connection closed for inactivity]
ShalokShalom_ has joined #ponylang
ShalokShalom has quit [Ping timeout: 240 seconds]
ShalokShalom_ is now known as ShalokShalom
_clint has quit [Read error: Connection reset by peer]
_clint has joined #ponylang
dipin has joined #ponylang
_clint_ has joined #ponylang
_clint has quit [Ping timeout: 252 seconds]
jemc has joined #ponylang
_clint_ has quit [Read error: Connection reset by peer]
_clint has joined #ponylang
Praetonus has quit [Quit: Leaving]
_clint has quit [Read error: Connection reset by peer]
_clint has joined #ponylang
endformationage has joined #ponylang
aturley has quit [Quit: aturley]
codec_ has joined #ponylang
aturley has joined #ponylang
codec_ has quit [Quit: Page closed]
aturley has quit [Quit: aturley]
nisanharamati has joined #ponylang
TheNet has joined #ponylang
user10032 has joined #ponylang
aturley has joined #ponylang
_clint has quit [Ping timeout: 252 seconds]
clint_ has joined #ponylang
benq has joined #ponylang
dipin has quit [Quit: dipin]
benq has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<SeanTAllen>
And yes, over at Wallaroo Labs, we've found the performance characteristics to be quite nice
<martinium>
I am going to read up on capabilities-secure but does this mean that good code will avoid the usual weaknesses that C code might produce like buffer overflows etc that can be exploited maliciously?
<SeanTAllen>
That's not really what capabilities security is about.
<SeanTAllen>
Capabilities security is about having to have "an unforgeable token" in order to do something.
<SeanTAllen>
So for example, the main part of a pony programmer has give a token to other actors in order for them to be able to open a socket.
<SeanTAllen>
unless they do it via FFI. but you can control which packages are allowed to use FFI.
<SeanTAllen>
buffer overflows and what not, thats different
<SeanTAllen>
although the parts of Pony that arent using FFI also avoid such issues
<SeanTAllen>
The first parameter, is the main programmer given a valid token to allow a socket to be opened
<martinium>
interesting
<martinium>
I have a lot to learn
<martinium>
do you know of any examples working with http get requests that return json? I would like to see how it is done in Pony so I can begin grounding myself
<SeanTAllen>
there might be something in the examples. i havent done much with that. jemc might have a better answer.
<martinium>
yeah I'll definitely search
<SeanTAllen>
i haven't used the http stuff other than to look at performance problems in the http server (it wasnt written for performance) and i played around with the json parser once (im not a fan, but its a place to start).
<SeanTAllen>
i know many people have done stuff with it, im just not sure where it all lives.
<martinium>
cool. Hard to track this stuff down
<martinium>
SeanTAllen, the wallaroo product looks impressive. The performance is due to Pony's features?
<jemc>
I just wanted to make a note about your lambda inference point
<codec_>
please do
<jemc>
this is actually a feature I added recently to the language, because I agree that it's really important for usability as the signature gets more complex
<jemc>
so your "does not compile" example actually would work with a small adjustment to the syntax:
<codec_>
is this just the : that got removed or am I missing something ?
<jemc>
yes, the colon gets removed, but the params still need parentheses around them
<codec_>
because I just realized the : in the first example is a typo
<codec_>
oh I see
<codec_>
did your modification was merge in the compiler?
<jemc>
unrelated, but the other modification I made to youe example line was adding binary operator parentheses in the expression in the body because I think otherwise the compiler will yell at you about operator precedence not being supported for mixed operators
<codec_>
compile just fine, I will submit a PR for my article then, I am not keen on leaving wrong statement in it
<codec_>
especially that since the tutorial is not very complete it may induce other people in error
<codec_>
anyway, is there more information available about the capabilites security ?
<jemc>
so, it should be made clear that this is just Pony's take capabilities security, which is an established field of computer science research, so I can find you some links that talk about the goal and the benefits, but they're likely to be prior work outside of Pony
<codec_>
why not but I am not searching the how but more the why
<codec_>
The way it is explained in the tutorial make sense for concurrency
<codec_>
but I don't see how it translate to something like file system or network for example
<codec_>
well in fact the how to deal with it is interesting to
<codec_>
because at first glance, it seems rather limiting, let's say for debugging purpose I want to write some text into a file
<codec_>
In a class or actor that does not have a reference to Env
<codec_>
Should I modifiy my program to pass the Env all the way down to my actor/class while it is only usefull temporary for debugging purpose?
<jemc>
yeah, I was definitely referring to the "why" when I mentioned outside work. this seems to be a reasonable place to start for learning about the "why": http://www.erights.org/elib/capability/overview.html
<jemc>
regarding practicality with respect to debugging - yeah, that's definitely a concern - you'll find that most pony programmers will bend the rules on capabilities security for debugging purposes, using FFI directly, or an "unsafe" package that wraps FFI calls
<jemc>
for example, the standard library has a `debug` package that can be used to log to stdout for debugging without passing the `Env` or `StdStream` around
<jemc>
with the idea being that leaving your `debug` statements in the file is an easy-to-grep-for code smell
<codec_>
but what the rationale to avoid actor to have access to a bunch of things by default?
<codec_>
because I could pass the Env to any function to make sure I can do all I want
<codec_>
this would be tedious and need a lot of boilerplate but it should work (i think)
<codec_>
so what are the benefits of such restrictions ?
<jemc>
in short, the rationale is based on the principle of least privilege
<jemc>
it *would be* tedious to pass `Env` privileges around to all the actors in your program, but in practice this rarely happens, because the tedium makes folks rethink their design and separate concerns a bit better
<jemc>
it's usually possible to isolate privileges to just a few types/actors in your program, and have the other types/actors make use of those appropriately
<jemc>
and the psychological pressure exerted by the code smell of passing privileges around is part of what can drive better-compartmentalized designs
samuell has quit [Quit: Leaving]
<codec_>
thanks
<codec_>
your explanation worth being in the tutorial I think
benq has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<slfritchie>
Hm, I suppose a more actor'ish approach would be to have the a DebugActor actor that received messages (string, or string + what-channel-or-file-descriptor-identifier-I-might-want-to-scribble-to). Nobody who sends string/string+whatever to DebugActor would need `env` also.
user10032 has quit [Quit: Leaving]
codec_ has quit [Ping timeout: 260 seconds]
<nisanharamati>
but then they'd need a tag to the DebugActor
<jemc>
yeah, so not necessarily good for the debugging concern, but other than that it's a good example of principle of least privilege
<jemc>
pass around an `Env` or `AmbientAuth` everywhere and all those actors can do *anything*
<jemc>
pass around a tag to your logging actor, and those actors with access to it can just log things and nothing more
<jemc>
by the way, the `logger` package in the standard library does pretty much exactly that