TLDR;

rkyv vulnerability in transitive dependency via rust_decimal 1.39.0. rust_decimal is at latest version and hasn’t updated to rkyv 0.8.x yet. Will be fixed when rust_decimal updates.

https://github.com/paupino/rust-decimal/issues/766

Cool, but now what? Do I need to wait for a fix (it’s a new year, people might still celebrating lol) Do I need to open pr just to add reason to audit.toml?

I ended up creating audit.toml with that ignore entry, since we are not even using rkyv and it is optional dependency. But as I am writing this I already see that patch to rkyv was merged, so I probably won’t need any audit.toml.

And T.I.L is:

• cargo audit cargo install cargo-audit is required for that. We have cargo audit step in CI to show vulnerabilities. Awesome tool
• there is such thing as optional features in dependecies

[dependencies]
rkyv = { default-features = false, features = ["size_32", "std"], optional = true, version = "0.7.42" }

• cargo tree Display a dependency graph

  • cargo tree -p rust_decimal -e features This will show you all dependecies for the package, and that packach will be a root (-p) and -e what kind of dependencies to show: features, build, all, etc.

  • cargo tree -i rust_decimal. Inverts the tree and focuses on given package. It will show you if you have crate installed. In my case, I would have something like:

rust_decimal v1.39.0
├── my_proj v0.19.0 (path/path/path)
│   └── more path entries
└── more entries (/path/path)

and if I try cargo tree -i rkyv - since I don’t have it installed directly - no root to display 😊

• and rust community is awesome and helpful, I spent only couple minutes to find the problem, and the issue was already created and people were addressing it only after couple hours since vulnerability was reported. Nice!!

There, I said it.

Value Object

Probably the simplest pattern is Value Object - PORO(plain old ruby object) that provides methods that return values:

class User
  def initialize (full_name:, email:)
    @full_name = full_name
    @email = email
  end

  attr_reader :full_name, :email

  def first_name
    full_name.split(" ").first
  end

  def last_name
    full_name.split(" ").last
  end
end

Service

Service object is responsible for doing only one thing:

class Greeter
  def self.call(name, title)
    "Welcome back #{title}. #{name}!"
  end
end

Of course, in reallity, you will have more complicated logic, but you want to make your service responsible for one thing only (single responsibility rule).

Decorator

Honestly, I am confusing decorators and presenters. I found this explanation and example here:

The decorator pattern is similar to the presenter, but instead of adding additional logic, it alters the original class’s behavior.

We have the Post model that provides a content attribute that contains the post’s content. On the single post page, we would like to render the full content, but on the list, we would like to render just a few words of it:

class PostListDecorator < SimpleDelegator
  def content
    model.content.truncate(50)
  end

  def self.decorate(posts)
    posts.map { |post| new(post) }
  end

  private

  def model
    __getobj__
  end
end

@posts = Post.all
@posts = PostListDecorator.decorate(@posts)

Presenter

This pattern is used when you need to isolate some logic and is usually (not always) used in views.

class UserPresenter
  def initialize(user)
    @user = user
  end

  def role
    if @user.admin?
      'Administrator'
    elsif @user.signed_in
      'User'
    else
      'Guest'
    end
  end
end

Policy Objects

These objects are responsible for permissions, policies etc. Examples of gems will be cancan, pundit

class UserAccoutnPolicy
  def initialize(user, account)
    @user = user
    @account = account
  end

  def access?
    admin? && @account.user == @user
  end

  def close?
    access? && @account.active? && @user.balance.positive?
  end

  private

  def admin?
    @user.role == 'admin'
  end
end

or another example

class BankTransferPolicy
  def self.allowed?(user, recipient, amount)
    user.account_balance >= amount &&
      user.transfers_enabled &&
      user != recipient &&
      amount.positive?
  end
end

Builder

Again, nice example with file parsers from long live ruby

The builder pattern is often also called an adapter. The pattern’s main purpose is to provide a simple way of returning a given class or instance depending on the case. If you are parsing files to get their contents you can create the following builder:

class FileParser
  def self.build(file_path)
    case File.extname(file_path)
      when '.csv' then CsvFileParser.new(file_path)
      when '.xls' then XlsFileParser.new(file_path)
      else
        raise(UnknownFileFormat)
      end
  end
end

class BaseParser
  def initialize(file_path)
    @file_path = file_path
  end
end

class CsvFileParser < BaseParser
  def rows
    # parse rows
  end
end

class XlsFileParser < BaseParser
  def rows
    # parse rows
  end
end

And usage: you can access the rows without worrying about selecting a good class that will be able to parse the given format:

parser = FileParser.build(file_path)
rows = parser.rows

Null object

Nobody likes to deal with nils and having those extra guards and defensive style. If you expect a user in your code, and user is not created (for example guest), rather than check for nil create GuestUser

class GuestUser
  def name
    'Guest'
  end

  def posts
    []
  end
end

Now if you need to perform something with user you don’t need to check for nils and can treat user as it always exists.

user = current_user || GuestUser.new
puts "Welcome #{user.name}"
puts "Number of posts created #{user.posts.size}"

Afterword

Patterns solve problems but when used incorrectly they bring unneeded complexity to your codebase.

But have you ever noticed that in those plannings, towards the deadline, pressure builds, and when we discuss release plans, steps, etc, at some point eng manager asks if we will be ready to release it next week.

And somewhere in the middle of all the conversation noise, you hear your teammates essentially saying: “Sure, it’ll be ready next week to release,assuming we address the issues, performance, and correctness.”

Politically - everyone’s happy. Legally - as always there is fine print - no promises were made.

We’ll release when it’s done.

Everyone leaves the meeting happy.

Then we have followup later that week in the tight engineering circle, talking about unrealistic dates.

We don’t like cutting corners - but we are forced to. Deadlines are draining..

And here’s the thing:

We want to be proud of our work. But things happen - on-calls, reviews, production issues, priority shifts - and all of that skews estimates.

Management hears the estimates, but they’re under pressure from above, so that pressure gets passed straight down to the team.

We don’t want to deliver and then roll back. We don’t want to ship something we are not confident in.

So the uncomfortable questions remain:

Is the deadline really necessary? Can we allow ourselves to miss a cycle and actually deliver quality work? And do we really need all those extra features that complicate the core project in the first place?

…. Side thought, I saw a post about corporate “new year” letters. You know the ones.

Those essensially say: “go recharge during your holiday, so we can drain your energy efficiently for the rest of the year”

Lana, biocell.

It was a fun project, never wrote games before. Ok not quite true, I wrote one game in Delphi in 2000 🤦‍♀️ That was loooooong time ago. Maybe I need to reimplement that game in javascript.

Game is written in JavaScript and Jest is used for tests. It was funny how I struggle at the beginning to setup the environment. Missing those times when you had plain javascript and index.html. Double click on index.html and see the result. This time I wanted to use Jest and write tests. And write modules. And it didn’t work smoothly from the first try.

I used

  module.exports.Tetris = Tetris;

and

  const { Tetris } = require('./Tetris');

The reason why I used require but not exports and imports - jest worked with require statements right out of the box. And I didn’t want to spend much time figuring out how to setup webpack and babel or whatever is needed to setup the project. Fast and simple please. And TDD ✅.

And of course, require statements don’t work in browser. browserify came to the rescue. In simple words it adds require and module functionality to bundled file.

The next issue was: if you simply double click index.html with bundled js files - you will receive the following error:

To fight that one you will need some server running. I used ruby oneliner

ruby -rwebrick -e'WEBrick::HTTPServer.new(:Port => 9090, :DocumentRoot => Dir.pwd).start'

After that, you have a nice localhost:9090 up and running.

That’s pretty much it for environment setup. Source code is available on github.

Fun with Flags 😄 Tetris

Guys were discussing interviews and different processes that are used by companies.

I liked what user YCode wrote:

...

Keep a daily journal of what you work on. Nothing fancy, just stop by once a day religiously and add a few notes on what you did, what meetings you attended, who you spoke with, etc...

Save your evaluations and especially any award packages you or your team might get submitted for. At least where I work both are your supervisor's attempt to make you look as good as possible.

Then, when you're job hunting review your notes and bullets and collect the ones that sound the best and perhaps ones that have numbers assigned to them (size, savings, productivity, etc..)

...

But also it’s helpful as a reminder for what we are doing and what we have achieved. Sprint notes are gone when you are changing company and will be too detailed to re-read, but a good old notebook (digital or real) is good to have. I will try to build a new habit.

The GitHub Arctic Code Vault is a data repository preserved in the Arctic World Archive (AWA), a very-long-term archival facility 250 meters deep in the permafrost of an Arctic mountain. The archive is located in a decommissioned coal mine in the Svalbard archipelago, closer to the North Pole than the Arctic Circle. GitHub will capture a snapshot of every active public repository on 02/02/2020 and preserve that data in the Arctic Code Vault.

Because I didn’t.

I noticed a new badge on my github profile and was surprised to learn that this blog was stored in Arctic Code Vault. Something I leave for future generations 😅. That made me happy!

Today T.I.L. became dark. 🎨

• obiously you need to create new directory
• run bundle init to generate new Gemfile
• add minitest related gems:

group :test do
  gem 'minitest'
  gem 'minitest-reporters'
  gem 'minitest-focus'
end

• bundle install
• create test file and add

require 'minitest/autorun'
require 'minitest/reporters'
require 'minitest/focus'

Minitest::Reporters.use! [Minitest::Reporters::SpecReporter.new]

Reporters add nice formatting to your output. Personaly, I prefer spec-like output, so I used Minitest::Reporters::SpecReporter.

The DefaultReporter gives you the following output:

The SpecReporter gives you the following output:

Run single test

Nice bonus: focus. You just need to add focus before method or it. Source

require 'minitest/autorun'
require 'minitest/focus'

class MyTest < MiniTest::Unit::TestCase
  def test_unrelated; ...; end       # will NOT run

  focus def test_method2; ...;  end  # will run (direct--preferred)

  focus
  def test_method; ...;  end         # will run (indirect)

  def test_method_edgecase; ...; end # will NOT run
end

# or, with spec-style:

describe 'MyTest2' do
  focus; it 'does something'       do pass end
  focus  it('does something else') {  pass   } # block precedence needs {}
end

array = []
#or
array = Array.new

More from official doc here

And it usually works, because, often I don’t need nested arrays, I initiate array and I can start doing #push, #[], etc.

But the problem is when you need to create

array = [[]]

I expected that this is enough for adding as many arrays to outer array as i want. To my surprise(again 🤦‍♀), when I wanted to add second element, I saw NoMethodError:

2.7.0 :003 > array=[]
2.7.0 :004 > array[0]=1
2.7.0 :005 > array[2]=3        <- dynamically can add elements
2.7.0 :006 > array
 => [1, nil, 3]
2.7.0 :007 > array2d=[[]]
2.7.0 :008 > array2d[0][0] = 0
2.7.0 :009 > array2d[0][1] = 0
2.7.0 :010 > array2d
 => [[0, 0]]
2.7.0 :011 > array2d[1][0] = 0            <- fail to add second array, obviously, because it doesnt exist
Traceback (most recent call last):
        4: from .rvm/rubies/ruby-2.7.0/bin/irb:23:in `<main>'
        3: from .rvm/rubies/ruby-2.7.0/bin/irb:23:in `load'
        2: from .rvm/rubies/ruby-2.7.0/lib/ruby/gems/2.7.0/gems/irb-1.2.1/exe/irb:11:in `<top (required)>'
        1: from (irb):11
NoMethodError (undefined method `[]=' for nil:NilClass)
2.7.0 :012 >

We failed to add second array, obviously, because it doesn’t exist. array2d is [[]], which means when you call array[1] it will return nil, and on nil I was trying to call []. And that’s why NoMethodError

Ok, so we know the problem. I need to initiate array of arrays with right amount of arrays inside. Official doc shows how it can be done:

Array.new(3) { Array.new(3) }  # please, see the block
Array.new(3, Array.new(3)) # no block was passed

what happens here, let’s break down:

2.7.0 :012 > a = Array.new(3) { Array.new(3) }              # block is given
2.7.0 :013 > a
 => [[nil, nil, nil], [nil, nil, nil], [nil, nil, nil]]
2.7.0 :014 > a[0][1]=2
2.7.0 :015 > a
 => [[nil, 2, nil], [nil, nil, nil], [nil, nil, nil]]      # as expected

2.7.0 :016 > b=Array.new(3, Array.new(3))                  # default parameter is given
2.7.0 :017 > b
 => [[nil, nil, nil], [nil, nil, nil], [nil, nil, nil]]
2.7.0 :018 > b[0][1]=2
2.7.0 :019 > b
 => [[nil, 2, nil], [nil, 2, nil], [nil, 2, nil]]          # HA, and here we passed by reference

As you can see, b was array that was created with default parameter, and array is passed by reference. Which means b=Array.new(3, Array.new(5)), Array.new(5) was evaluated once, and same object was passed to each element of outer element. To prove the point let’s check object_ids:

# a is created with block given a = Array.new(3) { Array.new(3) }
2.7.0 :020 > a.map(&:object_id)
 => [180, 200, 220]

# b is created with default value b=Array.new(3, Array.new(3))
2.7.0 :023 > b.map(&:object_id)
 => [240, 240, 240]
2.7.0 :024 >

From official docs:

Note that the second argument populates the array with references to the same object. Therefore, it is only recommended in cases when you need to instantiate arrays with natively immutable objects such as Symbols, numbers, true or false.

To create an array with separate objects a block can be passed instead. This method is safe to use with mutable objects such as hashes, strings or other arrays:

Alternatively, I could create outer array, and then use #push for pre-created internal arrays:

result = []
internal_array = [1,2,3,4]
result.push(internal_array)
internal_array = [2,3,1,2]
result.push(internal_array)

(repetition here just to show the point)

results:

2.7.0 :026 > result = []
2.7.0 :027 >
2.7.0 :028 > internal_array = [1,2,3,4]
2.7.0 :029 > result.push(internal_array)
 => [[1, 2, 3, 4]]
2.7.0 :030 > internal_array = [2,3,1,2]
2.7.0 :031 > result
 => [[1, 2, 3, 4]]
2.7.0 :032 > result.push(internal_array)
 => [[1, 2, 3, 4], [2, 3, 1, 2]]
2.7.0 :033 >

In addition to arrays, you may want to check about strings too: references in ruby