Blind Pair Programming Interviews - <AUTHOR> http://codemanship.co.uk/parlezuml/blog/?postid=1220 <comment><USER3> A 33% rate of developers just going offline after being "explained" the problem (through copy-pasting in instructions) seems pretty abysmal. I'd be really worried that you're losing quality candidates due to them being offended by having instructions pasted into a text file without any chance for a conversation.

I wouldn't be surprised that 33% of raw candidates for a dev position don't really know how to refactor properly, but in my experience, candidates who don't know what they're doing at least flounder around for a while doing the wrong thing, instead of suddenly leaving an interview.

It might be an easily solveable problem - I wonder how much the candidates were briefed about the blind nature of the screening, and why there wasn't a lot of interaction happening.

Another way to fix it would be to have a developer interact normally with the candidate - including voice chat, discussion, etc. but have the evaluation be done by another developer, who only has access to a recorded screen share without any audio. Seems like it gets most of the benefits without the drawback of seeming cold and impersonal to candidates.

<comment><USER4> >> I'd be really worried that you're losing quality candidates due to them being offended by having instructions pasted into a text file without any chance for a conversation. If a developer gets offended over something as simple as that AND goes offline without much word of an explanation as to why, I'd be relieved because I've just dodged a bullet.

<comment><USER3> That's probably true, but on the other hand - in my experience if you're really interested in attracting real talent, interviews are as much about selling your company to them as evaluating their skills. Building an interview process that doesn't allow interaction beyond pasting instructions might be a signal to the developer that they don't want to work there.

<comment><USER4> I am commenting based on my past experience. This sort of behaviour is more of a red flag against the developer rather than against the company. I knew someone who displayed duplicate behaviour in the past before I learned my lesson. Happy to let other companies train and deal with these types of people.

</comment></comment></comment></comment><comment><USER5> I believe this would have been a better test if the interviewer had made his expectations clearer.

It was notable that everybody failed on one point. That failure wasn't actually relevant - competent people wouldn't fail on that point if they were told it was important (just as they wouldn't fail a similar situation in a job). Allowing them to fail taught us nothing about those people in a real job.

It seemed to me that this led to a situation where prejudices were still very present - whoever has previously worked in a shop with similar policies to the interviewer will pass. Whoever has not, cannot pass.

If an employee would know what was expected, why should an interviewee be expected to read the interviewer's mind?

<comment> loup-vaillant I for one would have failed the testing part entierly, for two reasons:

First, for a refactoring job, I would have assumed this was not running code, but a subset of something bigger. I would hardly expect it to even compile, let alone pass tests. If I took this interview, I _may_ have noticed the presence of tests, and I _may_ have ran them if I did notice. Pretty unlikely.

Second, most of the refactoring I have done so far is based on local, semantic-preserving, transformations. Those are extremely reliable (as in a couple mistakes every 50 modifications). No point in running tests every few edits, unless they're less than two kestrokes (and seconds) away. If I do get in trouble, I still have Git.

\---

When I think about it, I probably would have failed the code smell part as well: over the years, I have seen the utter superiority of the functional style over the imperative style in most cases. This has consequences:

I sometimes use the ternary operator to initialize variables (or should I say _constants_ ). The only thing ugly about this operator is its syntax. Its semantics are cleaner than those of if(){}else{}, its imperative equivalent.

I often use multiple returns. It's the only way I can use if(){}else{} without relying on side effects.

I don't shy away from switch statements, or their cascaded if() equivalents. I may even use a cascaded ternary operator. See, most of the time, the Expression Problem leans _heavily_ in favour of sum types (tagged unions) and pattern matching, instead of class hierachies. Java lacks sum types, so this means emulating them with a switch statement. This is cumbersome, but less so than the equivalent class hierachy.

I shun getters and setters. While I like my objects to be immutable, sometimes I do need a public mutable member variable. Well, I'm honest about it, and use just that. I dont hide it under the getter/setter carpet, unless it actually helps me enforce some specific invariant. And I call my getters "foo()", instead of the more customary "getFoo()". I want to emphasise the result, not the action of getting it.

I will probably end up writing ML in Java (except when it means fighting the interfaces around me, including the standard library). But I do believe this generally results in shorter, cleaner, more reliable code than idomatic Java. This stays true even in the face of readability issues ("readability" means you can't use recursion, closures, or even first class booleans, because your poor colleagues lack some basic education —this is not a strawman, I have _lived_ it).

So, your code smell may very well be my best practice.

This interview process would likely reject me. Unless the interviewer has a relatively solid understanding of functional programming, he will just mark me off as sloppy, too clever, ignorant of OO principles, or even all three. I can explain myself, but I only have half an hour, and this comment already took me twice that.

</comment></comment><comment><USER6> If anyone else is interested in conducting similar blind programming interviews, check out: [https://coderpad.io](https://coderpad.io).

It's a completely in-browser realtime code collaboration/execution sandbox. Candidate (or you) types code in the left, and hits a button to run it. Can be quite a bit faster to setup than Skype screensharing and allows the interviewer to edit as well.

<comment><USER7> It would also prevent the interviewer from forming any prejudices based on the appearance of the candidate's screen. Esoteric window managers, that sort of thing.

<comment><USER6> That's a great point, thanks!

</comment></comment></comment><comment><USER8> I would like to take part of such kind of interview, not necessarily to take the job, but to experience an honest and objective evaluation from an experienced developer. Being a student and not actively looking for a job it's hard for me to self evaluate. Hitting roadblocks I don't know if the problem is genuinely hard to solve or I just bit more than I could chew

<comment><USER9> If you are a student, this sounds like a great project to do for a class: set up a service where two coders can get randomly paired up to program an exercise and then they can later evaluate each other!

</comment></comment><comment><USER10> Ok, a really naive question here - but how do you avoid cheating?

I can easily see if this takes hold that there are authentication issues - <USER2> do you know that the person who is taking the test is actually the person who applied or will show up (even if it's remote) to your job?

<comment><USER11> There's no reason this has to actually be a remote interview. They can be in the same building as you, on your own hardware.

The value is that the evaluator is blinded. Doesn't mean you can't have someone else greet them and supervise them, as long as that person isn't scoring them.

</comment></comment><comment><USER12> I'm surprised that the whole process is based on evaluating how good the candidate can apply some TDD techniques. I'm sure that more than 99% of all software is developed without unit tests. This includes the linux kernel and the rest of the OS, the other big OS-es, databases and other commercial software. Even most of the Java code doesn't have detailed unit tests. To base your evaluation entirely on how well the candidate uses those technical seems not very objective to me. I've seen people who are very good at working with very messy code which is impossible to refactor in a reasonable time and they do a very good job without any unit tests. This skill is sometimes much more important than knowing how to run you tests and few refactoring tricks.

TDD is a methodology - not an ability. A good developer can develop the habits in very short time. If this is part of the culture people can be trained to use it.

</comment><comment><USER13> I was interested in the refactoring course mentioned in the post. What I turned up was a youtube video showing someone refactoring code to music. Instead of, like, a github repo or something useful so I could try it out myself. Oh well. It is a nice idea.

<comment><AUTHOR> I wanted the same thing - there is a zip file with some code on one of the YouTube video descriptions. I asked the creator and he said it was an older version of the material that he uses for his on-site training.

</comment></comment><comment><USER14> Not quite an experiment - the results were not measured or even measurable - you probably can't hire them all and compare the results vs the interview rating. But an interesting protocol, if they can somehow validate it.

<comment><USER9> Very good point, measure everything!

One way to start trying a quantitative approach would be to conduct normal interviews with the same candidates and compare the results. If you already have a decent interview process there should still be some similar results, indicating you are on to something.

Not as good as hiring them all and evaluating performance, but the real world sucks

</comment></comment><comment><USER15> Cool idea, and nice write-up, but now I want to find out how the guys hired with the help of this method fare in their jobs!

<comment><USER16> This seems to be an ill thought out technique. The exercise has been designed so that all the candidate has is a false task and an awkward channel for communication.

Coding at interview is essentially always a false task, as the context and realistic goals are stripped away and the problem scaled back to something that can fit into a short timeframe. Typically, enough interviewers are bad enough at setting problems that there's a "market for lemons" effect -- the candidate does not know ahead of time whether you are a good or poor interviewer. As their goal is to get the job (not to only get the job if this particular interviewer happens to be a good interviewer -- see note) that means a significant portion of their energies goes into second-guessing who they are dealing with. And stage fright -- I've watched candidates make a complete hash of programming tasks at interview, be hired nonetheless (because we saw something else in them), and turn out actually to be competent programmers too.

Strip the communication back to just slowly typed text, with a thirty minute timeframe so every communication is exceptionally expensive, and now we have an almost entirely artificial puzzle.

Suppose one starts by reading and understanding the code; another starts by running the tests. One decides, given the thirty minute timeframe he's going to have to batch his testing at the end because the number of smells identified sounds like it's the test measure; another decides to run the tests at every tiny edit because it sounds as if the interviewer wants him to show his test-driven credentials; another decides that interviews like to "see how the candidate thinks" and spends most of his time asking text questions of the interviewer.

From this we could deduce, what? To be brutal, I wonder if frankly we might as well be deducing that the first one is a Sagittarius and this week's horoscope doesn't bode well for them. Because for all we know, the differences in behaviour are as likely to be about different guesses about the interview (it is a cut down task, so what has the interviewer decided to exclude and what have they decided to include, and does this interviewer even have any idea about that?) as about how the candidates actually go about programming on tasks in context.

But perhaps that's just my scientific curmudgeonliness about the "cult of hiring" \-- the irrational belief that programmers interviewing candidates have, usually without evidence, that they are "able to ascertain how a candidate thinks" in a short space of time on an artificial task.

While it might be mice to hear how the candidates hired performed, at n=2, we still would not be able to make any reliable inferences.

note -- While you might think the candidate would only want the job if it is a good interviewer, that is not true. First, because poor interviewers can nonetheless be good colleagues. But more importantly because the candidate loses nothing in being offered a job he/she rejects, but does lose something in not being offered a job they might accept.

<comment><USER17> Agreed.

Sometimes I write nice code, I come back a few months later, understand how it works and it is easy to change / add features to it. Other times I write nasty hacks, because it is required quickly, and they just need something that works. Depends on time constraints and other factors. This interview technique obviously assumes that time is plentiful, and refactoring is the most important thing about the code. Usually it is not (at least for most of the places I have worked over the last ten years).

I personally find I get a good idea about someones ability by _talking_ to them. I have a good idea about my colleagues ability, despite not having read much of their code. If they seem s to have a passion for programming, understand a variety of concepts, know what libraries are useful for what tasks, then I will have an idea that they are good.

Or are they still logging onto MySQL from the command line, because anything else is too complex to set up. Print statements for debugging, because an IDE is to complex to set up with graphical debugging. Still using the same tools that we got taught in University ten years ago, because they have not bothered to keep up? Yes, I work with these people as well. If I was hiring, these ones would not get chosen.

</comment></comment></comment><comment><USER18> This is a fantastic idea, like blind auditions. [http://www.nber.org/papers/w5903](http://www.nber.org/papers/w5903)

<comment><USER19> That's the first thing I thought of!

For the lazy, the linked paper (which is very famous) shows a significant jump in hiring women after orchestras started conducting blind auditions.

</comment></comment><comment><USER20> Seems like an interesting approach, but there is a lot to be said about how one communicates, not just codes.

Unless you just want a pure code monkey that never needs to talk to anyone or coordinate with anyone.. then this is a great way to find that monkey.

<comment><USER21> I would expect another interview purely to gauge likeability/communication/basic hygiene; this is a good approach just to gauge raw programming skills. It's no use getting to know someone just to find out they can't code at all.

That being said, the benefits of being able to discuss the requirements/expectations of the test would probably outweigh possible negative biases. Even if the candidate doesn't know what refactoring is, a discussion about it may give them insight on what they should research to increase their employability.

</comment></comment><comment><USER22> I like the idea of a blind evaluation, but I can't get past how impossibly awkward it would be to have to keep switching between coding and communicating with my "partner" via an IM window. Speaking a question out loud while I'm looking at code and my hands hover above the keyboard? Sure, that's using separate channels. Having to switch windows and type out my question? Huge context switch.

Not sure how badly that would affect the evaluation, but it seems like it would be significant.

</comment><comment><USER23> This could easily be a useful service. It sounds like a good transition from a phone call with technical questions asked by someone who is not themselves technical, and a full interview. Some questions:

1\. Could a non-technical person conduct this interview? 2\. Could a technical person who is not familiar with the challenges pick them up quickly enough that they could proctor them for many companies who supply their own questions?

<comment><USER24> I do not think that a non-technical interviewer would be able to adequately interpret things like how well the candidate found and fixed code smells, or adequately interpret how well the coder was using their tool of choice, or make meaningful comments on how the user went about testing the code.

Proctoring blind interviews might be really interesting, though.

</comment></comment><comment><USER25> I like the concept. It would take a lot of data (perhaps by a large SW firm adopting this?) to see if this improved recruiting. Even then, it may only be applicable to the firm in question.

When I set up interviews, I purposefully don't allow interviewers to talk to each other. This reduces some bias, but not gender or race. I also speak last in verbal feedback sessions.

</comment><comment><USER26> I would hang up on this guy, because he is a total d*ck and I would never work for this type of person. He just wants a machine to do his programming.

<comment><USER27> For a white man, this is reasonable.

For someone who is not a white man, this is an advantage because the interviewee is being tested on things that they control, rather than things they don't. (Gender, skin color, national origin, disability...)

<comment><USER28> Someone that cannot type fast is going to be selected against in this format. Someone for whom the interview language is not their native tongue is going to be selected against in this format.

Concrete examples: I work with someone that is a very bad typist. Yet she is very smart and a prolific contributor. (edit: the hint here is that a disability can make you a bad typist, yet a valuable contributor) Another person that I worked with was French and and found textual communication very challenging. I can't imagine either making it through this interview process.

Both are minorities by several measures.

<comment><USER27> I'd be very surprised to see someone who could comfortably speak in a second language, professionally, but have trouble typing. I say this as someone who has some experience both learning multiple languages and having went through learning to teach English as a foreign language. These people would be exceptions to the rule. The blind audition equalizes for more people than for whom it disadvantages.

<comment><USER28> * The blind audition equalizes for more people than for whom it disadvantages.*

Maybe. Do you have evidence for this statement?

I haven't put myself to any sort of test, but my perception of myself is that I am far more attuned to lapses in English usage in the written form than the spoken. I don't think these interviews are very blinded at all. I can tell if you are ESL (unless you are very, very good), I can often tell if you are younger or older, I can tell if you come from my background or not. As well as if I were meeting you face to face? Of course not! But, how will I select people in each situation? Am I more or less biased in face to face or written communication?

We know tests like the SAT have a cultural and racial bias. I should hire programmers because they can deliver value to my company, not because they type like me. When I measure you by a proxy (how well you communicate via IM) I have the chance to make the wrong choice.

Don't get me wrong - I think there is a very good chance you are correct in that statement. But I don't believe these interviews are blinded (they are probably most blinded to gender, and least blinded to ESL), and no one has shown that the results are less biased than the alternatives.</comment></comment></comment></comment></comment>


Origami-inspired materials could soften the blow for reusable spacecraft - <AUTHOR> https://phys.org/news/2019-05-origami-inspired-materials-soften-reusable-spacecraft.html <comment><USER2> Origamizer is one of my favourite toys to play with on a Sunday afternoon:

[http://origami.c.u-tokyo.ac.jp/~tachi/software/](http://origami.c.u-tokyo.ac.jp/~tachi/software/)

A neat paper on the algorithm for finding the origami path:

[https://www.semanticscholar.org/paper/Origamizer%3A-A- Practi...](https://www.semanticscholar.org/paper/Origamizer%3A-A-Practical- Algorithm-for-Folding-Any-Demaine- Tachi/758b3b9cea1b8391a73ff68846011c7f480fe7a0)

</comment><comment><USER3> I love the interplay between art and science. During my PhD I was lucky enough to work with an Origami artist (1) to help mathematicallly describe the folded structures he fabricated. One of such shapes was the one described in the article, I'm sure many more use cases will come, over the years.

(1) [https://www.mattshlian.com/](https://www.mattshlian.com/)

</comment><comment><USER4> Relevant to this: [https://news.mit.edu/2019/engineers-demonstrate-lighter- flex...](https://news.mit.edu/2019/engineers-demonstrate-lighter-flexible- airplane-wing-0401)

Cellular design is a coming revolution in industrial design and manufacture. As far as I know, there aren't any commercial products that cater to this being of mechanical design.</comment>


Sandboxing Landscape - <AUTHOR> https://idea.popcount.org/2017-03-28-sandboxing-lanscape/ <comment><USER2> A central goal of the new Mill CPU project is to make strong hardware fault isolation incredibly cheap and incredibly easy and so simple as to have no obvious deficiencies.

There's an old talk on Security [http://millcomputing.com/technology/docs/security/](http://millcomputing.com/technology/docs/security/)

I have prepared a much more up-to-date whitepaper on this that is going through internal review right now. Afraid we're focusing 99% on sim work at the moment and that 1% for other business is meaning the paper has been 'in review' since last autumn... hmm, have to go push :)

But I'm happy to elaborate if anyone has any security questions.

(Apologies if you're all still suffering from Mill fatigue)

</comment><comment><USER3> Here's your cool, lightweight and easily configurable sandbox - [https://github.com/google/nsjail](https://github.com/google/nsjail)

</comment><comment><USER4> From [https://cappsule.github.io](https://cappsule.github.io)

 _" Cappsule is a new kind of hypervisor developed by Quarkslab (to our knowledge, there's no similar public project). Its goal is to virtualize any software on the fly (e.g. web browser, office suite, media player) into lightweight VMs called cappsules. Attacks are confined inside cappsules and therefore don't have any impact on the host OS. Applications don't need to be repackaged, and their usage remain the same for the end user: it's completely transparent. Moreover, the OS doesn't need to be reinstalled nor modified ... Cappsule uses hardware virtualization to launch applications into lightweight VMs, which run a copy of the host kernel and have no access to the hardware. If an attacker manages to break into the VM (through a bug in the application for instance), the attack is confined into the VM."_

<comment><USER5> But VM escape vulnerabilities have existed lots of times. How is this a guarantee that they do not have one?

<comment><USER6> There is no software that is guaranteed not to contain vulnerabilities.

<comment><USER7> Sel4?

<comment><USER8> Provably :)

</comment></comment></comment></comment></comment><comment><USER9> This is an area where i wish there was more easy guides.

For example, i would love to understand how to take a program, limit the total count time and memory usage of it, and all its children, and be able to clean up after it.

Bonus points if i can limit what directories it can write to.

I'm sure one of these things will do it, but i don't know what level i want.

</comment><comment><USER10> I've been looking for such a language for some time now but couldn't find any either. The feasibility to run untrusted code, combined with the ability to suspend, serialize and reschedule running tasks, as in Stackless Python:

[http://stackless.readthedocs.io/en/2.7-slp/library/stackless...](http://stackless.readthedocs.io/en/2.7-slp/library/stackless/pickling.html)

would make it possible to have truly distributed applications. Imagine thousands of tasklets jumping through your filesystem, local network or the internet.

Another interesting property is determinism, which in turn would allow for remote execution and instruction metering - a computation market.

[http://e-drexler.com/d/09/00/AgoricsPapers/agoricpapers.html](http://e-drexler.com/d/09/00/AgoricsPapers/agoricpapers.html)

If the code is fully deterministic, verifying results becomes much simpler, one option is comparing merkle roots over the entire program state, for example:

[https://people.cs.uchicago.edu/~teutsch/papers/truebit.pdf](https://people.cs.uchicago.edu/~teutsch/papers/truebit.pdf)

<comment><USER11> What is your use case?

IBM was working on that with Java: [https://www.ibm.com/developerworks/library/j-multitenant- jav...](https://www.ibm.com/developerworks/library/j-multitenant-java/)

<comment><USER10> Nothing serious, really. I just think it would be awesome. In the long term, working on a general purpose BOINC-like platform could be interesting.

</comment></comment></comment><comment><USER12> Another possibility is to use Moxie ISA:

[http://moxielogic.org/blog/](http://moxielogic.org/blog/)

It has a GCC backend.

</comment><comment><USER2> Redis, for example, uses Lua but limits the Lua to a single pure-function and enforces an execution time limit [https://redis.io/commands/eval#sandbox-and- maximum-execution...](https://redis.io/commands/eval#sandbox-and-maximum- execution-time)

Whilst the complexity of the script is limited in what it can do, it seems actually not that hard to imagine some kind of next-gen CDN offering edge scripting to statelessly rewrite requests and responses.

<comment><USER13> Lua, in its vanilla form, is not a language supporting proper multi-tenancy. It works okay if only one (trusted) user writes the scripts, but it's not the good choice for running truly untrusted code from the internet. What will just happen when you do "string.rep" in redis?

A better design would be to run one Lua VM per tenant, but then we are at totally different set of problems (preemptive multi-tasking between VM's?)

<comment><USER2> In Lua its the host that does the actual allocs (lua_setallocf()), and its routine for the host to intercept those mallocs and do accounting.

Now even with a 'locked down' Lua VM there is a lot of trust in executing 3rd- party scripts and there might be various attacks.

But as I said, I really could imagine some next-gen CDN allowing paying customers to put Lua scripts in the edge to rewrite requests and responses.

If I were tackling it I would want all the script instances for any given customer to be isolated at a hardware level from other customers too.

</comment></comment></comment><comment><USER14> Sorry for the meta comment, but reading this on an iPad Pro 12.9, and can't seem to get this to render as it would on a desktop, despite hitting 'Request Desktop Site'. Is there anything one can do with a bookmarklet in this situation, or am I beholden to what the server decides?

<comment><USER13> Author here. The markup is trivial. The CSS is basic. I'm not sure what problem precisely you have, but I did spend quite some effort to make it look good on iphone. (for added kicks press "d" on your keyboard on desktop)

<comment><USER14> Sorry again for meta, and thanks for responding. I just mean on the iPad pro 12.9 it renders as if it were a huge iPhone, rather than as a desktop site. It just means the text is huge. Not a biggie - I've seen this on some other blogs, and wondered if there were a workaround.

<comment><USER15> Same device, same giant text ... workaround I like is tap reading view icon in Safari URL bar.

</comment></comment></comment></comment><comment><USER16> >Some time ago I started wondering - would it be possible for a CDN to run customer code on the edge servers?

Can't you already do that with PaaS providers? Upload your code, create instances across multiple regions, and you're done.

<comment><USER17> Indeed, google Appengine has sandboxed versions of python, java and go. It's becoming the 'old' way to do things though. If I understand correctly more recently VM and container-based solutions are the new way to do sandboxing on google cloud, e.g. Compute Engine and Container Engine.</comment></comment>


Homeland Security attempting to seize Mt. Gox's accounts? - <AUTHOR>

I've used Dwolla successfully a couple times in the last month to transfer funds to Mt. Gox. Abruptly, I just got this email 5 minutes ago from Dwolla:<p>http://malgorithms.com/dropbox/mtgox-dwolla-homeland-security.png <comment><USER2> Apparently MtGox/Japan does not know about it: <https://mtgox.com/press_release_20130515.html>

</comment><comment><USER3> also mentioned here: <http://hardforum.com/showthread.php?p=1039878678></comment>


It's legal: cops seize cell phone, impersonate owner - <AUTHOR> http://arstechnica.com/tech-policy/2012/07/its-legal-cops-seize-cell-phone-impersonate-owner/ <comment><USER2> The key point here is that _the police can lie to you_. They can tell you they have evidence that you did it, they can tell you that your buddy is blaming you, they can answer your phone while they're in your house and pretend they're you, and so on. The police are not obligated under any kind of ethical rule to tell you the truth. Deception is fine.

Of course, if _you_ like to a federal agent, it's a felony. That includes everybody from tax collectors to folks from the Farm Bureau. If you lie to state or local policemen, they can use that against you as evidence that you were trying to be evasive. This is true even if you accidentally omit something or just get confused. It's all free ammo for them to use.

This is why the only thing to do when questioned by the police is shut up and ask for a lawyer. Even if you are innocent and have nothing to hide[1]

[1] Admittedly this is very difficult to do in situations where you are completely innocent and a life is on the line, for example if the cops are looking for a missing person. Personally I try to help all I can. But from what I understand you are gambling here that the police will intuitively grok you as a "good guy". If their perceptions change, even in error, informally cooperating is a fool's game and you could get screwed royally.

<comment><USER3> There's a difference between being questioned and police just asking for help.

Being questioned = they are asking about what you did

Asking for help = they are asking about what _someone else did_

If you are being questioned, you can and should demand a lawyer even if you have nothing to hide because at this point you are already a person of interest in their investigation.

If they are merely asking for help...just don't be stupid answering their questions. The police aren't there for you.

</comment></comment><comment><USER4> Pretty sure they were doing this far before smartphones or even cellphones - it was done with pagers and even home phones before that.

Think about it, they don't even need your phone.

All they have to do is find out the number and all the carriers have gateways for law enforcement without warrants to examine everything sent/received and locations.

Then they can route the number anywhere and impersonate you.

BTW I am 100% okay with this if a person was CONVICTED in a court of law or they go before a judge and can prove someone is in mortal danger (child, etc.)

The biggest problem is they can now pull you over for a ticket and clone your phone without challenge. That's not right.

</comment><comment><USER5> So it's legal for cops to seize your residence, confiscate your postal mail, open it, and write replies _impersonating you_ to whomever they want?

How is this any different? Because there's an electronic device involved?

<comment><USER6> Even more similarly, what is the law on answering machines? Can someone leaving a message on an answering machine be subjected to a similar interception and impersonation without a warrant?

What about emails? Can emails be faked without a warrant?

<comment><USER3> 1) Not quite. A person leaving a message on a suspect's answering machine can be called back without a warrant for them (as the original warrant/search would still be valid on the original suspect). But a separate warrant would be required to intercept (EDIT: removed impersonate) that caller. EDIT: They can impersonate a person without a warrant.

2) Yes. Emails cannot be _searched_ without a warrant, but police can fake emails without a warrant. However, if they attempt to entrap another person by faking emails, they run into the classic entrapment defense. Furthermore, if they cause harm to a person's reputation, etc., through the impersonation, they are usually liable for crazy damages.

<comment><USER7> > However, if they attempt to entrap another person by faking emails, they run > into the classic entrapment defense.

So they can do it with a cell phone (in the article), but not an email?

<comment><USER3> No, they run into the entrapment issue either way. But it's easier to show entrapment with email because the fake emails are recorded.

With a phone call, it is not necessarily a given that the call was recorded (as the police may not have had proper gear set up), so it usually becomes a he-said-cop-said problem. Cops usually choose not to record calls unless they need to, because for evidentiary reasons (for the prosecution) it is better to make the dispute one of credibility.

<comment><USER3> Journalists do not understand the law very well...

In this case, the police hit up a bunch of people they suspected of being the dealer's customers and asked them if they wanted to buy more drugs. The callees who were arrested agreed to buy more drugs without persuasion. That's not entrapment.

Left out of the article, because they were not relevant to the opinion, is those people the police texted who chose not to buy drugs from the dealer being impersonated.

<comment><USER7> > The callees who were arrested agreed to buy more drugs without persuasion. > That's not entrapment.

It seems I'm confused about what constitutes entrapment.

If an officer walks up to me on the street and offers to sell me drugs, is that entrapment? (I see that as exactly the same as sending a text message, or email)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> *"...he can't be sure that the pager will be in the hands of its owner ... But after their arrival, Hinton's text messages on Lee's iPhone were no longer private"

I wonder if this argument still applies if you have a lock code on your phone. Yes, my phone may have been stolen or lost or left on a desk, but if no one can get into it then it's not public. Could an officer request you unlock your phone and then argue that the contents of your phone are not private?

</comment><comment><USER9> This is why you should just lock your iPhone with a passcode. Not that I'm rooting for the dealer, but in no way whatsoever am I (Me not some court) going to let a Gov PD have access to my technological data without a fight. Lock it down and remote wipe later, play where's the data.

</comment><comment><USER10> They contacted people to see if they "needed more" ? So the cops initiated it?

Can someone (qualified) describe how that is not entrapment?

<comment><USER8> Entrapment isn't a complicated concept. This isn't entrapment because the defendant wasn't coerced into committing a crime; he was willing to commit the crime anyway. It's not illegal for an officer to ask you to commit a crime, it's only illegal if they give you no choice but to commit that crime.

en.wikipedia.org/wiki/Entrapment

</comment></comment><comment><USER3> This is a court decision by a _low level_ court which applies only to a single county in the state of Washington. Assuming it survives appeal, it would, at most, apply to the state of Washington.

The distinction here (at least the one discussed in the opinion) is that the court found that texts were an active communication method, i.e., like talking on the phone, not one of the traditional protected methods such as postal mail. (I do not agree with this distinction, but this is what the court reasoned.)

<comment><USER11> > Assuming it survives appeal, it would, at most, apply to the state of > Washington.

That's not completely true. A decision at a state's highest court may not be legally binding elsewhere, but it can have precedential weight in other jurisdictions where similar laws have not yet been tested. A single case in a single state could well determine the course of law throughout the country.

<comment><USER3> Precedential weight has value only if there is absolutely no in-state jurisprudence on the issue. However, texts are easily analogized to other forms of communication (and indeed, that is what this judge did). Consequently, the state's jurisprudence on such other forms of communication will trump what little precedential weight this case could have.</comment></comment></comment>


ETO Sterilizer, Hydraulic Baling Press, Rotogravure printing machine - <AUTHOR> http://www.omindustries.co.in/plastic-print.php We are engaged in manufacturing and supplying a wide range of Plastic Processing Machines, Plastic Printing Machines and Equipment. Fabricated using superior quality stainless steel, our range is extensively catering to the demands of several industries. Also To ensure superior working performance at the client's end, these are quality checked on various quality parameters. Moreover, in order to attain maximum client satisfaction, we also offer our range in accordance with specific requirements of the clients. Our range consists of following machines: •	Rotogravure Printing Machines •	Slitting Rewinder Machines •	Auto Edge Trimming Machines •	Power Pack Machines •	Fixed Rake Angles •	Hydraulic Bale Presses •	Hopper Loaders •	Hopper Dryers •	Steam Sterilizers •	Cone Blenders •	Ribbon Blenders •	Pulverisers For more details visit us at: http://www.omindustries.co.in/plastic-print.php <comment><USER2> screw conveyor, belt conveyor</comment>


The Ghosts of the Orphanage - <AUTHOR> https://www.buzzfeednews.com/article/christinekenneally/orphanage-death-catholic-abuse-nuns-st-josephs <comment><USER2> Hard to read, but I think we owe a debt to society. We need to make sure these things don't happen again. This is why charter schools, home schooling, and other aspects of society need oversight to protect kids from predators.

<comment><USER3> The problem is that the oversight itself is almost always the cause of the abuse. In the case of parents, obviously. But of course this was the case in the past, where the church _and_ the state (the social agency referred in the article and it's management, which is the government) were the problem.

Any kind of oversight necessarily puts people in power over others' children, as does the very concept of an institution or orphanage, including of course schools. It is that power, not which geometric shapes the organizing power insists get put on the wall that attracts child predators.

Giving people power over children is the problem. Attempts to "make sure these things don't happen again" so far have massively increased child abuse. The numbers I checked for the Netherlands are staggering: 1 out of every 3 children in child care gets sexually assaulted in the sense that they report it to the police. Roughly half of those gets abused by foster parents or government employees, half by other children (they just put babies with teenagers, then leave them alone due to lack of manpower or outright unwillingness of employees). Suicide rates are almost 10x what they are outside of child care.

And the incredibly sad part is ... once in child care 1 in 3 gets sexually assaulted, but barely 1 in 10 is put in child care because of allegations (usually not even a complaint) of sexual abuse. Mostly it's because of ... hygiene problems.

The problem is that without giving institutions power over children, nothing happens: children will refuse to leave their parents in all but the most extreme cases of abuse, until they are at least halfway through their teens. And the huge problem is that statistics clearly show that that is the right decision to make for the children: outcomes for children with their parents, even when abused, are far superior to outcomes in child care. In terms of education, in terms of living independent as an adult.

Here's some links:

[https://www.bbc.co.uk/news/resources/idt- sh/norways_hidden_s...](https://www.bbc.co.uk/news/resources/idt- sh/norways_hidden_scandal)

[https://www.theguardian.com/uk-news/2018/jan/29/rotherham- ch...](https://www.theguardian.com/uk-news/2018/jan/29/rotherham-childrens- services-transformed-since-abuse-scandal)

[https://en.wikipedia.org/wiki/Cleveland_child_abuse_scandal](https://en.wikipedia.org/wiki/Cleveland_child_abuse_scandal)

[https://www.mirror.co.uk/news/uk-news/social-services- centre...](https://www.mirror.co.uk/news/uk-news/social-services-centre- britains-worst-12176585)

[https://www.thesun.co.uk/news/6112955/telford-politicians- ch...](https://www.thesun.co.uk/news/6112955/telford-politicians-child-sex- offenders/)

And, of course, the abuse was accepted and reinforced:

[http://www.childrenscreamingtobeheard.com/fostering- scandal/](http://www.childrenscreamingtobeheard.com/fostering-scandal/)

Who turned out to be pedophiles in the past 20 years or so ?

* The social services chief for a large British city. Note: AFTER he was convicted of sexually assaulting children Graham Bould was still put in charge of child services, as well as other social services (no worries: I'm sure he behaved himself much better around adults ...)

* an unspecified number of North Wales psychiatric child care workers at 18 different government facilities for child care (and some foster parents), who sexually abused at least 140 children

* The local councilor of that same city. These 2 worked together to, firstly, allow the local vicar to abuse children, and all 3 worked together to threaten abused children into silence.

* The child psychiatrist in charge of the "Child Expert Commission" for the entire country of Norway, who decide whether children get taken from their parents or not

* a dozen French government psychologists, in charge of diagnosing children in psychiatric care

* hundreds of Spanish government doctors, nurses, and also nuns and priests

* US public school employees, hundreds, from janitors to administrators and social workers

* Sebastian Edathy, a very high level German politician, and a senior cabinet minister in the government of Angela Merkel, Agriculture Minister Hans-Peter Friedrich, was fired for protecting him and tipping him off

* Dutch Jehova's witnesses employees and members cooperated to commit and hide child sexual abuse, for decades

* Government day care employees in the Netherlands

* Red Cross and Doctors without Borders aid workers (who did it, with the knowledge of the top of the organizations, for over a decade)

* Public school employees in Holland exploited the children entrusted to them on a large scale (specifically these were promising athletes sent to a special school)

* UN peacekeepers sexually abusing indigenous children in Western Sahara, Mali and other places

* Oxfam rescue workers (who were protected by the board of Oxfam)

* The leadership of an islamic school in the UK, and local politicians

Not pedophiles, but at the very least encouraging child abuse:

* A majority of the British parliament (who voted that private companies would be allowed to pay social workers to give them children they "offer up" for adoption (meaning they sell them))

Quote: "A foster agency receives £20.000 for every single child they sell, adoption agencies £36.000 for every child sold, all with tax payer's money, most of the agencies are owned by ex social workers. So, are the agencies working with the social services?"

(Needless to say "somehow" these sold children have a disturbing habit to end up in prostitution. I wonder how that happens)

<comment><USER4> Not a one of these examples is less than chilling, even terrifying, and provokes a sense of immense outrage. Like examples of rape, murder and child abuse by total strangers it makes us all feel fearful and powerless, but it also misses a critical point. Most children are abused or neglected by family and loved ones, not distant authorities or strangers. Most people are murdered (including children' by their nearest and dearest.

It's important to make those distant authorities which somkften get things wrong be accountable, yet at the same time we have to avoid the bottomless pit of something like Stranger Danger. The examples you cite are sensational, but they're not typical. The typical case is the child being raped by a family member or family friend, the wife being murdered by the husband, or the friend being murderers by a friend. For every extreme and chilling case of someone far away in a position of power abusing thst power, there are hundreds of much quieter yet no less damaging cases of the same thing being done close to home.

<comment><USER3> > Most children are abused or neglected by family and loved ones,

Why do you say "abused or neglected". They are not the same at all. And interfering in a case of neglect clearly leads to abuse within the child care system ...

At the very least child care will inflict massive psychological trauma on any child it interacts with. No child, no matter how neglected, will react positively to being torn from their parents. Being violently torn from their parents, then locked up into an unfamiliar environment that has predators ... that's just indescribably traumatic. And that's the _best_ case for those services interfering ... That's assuming no actual abuse follows, which is clearly rather too likely.

The measure should of course be that that massive trauma is significantly less than the damage that the parents do if left in control. I would argue that in the case of neglect, that is essentially never the case. Even in the case of abuse, I would argue that it's rarely the case, and that the child should be the one taking the decision, and that child should be provided with the authority to undo that decision at will and without explanation. Children are perfectly capable of figuring out which is the better situation for themselves, a right systematically denied them in every child service.

And if you argue differently, can you really claim to be acting in the interests of the child ?

This is a best case scenario: [https://www.youtube.com/watch?v=RR8cZuXPiYU&t=137s](https://www.youtube.com/watch?v=RR8cZuXPiYU&t=137s)

Note: you might wonder what sort of abuse the mother subjected the child to ... well, she did not force the child to see his father despite a court order. For that, the judge took the child away from both his parents, and despite not getting adopted will not get to see either of his parents again until he is an adult ... Needless to say, the government defended this action, it is "justified". Why ? The agents followed the law and the judge did indeed have this option available to her (judge was female). Can you explain to me again why you are defending these people ?

Also in the example above, can you please let me know your opinion: because of this action, did the odds of the child getting abused increase or decrease because of the child services intervention, because any sane person knows perfectly well that those odds just went up massively.

And yes, child services taking children almost never happens because of actual abuse. Hygiene (as judged by teachers), and parental separation are the main causes (and by that we mean 80%+) of child services interfering with young children. Later it becomes theft (as in the child stealing something)

> The examples you cite are sensational, but they're not typical.

No they're not. They're truly banal. If you read up on them you will quickly realize that the only reason those are examples at all is because of systematic fuckups on the part of the perpetrators, and even then that was usually not enough. Mostly there is also interference by someone in power to get any progress at all in the case. And notably: almost never does the government give the children back even when it was a goverment institution getting caught abusing the children. So there is zero willingness on the part of the government to act in the interest of the child, even when caught red handed abusing the child.

These are the people you're defending.

Clearly the 33% figure points out that abuse is far more likely in the child services case, than in an environment where nothing is done (children just left with parents). I guess it is, however, 17% short of "typical".

And, of course, despite this massive child abuse committed by social services, it has not actually helped. In theory they do this to prevent what happened in the 90s. And ... of course ... in that it is a total and complete failure, a few examples:

[https://www.hoogeveenschecourant.nl/nieuws/hoogeveen/531051/...](https://www.hoogeveenschecourant.nl/nieuws/hoogeveen/531051/drentse- youtuber-ontmaskert-pedofiel-in-hoogeveen-incl-undercover-video.html)

[https://www.omroepgelderland.nl/nieuws/2303872/Klopjacht- op-...](https://www.omroepgelderland.nl/nieuws/2303872/Klopjacht-op-pedofiel- onrust-in-buurt)

[https://www.rtvdrenthe.nl/nieuws/125426/Cel-geeist-tegen- ped...](https://www.rtvdrenthe.nl/nieuws/125426/Cel-geeist-tegen-pedo-Toen- hij-was-opgepakt-was-het-veilig-in-Meppel)

[https://wnl.tv/2017/12/06/pedo-huisarts-opgepakt-om- ontucht-...](https://wnl.tv/2017/12/06/pedo-huisarts-opgepakt-om-ontucht- minderjarige-meisjes-en-filmen-patienten/)

> much quieter yet no less damaging cases of the same thing being done close > to home

I think reading the links will also quickly elucidate that every government, from the UK, to the Dutch, the US and the Norwegian government acted to protect the abuses, through legal _and_ illegal means. So those cases are exceptional only in that they were big enough and that the victims actually managed to get heard. But if a small group of child care employees managed to systematically abuse 140 children for years, like in the UK case, how many cases are there of 1 child care employee abusing a child where the government succeeds in silencing the whole issue ? Hundreds ? Thousands ? That, to me, seems like an extremely low and conservative estimate. How many cases of children being left to themselves and then, when they become teenagers in such a forced prison situation, abusing each other ? I don't even want to guess.

You claim the scale of abuse by people in positions of power is small. And yet ... this is clearly not true:

[https://www.theguardian.com/society/2018/jan/18/adoption- has...](https://www.theguardian.com/society/2018/jan/18/adoption-has-become- runaway-train-social-workers-cannot-stop)

It is not hard to find sources talking about the scale of the abuse. Just for the Britain alone, we're talking from 1000 to 20000 children per year. If you call that small scale, I will call you crazy.

Per year.

We can all see what the incentives are here. If these people truly acted to protect children, they would almost never actually act, and require truly extreme circumstances before they take a child away. In other words: these organizations would not have any meaningful work to do. Taking and abusing children is a self-reinforcing loop for these organizations: without that, they would shrink and eventually cease to exist. Their incentives are very clear: make the problem worse, and worse, and worse.

Now let's assume for a second that over time, these organizations actually do what's good for them, regardless of any early intentions. Then we would find no end of complaints and stories of the cruelty of these organizations online ...

Oh wait ...

That's exactly what we see. I'm sure it's nothing but a coincidence !

<comment><USER4> That's a massive wall of text filled with claims, many of which seem sketchy at best (1000-20000 children per year in Britain is a huge range for example, the latter number being twenty times the former) and I don't have the time to sort through most of it. One thing did leap out at me however.

 _And yes, child services taking children almost never happens because of actual abuse. Hygiene (as judged by teachers), and parental separation are the main causes (and by that we mean 80%+) of child services interfering with young children. Later it becomes theft (as in the child stealing something)_

That's a suspiciously round %, and I'd love a citation for it. I think it would be helpful to get a sense of where you're getting your numbers while avoiding the pages of opinion and invective.

<comment><USER2> True, I know US authorities are loath to take children away, it takes alot to lose your parental rights. Usually they are surrendered by the parent.

I think the poster above you is a sensationalist, but those sort of things, and the things happening in the article are based on one simple fact: We don't value children.

We will spend money to lock up a juvenile (or adult) before we give resources to poor parents or poor children. We get bad enough results when parents are struggling financially and mentally to provide for their own children. Usually there is some soft of biological imperative compelling them. When you take a stranger and put them under the same sort of pressure while expecting them to care for children of others, who may already have significant behavioral problems, you are asking too much.

This is obviously going to attract the wrong sort of people, and the right sort of people will be influenced by them and frustrated in their own right.

It sounds like this school was a world unto itself. Kids did not participate in activities away from it. This is exactly the sort of thing that brings out the worst in people. I know this offends homeschoolers, but every child should have some outside authority they trust. Those authorities should be a mix of religious and secular.

<comment><USER3> > This is obviously going to attract the wrong sort of people, and the right > sort of people will be influenced by them and frustrated in their own right.

This is a very important thing to internalize: whatever your arrangement. Any position that's given power over others, or over children, or over mental patients will attract exactly the sort of people that are the worst possible case to have such power.

Power over others ? Bullies, torturers, rapists.

Power over children ? Paedophiles.

Power over mental patients ? Bullies, torturers, rapists.

So any child care system, mental health system and prison system needs to be designed so that even with a group of paedophiles taking all the decisions (which WILL be the case, as demonstrated above) the system does not lead to abuse.

Is it the same in the US ? You bet [1]. What do US child abuse/child protection services do when caught molesting children ? They cover it up and protect the guilty. From that wikipedia page:

"Several lawsuits were brought in 2008 against the Florida Department of Children & Families (DCF), accusing it of mishandling reports that Thomas Ferrara, 79, a foster parent, was molesting young girls.[36][37] The suits claimed that even though there were records of sexual misconduct allegations against Ferrara in 1992, 1996, and 1999, the DCF continued to place foster children with Ferrara and his then-wife until 2000.[36]"

"In July 2002, the federal court granted plaintiffs' experts access to 500 children's case files, allowing plaintiffs to collect information concerning harm to children in foster care through a case record review.[42] These files revealed numerous cases in which foster children were abused, and DYFS failed to take proper action. On June 9, 2004, the child welfare panel appointed by the parties approved the NJ State's Reform Plan."

(note: no action was taken to punish the guilty. There was simply a request for a "reform plan", no mention is made for any checks to a reform plan)

"The foster parent, John Jackson, was licensed by the state, despite the fact that he abused his own wife and son, overdosed on drugs and was arrested for drunken driving. In 2006, Jackson was convicted in Santa Clara County of nine counts of lewd or lascivious acts on a child by force, violence, duress, menace and fear, and seven counts of lewd or lascivious acts on a child under 14, according to the Santa Clara County District Attorney's Office.[32] The sex acts that he forced the children in his foster care to perform sent him to prison for 220 years. Later in 2010, Giarretto Institute, the private foster family agency responsible for licensing and monitoring Jackson's foster home and others, was also found to be negligent and liable for 75 percent of the abuse that was inflicted on the victim, and Jackson himself was liable for the rest.[32]"

"In 2009, Oregon Department of Human Services agreed to pay $2 million into a fund for the future care of twins who were allegedly abused by their foster parents; this was the largest such settlement in the agency's history.[34] According to the civil rights suit filed on request of the twins' adoptive mother in December 2007 in U.S. Federal Court, the children were kept in makeshift cages—cribs covered with chicken wire secured by duct tape—in a darkened bedroom known as "the dungeon." The brother and sister often went without food, water or human touch. The boy, who had a shunt put into his head at birth to drain fluid, did not receive medical attention, so when police rescued the twins he was nearly comatose. The same foster family previously took into their care hundreds of other children over nearly four decades.[35] DHS said the foster parents deceived child welfare workers during the checkup visits.[34]"

Apparently checkup visits in Oregon miss the fact that children are kept in cages.

Needless to say, all of the above cases make it very, VERY clear that only the minutest tip of the iceberg was actually caught. Serial paedophile works for Florida CPS, gets 400 children ... and abuses a single one ? Riiight. Let's realistically assume he violated half of them. That would mean about 0.5% of child abuse in child protective services in the US is actually caught.

In all cases, child rapists working for CPS in at least 4 states were each given hundreds of children, dozens per year. At least 78% of those, according to [2], were never sexually abused by their parents, and a further 11% were only abused in the sense that there was inadequate supervision, or their parents got drunk). Given that the above cases alone would reasonably be ~800 children that were abused, we can assume that 89% of those, or 716 were abused _because child protective services protected them_. That's for a period of about 8 years, and only the very tip of the iceberg, cases famous enough to be very widely reported. How many cases are like that ? 1% ? 10% ?

10% would mean that of all children child protective services takes in (~500000) about 15% get sexually abused, versus 0.08% of children in the general US society (0.009 * 0.09, according to the wikipedia page), or CLOSE TO 18518% MORE THAN WOULD BE ABUSED WITHOUT CHILD PROTECTIVE SERVICES

1% would mean that of all children child protective services takes in, about 1.5% get sexually abused, or about 20x more than if child protective services did not exist.

You know, the amount of children that child protective services gave to these convicted paedophiles in these very public cases (in half the cases WHEN THEY KNEW THOSE WERE CONVICTED PAEDOPHILES) is about equal to the total number of children sexually abused in the United States. So if the above cases are all there is, that would mean that at least half of the children sexually abused in the US get abused because Child protective services exists.

Which of course, creates a bigger need for more child protection. Where else could a paedophile go where the damage they do gets them more children ?

That's the result of creating an organization that's such a ridiculously tempting target for paedophiles.

And given that you're right, Europe does a lot more interfering, which would mean that in Europe the situation should be worse, not better.

Thanks for pointing me to the US. Much more numbers available. Sad, very, very, very sad numbers.

[1] [https://en.wikipedia.org/wiki/Foster_care_in_the_United_Stat...](https://en.wikipedia.org/wiki/Foster_care_in_the_United_States#Abuse_and_negligence)

[2] [https://en.wikipedia.org/wiki/Child_abuse#United_States](https://en.wikipedia.org/wiki/Child_abuse#United_States)</comment></comment></comment></comment></comment></comment></comment>


Ask HN: What gift could one buy a semiliterate 14 y/o boy returning to school? - <AUTHOR> I'm staying in Lahore, Pakistan.  I met the 14 y/o son of friend's servant.  The story is that he dropped out of school about 6 years ago, and wants to go back.  He'll be starting off with basic reading, writing, and arithmetic.  I was thinking I might buy him a small gift to encourage his learning.  Any ideas on what could make a meaningful, appropriate gesture to a kid in this situation?  I've never met a 14 y/o who couldn't read well, and I have not idea what to offer. <comment><USER2> Unsure if this would even be possible. Perhaps the following would be more effective/motivational.

Figure out whatever it is that the boy likes, whether is in relation to learning/reading or not, and give him a toy in that subject. However, when you give him that gift, tell him something along the lines of this: "What you are about to do, going back to school, learning something new, is _the most important thing_ you could do for yourself. Endeavoring to become the best possible version of yourself is the most noble pursuit for any person. I could have given you an education gift, something symbolizing the path upon which you are currently set. However, I am gifting you something of which I am told you are currently interested, because what we are celebrating here today is you, not just the path upon which you are currently progressing. We are celebrating 'you', and all of that you may become."

Anyway - just a thought, I am still learning how to motivate my own kids and have found similar approaches unexpectedly successful.

{edited obvious typos}

</comment><comment><USER3> It might be better to ask someone in the local area, since they'd have a much better idea of what would be a useful and culturally appropriate gift.

</comment><comment><USER4> A Kindle?

To make reading more something cool and fun.</comment>


HTTPS Support Launching Now - <AUTHOR> http://central.sonatype.org/articles/2014/Aug/03/https-support-launching-now/

<comment><AUTHOR> This is Sonatype's response to the earlier "How to take over the computer of any Java (or Clojure or Scala) developer" concerns and discussion [1]. I'm very relieved they've fixed the big problem there, as having so much infrastructure reliant on plain HTTP was a giant hack waiting to happen.

[1] [https://news.ycombinator.com/item?id=8099713](https://news.ycombinator.com/item?id=8099713)

<comment><USER2> I've got to say, it is definitely refreshing to see a company just quickly give a mea culpa and fix the problem rather than doubling down and arguing about the reasons for the problem to have existed in the first place. I definitely have more respect for them for doing this (even if they should have been doing it all along, at least it's a correct response to the criticism).

<comment><USER3> They do blame the reason they didn't do it on the lack of demand from the users.

</comment></comment></comment><comment><USER4> > extremely short turnaround time

Come on, please. Sonatype had HTTPS intentionally only for Nexus/Artifactory/… users since at least 2007.

</comment><comment><USER5> Except that this does not really give you that much security. Maybe only in the transport, but certainly not verification of content.

HTTPS (or SSL/TLS for that matter) only verifies the identity of the server the content is coming from. Since users can upload stuff to repositories on Sonatype, there is no verification of content whatsoever.

A naive workaround of this is to use PGP signed content. This would work, if users actually verified the PGP signature through a third channel. Either using web of trust, or some other means of getting a verification that the PGP key actually belongs to the developer.

Failing that, HTTPS is just snake-oil security here.

<comment><USER6> No measure taken in isolation will give you "that much security". As you say, validating the identity of the artifact signer is an extremely important and oft-missed measure, but that should not lead one to conclude that transport layer security (both confidentiality _and_ server authentication) is unimportant or "snake oil".

I will give you that web PKI sucks, but I would rather have a bit more assurance (even if imperfect) that the site I'm pulling artifacts from is indeed the one I intended to retrieve them from, even if I have a good signature + signer verification mechanism in place.

</comment></comment><comment><USER7> Thanks guys for the great work!

</comment><comment><USER3> Is it enough? [http://blog.bintray.com/2014/08/04/feel-secure-with-ssl- thin...](http://blog.bintray.com/2014/08/04/feel-secure-with-ssl-think-again/)

<comment><USER8> The author seems to forget that a key server makes no validation assurances, it just hosts said key.

There are various other flaws in it and he doesn't seem to understand how the PGP WoT works...

<comment><USER3> The author of what?

<comment><USER9> Presumably the post you just linked to

<comment><USER3> Well, in that case @iancarroll didn't read the post. What he claims I don't understand is exactly what the post says.

<comment><USER10> I think @iancarroll is pointing out that you seem to be conflating signature and identity verification. They are different concerns, yet both are both necessary for secure software distribution.

Fine if you reject web-of-trust style identity verification, but your notion of "web identity verification" is not in any way a good substitute for code signature verification. What if someone compromises your hosted repository? Unless your artifact were already cryptographically signed, no amount of identity verification is going to help you.

<comment><USER3> That's very true. That's why Bintray has both "web identity verification" and pgp signing, while Maven Central gives you signing only, without a way to really identify the author.

<comment><USER11> Fwiw, Bintray requires the private key and passphrase to do the signing. This isn't really proper key handling and has been pointed out before.

<comment><USER3> Brian, how ignorant of you (again). The docs on signing are public, you could read before spreading FUD.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Public shaming works!</comment>


What if anything have we learned from C++? [video] - <AUTHOR> https://www.youtube.com/watch?v=2egL4y_VpYg <comment><USER2> I started programming in C++ in the late 90's and I used to be confused about what features to use and found it easy to make a mess.

But I am happy I stuck with it as it opened up opportunities to work in a lot of different and interesting domains like games, mobile apps, interactive art installations, trading systems and video and film processing apps. Also, most of my code is platform independent and very efficient.

There are a few interesting alternatives at the moment, namely Rust and Swift, but for now C++ does everything I want and since C++11 it really feels like a much more modern language.

<comment><USER3> This is also something that I like. In my opinion, the programming languages environment is ridiculously fragmented, and one has to learn new tools constantly in order to keep up, without gaining any real benefits.

I would prefer it if we had several strong, open langauges that are complements to eachother and which would own the market so developers could focus on solving problems, not learning syntaxes and APIs. Instead we have C# and Java, Python and Ruby, etc.

<comment><USER4> [https://xkcd.com/927/](https://xkcd.com/927/)

I'd rather see greater interoperability to enable parts of a project to be written in different languages. The C# ecosystem (F# etc) is closest to this, although see also Scala.

</comment></comment></comment><comment><USER5> "most researchers prefer an inefficient language because it's easier to get a paper to improve an inefficient language... I've seen dozens of papers on getting lisp almost as fast as C++, on getting Java almost as fast as C++. You can't do that with C++".

A paper from the man himself on getting a type switch in C++ almost as fast as what you get in OCaml. [http://www.stroustrup.com/OOPSLA-typeswitch- draft.pdf](http://www.stroustrup.com/OOPSLA-typeswitch-draft.pdf)

Lot's of other places where he's omitting things because he wants to plug C++.

Also, he also seems to be confused between "an efficient language" and "a language that allows you to create something that runs efficiently".

<comment><USER6> It appears according to the abstract that it beats other languages while being implemented as "just a library":

"Our library-only implementation (...) For many uses, it equals or outperforms equivalent code in languages with built-in type-switching constructs, such as OCaml and Haskell"

In my opinion major weakness of C++ is just that the linker features more or less remained out of the language design. Turbo Pascal already shown eons ago the advantages of having modules instead of obj files. The slowness of compilation is still the major problem of C++ compared to the languages like Turbo Pascal and more recently Go.

<comment><USER5> figure 5 in the paper.

</comment></comment></comment><comment><USER7> I really wish there was a "syntactic-sugar-on-top-of-C++" language that would compile down to C++ and have 100% compatibility with the existing C++ ecosystem (so that you can just directly use a class from any C++ library).

Something like TypeScript is to JavaScript, or like Kotlin is to Java. Would make the experience much nicer without having to wait on the slow C++ standardization process or deal with all the backwards compatibility baggage from the past (to a degree).

<comment><USER8> Compiling to C would be better. Using C++ libraries from anything outside C++ compiled by the same exact compiler and same exact version of it as the library was is a royal pain.

On the other hand using C libraries is super easy from any language and something compiled 10 years ago still works today.

<comment><USER9> You only get ABIstab in C if you never change the size or layout of your structs, or completely hide everything behind pointers and allocate everything on the heap (maybe a little on the stack if your library is amenable to using callbacks - blargk!). The rules[0] for C++ aren't really any different, you just notice it more. When you start shooting for ABIstab, without putting in a lot of extra work, you start losing the nice semantics and APIs you're used to. In the C world, because of the limited capabilities of the language, library developers have never been able to do better, so application developers are used to suffering crappy APIs and working extra hard to get stuff done.

C++98 code out of GCC has been ABI stable for over 10 years now btw, and we also have some pretty great tools for detecting ABI breakage now, like abi- compliance-checker[1]

[0] [https://techbase.kde.org/Policies/Binary_Compatibility_Issue...](https://techbase.kde.org/Policies/Binary_Compatibility_Issues_With_C++#The_Do.27s_and_Don.27ts) [1] [http://ispras.linuxbase.org/index.php/ABI_compliance_checker](http://ispras.linuxbase.org/index.php/ABI_compliance_checker)

<comment><USER10> > You only get ABIstab in C if you never change the size or layout of your > structs

Well, and you can append new elements to a struct and are guaranteed that the initial sequence of common elements is identical. This is not mentioned explicitly in the C language standard, but it follows as a corollary from point 220.127.116.11.5 of the language standard:

> One special guarantee is made in order to simplify the use of unions: if a > union containsseveral structures that share a common initial sequence (see > below), and if the unionobject currently contains one of these structures, > it is permitted to inspect the commoninitial part of any of them anywhere > that a declaration of the complete type of the union isvisible. Two > structures share acommon initial sequenceif corresponding members > havecompatible types (and, for bit-fields, the same widths) for a sequence > of one or moreinitial members.

Consider

a.h

        struct a { char aye; short bee; int cee; long dee; };

a.c

        #include "a.h"
        int aye(struct a a) { return a.aye; }

b.h

        struct b { char aye; short bee; int cee; long dee; double eee; };

b.c

        #include "b.h"
        int bee(struct b b) { return b.bee; }

Now if we add c.h

        #include "a.h"
        #include "b.h"

        union ab {
            struct a a;
            struct b b;
        };

The language standard warrants, that the common initial sequence of both structures can be used interchangeably in that union. Since however compilation units a.c and b.c are processed individually without knowledge of union ab this enforces the compiler to use the same memory layout for an initial sequence of member elements for either struct. Hence it is legal to extend structs without out altering the memory layout of the previous elements.

<comment><USER9> You get the same guarantee in C++, as well as a language mechanism to exploit it (inheritance). You still can't pass structs by value across library boundaries in either language without fixing your ABI though. This isn't a language intrinsic problem: it boils down to the linker model, which only C and C++ share.

<comment><USER10> > This isn't a language intrinsic problem: it boils down to the linker model, > which only C and C++ share

The linker coudln't care less about this part of the ABI (calling conventions). For example passing a function pointer to a different library (callback) the linker is completely oblivious to. Heck, the functions which pointers are being being passed around could have been compiled at runtime (JIT).

Calling convention ABIs are a compiler thing, as it's the compiler that emits the machine code that's responsible for setting up the frame in which a function executes. And calling conventions is, where C and C++ differ. On the language level there are not calling conventions (how could there be, as those strongly depend on the machine architecture). However for the various operating systems out there you can find detailed calling conventions for C, but seldomly for C++. And these platform specific C calling conventions usually tightly control both how function (stack) frames are created, which registers may be clobbered, but they also control the memory layout that a C compiler for that platform shall apply on structs. For example the SysV AMD64 ABI strictly nails down the specifics of aggregate type memory layout and function parameter passing. All compilers following that spec will produce code that's compatible with each other, even across library boundaries.

</comment></comment></comment></comment></comment></comment><comment><USER11> After twenty years of using it? That I was wrong, that plain-old C really is better.

<comment><USER3> I hold the exact opposite opinion, and would never want to work on a plain C project. It is so low level that one has to write a lot of plumbing code to take care of error handling and resource management. It's also missing pretty much all higher-level concepts that are fast and can make code easier to write, read and less error-prone. Overall, it's simply not fun to write C code, there's a lot of tedious manual work, and even if you do everything according to the book you might oversee something and have problems. Well- written C++ completely eliminates some classes of problems, just like Rust's type system can eliminate even more issues.

C is so tedious to write that even if I didn't have access to C++ I would try something else first when the need to write cross-platform/performant code would come.

The point is: it's not appropriate to evangelise C (or any other language) without pointing out some of its major disadvantages. This is simply spreading misinformation.

<comment><USER12> >plumbing code to take care of error handling

This becomes much simpler once you learn how to write your own variadic functions (it's not that hard, though I do admit it could be prettier). Then you just write one single logerrf function or whatever, which 9 times out of 10 you can carry with minor modifications to your next project. Java does try/catch better in the sense that with checked exceptions you can force library users to at least acknowledge exceptions. Without checked exceptions, try/catch just hides the extra int *err argument under the rug, actually increasing the risk of library users not acknowledging edge cases.

>and resource management

I don't like C++ malloc'ing things behind my back. I see it as trading maintainability for instant gratification. The problem is compounded by the way C++ doesn't play nice with gdb/valgrind. Memory leaks and other memory errors are much easier to fix in C than C++.

>C is so tedious

It really isn't, though, if you use it right. Whatever syntactic tedium it has is more than compensated for by the lightning-fast compile time and the infinitely simpler compiler errors (due to no overloading, no templates...)

<comment><USER13> "I don't like C++ malloc'ing things behind my back. I see it as trading maintainability for instant gratification."

I agree and I want to add that for a language "with a bias towards system programming" C++ makes strange assumptions about the memory. It assumes that there is only one kind of memory available for every operation (and it does its thing with that by default). Then it goes and further assumes that there is only one way (no finer further details whatsoever) of getting that one and only type memory. It's exactly the _one boot fits all_ kind of thinking that Mr. Stroustrup suggests that C++ hasn't.

</comment></comment></comment></comment><comment><USER14> Don't leave it forever to introduce a proper module system. Textual inclusion and manual header file maintenance is bronze-age programming.

</comment><comment><USER15> Lua is my C++. If I need speed - I'll just write it in C and interface to the Lua environment.

</comment><comment><USER16> That introducing kids to programming using C++ will ensure they never want to try again.

<comment><USER17> I was introduced to C and then C++ when I was 10 years old. I found the book on C by Arthur Chapman very confusing, particularly pointers. I then started reading a book on Pascal in the same series and that was confusing too.

But I stuck with it and have found that learning C++ has meant that I think in C++, and transfer this to other languages when I have to write them.

Additionally, the second thing I found was that all other languages I have come across (Obj-C, Java, Swift, JavaScript, PHP, C#) all have enough commonalities in syntax and thought processes that working in them is easy. In some cases, you get to consider them "dumbed-down" C++, and it makes working in them easier (and means approaches to things are different).

So it isn't a bad language after all. Particularly with the changes in C++11, it feels like an entirely new language.

<comment><USER16> I went the other way. I was introduced to programming at university, although not in a computer science degree. The professor believed in the hard way, so using some old Unix machines (it was in the 2000s), writing C++ in the equivalent of a notepad, and "debugging by printf".

Though I was keen on getting into coding, I was like many other students put off by this approach and only went back to programming many years later with visual basic.

I appreciate that one gets a better understanding of computer science by going really low level (assembler, etc) but I question whether this is the right approach if one wants coding to be more mainstream.

I think coding should be taught in high school like latin or physics, not because kids will all become programmers, or historians or scientists, but because having a basic understanding and culture will help in everyone's life and it gives kids a taste for what a career in that field may look like. And I don't think C++ is the right tool for that.

</comment></comment></comment><comment><USER18> This video was more engaging than I was expecting. To the point that I am not sure what I was expecting.

There did seem to be too much apologizing for how other people messed up the original idea of C++. Same for patronizing much of the industry. I can't claim it was unwarranted, but a lot of patronizing.

</comment><comment><USER19> I still hope someone will do transcript for it. Slides are missing some parts from talk.

</comment><comment><USER20> No matter how elegant things are, the garbage collected, the pointers untoucheable, the libarys all optimized and readymade and the code jit- compiled to get near C - on the day your C ustomer demands that one feature too much - you want to have C ontroll.</comment>