Clojurians Log v2

👋

Morning

Good Morning!

Good morning!

Morning

Morning!

morning

and the ice does look ideal for ice skating @pez

Morning!

me: why is emacs getting so slow? htop:

23GB... something, somewhere, has gone horribly wrong

I have this too, once in a while

Restarting helps, I never had the motivation to debug this

@pez when the time allows it I need to go to Skandinavia just of ice lake skating

You can use profile start/end and report to see what’s going on

It is pretty rare with that kind of ice, though. I live by a lake since 21 years and have seen it happen three times. And in the archipelago it has to be even less common. But I’ll holler your way if I think it is about to happen. 😃

maybe a sub-process getting out of control? (this is one reason I usually don't use jack-in)

So, hypothetically speaking. Let’s imagine a company uses friend , which is somewhat retired. Then it comes to the company’s attention that there is a CVE on friend, because a lib that friend depends on has a vulnerability. There is a newer version of the vulnerable lib available, which works. Now, do you 1. exclude said library in your project.clj and add an explicit dep on the newer version of said libary 2. beg cemerick to issue a new version of friend with a version bump on the dep 3. finally get clj-commons to take on friend and have them version bump the dep 4. rewrite to buddy and hope for the best 5. say f*ck it, the vulnerability is not likely to hit us.

https://nvd.nist.gov/vuln/detail/CVE-2015-0886

4

friends don't let friends use friend

(half kidding, as I don't know friend very well, it seemed too complex for me to ever get started with, but I would not invest that much energy in a lib that was abandoned for too long)

@borkdude that’s probabily the main cause when it happened to me. E.g. having a repl producing 1M of output can easily freez your emacs.

#1 and #2 are basically the same. Somebody would need to to a propery assesmenton the impact and verify the bug is actually fixed with the version bumb.

You could also re-write just the credential fn to use an updated BCrypt lib. That fn is quite simple

Not familiar with that case but from what I read in the CVE the dependency bump should be stract forward.

@josh604 that’s actually not a bad idea. But when it comes to crypto or security, you better used some canned libraries. Also because due dilligence in corporate environments.

Saying that “#4” might be the best option in the long run.

(or #3)

The reason this came up, is that we ran lein-nvd on our backend, and it showed, well more than three cve’s, so there is some work ahead.

Well, Friend is just calling a fn in some Java lib to verify the password and hash, and returning a map or nil https://github.com/cemerick/friend/blob/master/src/cemerick/friend/credentials.clj#L20

IIRC Buddy is more pluggable in that it has a separate hashing library which plugs into the auth stuff

(btw I used a patched version with this PR https://github.com/rm-hull/lein-nvd/pull/43, the patch is quite neat as it gives you not only the vulnerabilities, but the libs that includes them)

@josh604 nice. Pluggability for the win!

You can also use all of these hashing functions from babashka via https://github.com/babashka/pod-babashka-buddy

Nice “plug” 😉

Cider has an option of clearing it’s buffers past a certain threshold. Would likely mitigate this

@hkjels I will dig into that