All Unkept
Posted in: Python, Software development  —  12 February 2010

Mercurial tree visualisation

I discovered hgview, and wondered whether it could make better sense of my Django repository than hgk.

Which of these two would you rather look at?

hgk:

hgk output

hgview:

hgk output

Comments §

§ On 12 February 2010, masklinn wrote: 853
And what's the graphlog view? Is it more like hgk or more like hgview?

btw your crsf protection stuff also requires cookies. That's vile.

§ On 12 February 2010, luke wrote: 854

@masklinn:

I don't know what you mean by graphlog. Here is a complete screen shot:

http://lukeplant.me.uk/uploads/hgview-shot2.png

I'm sorry you don't like the CSRF protection in Django. The rationale behind the implementation is here: http://code.djangoproject.com/wiki/CsrfProtection

We did a lot of research and thrashed it out for ages on the mailing list, and couldn't find a better solution. If you have one, please feel free to propose it on the django-devs list.


§ On 12 February 2010, masklinn wrote: 855

I don't know what you mean by graphlog.

Mercurial's graphlog extension, the hg glog command (or hg log -G) which creates an ascii revision graph in your terminal. I'd assume hgk uses the same algorithm, but that's not certain, so I'd like to see how it compares with hgview

I'm sorry you don't like the CSRF protection in Django.

Well it's not that I don't like it as much as it doesn't like me: I saw the warning about javascript, but javascript is activated in my Camino so I didn't worry to much, and then it rejected me. Repeatedly. Which I could only link to my pretty systematic refusal of cookies.


§ On 13 February 2010, luke wrote: 856

Mercurial's graphlog extension...

hgview seems to be very similar to hg glog. hgk seems to use some other sorting algorithm altogether.

Well it's not that I don't like it as much as it doesn't like me

Oops, sorry, I was thinking that you were referring to my Django CSRF work for some reason, not the CSRF protection on this blog, which I had completely forgotten about.

I do implement CSRF protection on this blog using cookies. My reasoning is basically the same as for Django, though. I don't know of an adequate solution that doesn't use cookies, apart from using AJAX for every POST, which I'd like to avoid.

If you have cookies disabled, the reason that you might not have this problem with other sites is that most haven't given a thought to CSRF, and many have flawed solutions.


§ On 13 February 2010, masklinn wrote: 857

hgview seems to be very similar to hg glog. hgk seems to use some other sorting algorithm altogether.

how very bizarre

I do implement CSRF protection on this blog using cookies. My reasoning is basically the same as for Django, though. I don't know of an adequate solution that doesn't use cookies, apart from using AJAX for every POST, which I'd like to avoid.

I don't mind it much, it's just that there's a warning that javascript needs to be enabled to go past the spamcheck, but none that cookies be enabled to go past the CSRF.

I added a warning about the cookies now, thanks! — luke

Add comment

Format:

  • Javascript has to be on to get past my spam protection, and cookies, and there is a delay, sorry for any inconvenience!
  • I reserve the right to moderate comments.