DEV Community: nigel447

Some notes on Dart package encapsulation

nigel447 — Tue, 28 May 2024 14:11:48 +0000

This is a short note showing how I use dart package encapsulation to manage the dependency in a dart/flutter application.

If you are new to creating your own dart package there is a great post here on dev to help u get started How to Create Dart Packages in Flutter: A Step-by-Step Guide

Dependencies are always an issue and need to be managed carefully to avoid cycles among other things, Golang helps by throwing a compilation error if u have any Cyclic dependencies in your code. Creating acyclic dependency trees(graphs) preferably Directed DAG is what you want, you can research the details if u r interested.

Say you have a project with a few packages like below

Here I have a rest_client package among others, the rest_client package will use other dependency packages like Dio.

I want to use Dio response types in the main code.

To keep the dependency tree clean I dont want to import Dio types in the main source as well as the rest_client package, so I export Dio from the rest_client package as so

library rest_client;

export 'package:dio/dio.dart';

In the main source code I import any needed Dio artifact from my rest_client package like

import 'package:rest_client/rest_client.dart' as transport;
class FreeAuthService  {

  final transport.Dio _dio = transport.Dio();
}

now I am free to encapsulate all my related http transport code in the rest_client package and just return the Dio responses into the main source code.

Here are some minor details

packages are imported in pubspec like

  rest_client:
    path: packages/rest_client

in the package directory source you need a top level file where you export the package dependencies you wish to expose like

library rest_client;

export 'package:dio/dio.dart';

Some notes on symmetric encryption in golang

nigel447 — Sun, 19 May 2024 10:42:56 +0000

Working today on passing around secure parameters I came across the post
Instead of LibSodium, you should use the nacl/box library that is part of golang.org/x/crypto. [1]

here is a simple example using the suggested libraries

the encrypt import suggested [1]

"golang.org/x/crypto/nacl/secretbox"

func getRandomNonce() ([]byte, [24]byte) {
    iv := make([]byte, 24)
    if _, err := io.ReadFull(rand.Reader, iv); err != nil {
        panic(err)
    }
    return iv, [24]byte(iv)
}

func encryptSecret(plainText []byte) ([]byte, [24]byte) {
    nonce, np := getRandomNonce()
    symKey := [32]byte(secretKeyBytes)
    encrypted := secretbox.Seal(nonce, plainText, &np, &symKey)
    hex.EncodeToString(encrypted)
    return encrypted, np
}

func decryptSecret(cypherText []byte, decryptNonce [24]byte) []byte {
    symKey := [32]byte(secretKeyBytes)
    decrypted, ok := secretbox.Open(nil, cypherText[24:], &decryptNonce, &symKey)
    if !ok {
        panic("decryption error")
    }
    return decrypted
}

and here is a test

func TestSymmEncrypt(t *testing.T) {
    plainText := "this is pop"
    cypherText, decryptNonce := encryptSecret([]byte(plainText))
    hopePlainText := decryptSecret(cypherText, decryptNonce)
    fmt.Println(string(hopePlainText))
}

notes

[1] is a good example of why we cant just cut and paste crypto code and hope for the best, its humbling to see even good cryptographers make mistakes
its amazing how often the crypto random source and its use is a basic repeated error in so much code
golangs rand.Reader uses getrandom(2)[2], its worth it to read the man page to see its limitations from [2] "entropy pool has been initialized and the request size is large (buflen > 256), the call either succeeds, returning a partially filled buffer" oops!

philosophical notes

is the universe deterministic if yes then we should be able to get a truly random source, however for the believers of science there has always been an argument for a non deterministic universe
struggling with crypto? => Zen proverb "Hell, also, is a place to live in."

run dart-frog in intellij

nigel447 — Sat, 06 Jan 2024 21:18:04 +0000

As a dartlang enthusiast I am sharing a setup to run the dartfrog development server in Intellij.

There is a dart-frog VSCode extension sadly while Intellij has a good dart plugin I struggled to create runtime configs, I did not want to have to run the dartfrog cli in a separate terminal. Using the Intellij default ant plugin I was able to easily set up a dev mode run config looks like this

<project name="secure-context" default="run_dev" basedir=".">
    <target name="run_dev">
        <exec executable="dart_frog">
        <arg value="dev" />
        </exec>
    </target>
</project>

copy this into a file called build.xml in project root dir
with the ant plugin Intellij will prompt you to add it as a runtime build
double click on the task run_dev and the dart frog dev server will boot.

# The Great Merge Hexagram 44

nigel447 — Sun, 18 Apr 2021 14:58:19 +0000

A precautionary tale that many of you may experience(d).

A project manager with more money than sense and no technical expertise.
A distributed development team with little in common in terms of language and communication.
Teams trapped in DSL, obsessed with micro goals and oblivious to the wider picture.

You have been invited in to help move the project forward and introduced to the type of code so common to this dysfunctional environment. Countless feature branches with nothing merged.

Working with the teams, pruning branches merging and setting clear well defined goals. Trying to communicate between the developers and the project manager.

I had a bad feeling, so I asked the oracle and received 44.

This was good advice. I had become infected by the chaos, I was to controlling, trying to channel the whirlwind of commits. I stopped, stood back, put myself in the place of the devs, "What good is strength if no one cares?", "After breathing in, one pauses for a moment.", "Amidst the hustle and bustle sensitivity emerges."
I focused on sensitivity and the devs started to respond, a shared sense of ownership began to emerge, spontaneous merge policies and the code begins to build correctly.

I am left to consider this most important question "You may be driving the chariot, But who or what drives you?"