Codepope's Development Hell

For 2015, I thought I’d shake up the Codescaling site and see if I could get a bit more, well, life into things - catchups have become a chore so I’m going to try to shorten the distance between brain and keyboard. So, from now today I’ll be doing shorter, more regular posts on things which have just come onto my radar, but which should be worth having a look at.

What’s up with Node: So there’s been a fork in Node.js land with the appearance of IO.js. A group of core contributing developers have lost patience with Joyent, the developmental home of Node.js, and have set out to accelerate the development of the Async-JavaScript server side platform. This is the world of open source where people can vote with their time and effort. It’s easy to see both sides of the fork.

Facebook Go: When you develop a lot in Go, you make a lot of libraries and tools in Go. Facebook must be doing plenty because their new Facebook Go repository is full of code, much of it useful utilities for managing HTTP connections, mocking for tests, apps to test libraries like MySQL and MongoDB drivers and so on. Add to your resource list. HTTP2 Go: While we’re talking Go, there’s a HTTP2 library in development by Google’s Brad Fitzpatrick.

Raspberry Pi Model A+ breaks cover: It seems that there’s been a leak on the Pi A+, the compacted version of the Pi less Ethernet, as its being reported. The cut-down Pi now has microSD and a 40 pin GPIO to match the B+. It still lacks the features that made the ODROID/W so interesting – LiPo battery support and real time clock on board. It does retain one thing from the Model A, the question of who’s it actually for.

This article was imported from the original CodeScaling blog

POODLE yips: In what was a glorious nail in the coffin of SSLv3, the POODLE vulnerability(PDF) made sure no one would trust SSLv3 again. The simple fix is to turn off SSLv3 where its used. The bug itself is bad in terms of cryptography, in that it gives an attacker a route to completely decode a stream that has been encrypted, but in practice its not as bad because the attacker has to be a man in the middle to get started.

First of all a catchup on some of my making. I presented a short talk at Oggcamp 2014 on using the 1Sheeld with an Android phone to make experimenting with Arduino much simpler. The 1Sheeld sits on Arduino’s serial ports and using Bluetooth, talks to an Android phone app. The app is able to emulate a whole range of devices, like keypads and LEDs, and sensors, such as gyroscopes and barometers, and act as a proxy to web services like Twitter and Facebook.

Bashed: So the Bash bug is out there and real. These quick notes are still valid. The point is that this hideous feature (really, exporting function definitions through environment variables) is horrid and leaky by design and it’s only this bug in how that feature is implemented thats bringing it to the fore. CGI scripting, Qmail, some SSH and DHCP services are all potentially vulnerable, so patch away but be prepared to patch again because the lid is off this can of worms.

HTML5 getting closer: Over at the W3C the HTML5 spec has got close with the publication of the Proposed Recommendation of HTML5. By the end of the year, HTML5 will, according to the activity statement and barring madness, be a W3C recommendation. Then it’ll be onto the HTML 5.1 track as it sees a Candidate Recommendation out at in early 2015 and wrapping up in a recommendation at the end of 2016.

Node.js synchronously: Node.js is sweet if you can adapt to the asynchronous model of start thing, say what you want to do when its done, do everything else anyway. Good for web request handling but bleh for trying to emulate a shellscript. Turns out that in Node.js 0.12 (coming soon? anyone? Bueller?) we get synchronous child processes to now you can run that curl or find or whatever and just wait till its returned with its results.