codingrobots

[codingrobots]

This is an awesome 15-min $15 logotype created for us by http://www.vonglitschka.com/5MinuteLogo/ — “The Original Brand Parody Service that Creates Craptacular Logos forCheap-Ass Clients Worldwide.”

[codingrobots]

[codingrobots]

“There are lots of security-related things to keep in mind when writing a web application, as the Web is a place full of danger: cross-site scripting (XSS), cross-site request forgery (CSRF), clickjacking, brute forcing, spam and so on. Go gets many things right by default: for example, templates from the standard library make it hard to accidentally introduce XSS vulnerabilities. But what about other attacks? Fortunately, there are a few open source Go packages that can help us.”

[codingrobots]

Happy to announce our latest project, StableLib! Here’s the announcement post: https://stablelib.com/blog/stablelib-released/

[codingrobots]

How to start writing a journal on your Mac with Mémoires.

[codingrobots]

Mémoires 4.5 released!

Announcement: http://www.codingrobots.com/blog/memoires-45/

Download here: http://www.codingrobots.com/memoires/

[codingrobots]

Journalite supports lightweight visual text formatting, which is represented internally (and, in the next version, exportable to) as a simple plain-text format, previously known as Markdown. From now on, we will use the term Common Markup for this formatting language.

[codingrobots]

By popular request, we now have a 88x31 button for Mémoires that you can put on your homepage! Get it here.

[codingrobots]

Pushed this change today to captcha package for Go to prevent a weakness:

Generate captcha representations deterministically.

WARNING: introduces API incompatibility!

This package generates captcha representations on-the-fly; for instance, if captcha solution was "123456", every call to NewImage() using this sequence of digits would generate a different random image containing "123456"; similarly, NewAudio() would generate a different audio pronouncing the same sequence: 1, 2, 3, 4, 5, 6.

If a user, instead of storing generated outputs, exposes this functionality from their server, which is the default and recommended behaviour, an attacker could try loading the same image or audio over and over again in attempt to arrive at the most correct optical/voice recognition result.

Instead of using a global non-deterministic pseudorandom number generator to distort images and audio, this commit introduces a deterministic PRNG for each image/audio. This PRNG uses a combination of a global secret key (generated once during initialization from a system CSPRNG) and captcha id and solution to produce pseudorandom numbers for each representation deterministically. Thus, calling NewImage() with the same captcha id and solution at different times will result in the same image (ditto for NewAudio).

To make results unique not only for different solutions, but also for ids, these incompatible changes to public API have been introduced:

NewImage and NewAudio changed from:

func NewImage(digits []byte, width, height int) *Image func NewAudio(digits []byte, lang string) *Audio

to:

func NewImage(id string, digits []byte, width, height int) *Image func NewAudio(id string, digits []byte, lang string) *Audio

That is, they now accept an additional captcha `id` argument. No other interfaces changed.

Described changes also improved performance of generating captchas.

[codingrobots]

Our first product for Windows in a few years. The easy-to-use diary app. (I'll write about the "cutting-edge technologies" inside it later in this blog.)

[codingrobots]

Getting rid of meaningless words.

[codingrobots]

I hate these companies. They make the world worse. We should demotivate their employees to make them go away.

[codingrobots]

Mémoires file sizes over time.

[codingrobots]

Unbelievably fast

Interesting fact: some people didn't believe that I Write Like actually analysed texts because it worked too fast. I had to explain the algorithm to them.

In the next version I plan to introduce a slight artificial delay between clicking "Analyze" button and showing results, with some kind of load indicator in-between. Seriously.