How Facebook tracks you on Android [video] - <AUTHOR> https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android/ <comment><USER2> We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy".

The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a shared filesystem.

Mobile apps, despite platform API permission, and having some ability to protect their own data, are a lot closer to desktop programs than web apps in many regards.

<comment><USER3> While you make good points about mobile apps, don't be too spoiled by the privacy offered by destop browsers. Because of their configuration and various APIs, they're almost as easy to fingerprint as mobile devices with advertising IDs.

EFF has had a proof of concept online for quite a while [https://panopticlick.eff.org/](https://panopticlick.eff.org/)

And HN users are probably even more vulnerable since we will have customized our software making it stand out.

<comment><USER2> I know you're not disagreeing with me, but the issue you raise only distracts and lends ammo to the defenders of these prolific tracking mechanisms. It's the Nirvana fallacy.

I'm sure there's a Google rep somewhere that will tell you that their "advertising ID" is better than the status quo on the web because the user can rotate it and, because it's reliable and easy for app devs to use, they are discouraged from being more nefarious and sneaky in tracking users.

This is all a bloody distraction from the point: _it should not be an acceptable norm for this tracking to happen and it should be as hard as possible to pull off without informed user consent_.

The degree to which platforms are defensive against it is a different issue to whether or not they actively encourage it by design... which shouldn't even be open to debate.

<comment><USER4> Anybody suggesting technical solutions to this problem is completely misunderstanding the scale of it.

The only acceptable answer is a legal/regulatory solution.

<comment><USER5> So honest question, how does a legal/regulatory solution protect users against illegal bad actors, foreign actors, or malicious projects and frameworks that are either Open Source or that aren't backed by a company?

I hear this argument brought up a lot, that the only thing that can fix this is regulations. I've always come at this from the opposite direction -- regulatory solutions are nice, and I'm not _against_ them, but they're less useful than technological solutions because my gut instinct is regulations only cover a) law-abiding entities (and usually only corporations at that), who are b) competent enough not to mess up compliance in the first place.

The perspective I lean on by default is that even if you have good regulations in place, the problem isn't _really_ solved until there's a widespread technical solution. So for example, it might be nice to have a law banning MITM attacks, but HTTPS is the superior solution that we really want. When we pass laws criminalizing stuff like hacking or tracking children, my perspective is we're just trying to buy time and localize the damage to the slightly less frequented parts of the Android app store while we fix the crappy permissions models and sandboxing on our core platforms.

Is there a secondary aspect to the regulatory solutions that I'm missing? Something that would go much, much farther and be much stricter than laws like GDPR? I don't mean it as an argument, I'd just be curious to hear someone with the regulation>infrastructure perspective elaborate more on what they're thinking about when they say that, because it's a perspective I don't have much experience with.

</comment></comment></comment></comment></comment><comment><USER6> I seriously loathe the people hating on the web. On the web one can preview, debug, and block stuff at each application and network layer. Use Lynx, disable JS, install ad and tracking blockers, edit hosts file - you are the king. Want to see the true evil? Native Android and iOS applications, there doesn't exist an alternative platform anymore. You think that app is free? Not even web-style in-app advertisements give you a second thought?

<comment><USER7> Anyone else feeling like there is a resurgence in web?

Apps were the hot thing for a while, but now that major players have an app, they have figured out it matters little.

I dont do my shopping on the Target App. I'm sure they are getting economic indicators that web on mobile is just as effective.

<comment><USER8> Yes, it's been happening for a while. Google and Mozilla have been pushing (sometimes rushing) for more capable web browsers while Apple actively protects the exclusivity of some functionalities of it's app store, to the detriment of Safari users, making them feel an even greater gap between websites and native apps.

Originally, smartphones were to be the new way of browsing the web but it turned out to be a new way for OS manufacturers to profit over third-party software because developers had to handcraft a way of accessing their data over the internet from the device given that web browsers were not up to the task of delivering fast, snappy experiences. Developers had to create native apps for the simplest services even if they didn't need the extra functionality and APIs like notifications, background updates or movement sensors.

Today, mostly because of the increase in mobile processing power, the difference between a website and an app for trivial tasks (notekeeping, calendar, ordering a product, whatevs) is innofensive and overall imperceptible, making websites a reliable way of providing functionality once again.

Browser updates and new APIs will increase the amount of possible trivial services you will be able to access from anything with a browser and up-to- date processing power.

</comment></comment></comment><comment><USER9> Is there a blog post or outline that summarizes this talk? I care about privacy, but don't have an hour to watch the whole video.

The conference does provide a useful link to a privacy-centric page which catalogs some known facebook abuses:

[https://privacyinternational.org/types- abuse/facebook](https://privacyinternational.org/types-abuse/facebook)

but there is no outline of this talk which summarizes the methods that facebook uses to spy on their users and the public.

<comment><USER10> TL;DR seems to be that lots of apps include the Facebook SDK and when you initialise the SDK it always sends your device ID back to Facebook.

Most negative news about Facebook is nonsense but this does seem to be pretty shady on Facebook's part.

<comment><USER11> Just speculating, but they might just need this information to combat bots actually.

Think about it, they already know who you are because you are logged in with your account.

They don't need more info than that to run targeted ads.

<comment><USER12> > Just speculating, but they might just need this information to combat bots > actually.

That would be actually quite useful for fighting bots, but I doubt that is the reason.

My guess would be just gathering telemetry to how how API is used, and what type of android devices are there (you know, like to know what you should support and test on).

<comment><USER13> _My guess would be just gathering telemetry to how how API is used, and what type of android devices are there (you know, like to know what you should support and test on)._

In the video it is shown that the information sent to Facebook is far more intrusive than that.

</comment></comment></comment></comment></comment><comment><USER14> This is not unique to Facebook and is true for almost all SDKs, which can track the same events (which this talks mentions), that the app has. Google tracks exactly the same events which FB does as well. Also, the same thing happens on iOS too - not sure why the talk avoided it. Once the app has the SDK for a third party (regardless of OS), tracking all events within the app is fair game.

<comment><USER15> What is your motivation posting this? Because it sounds like a great example of "whataboutism". Just because an evil is done a lot, and in different contexts doesn't make it not evil.

<comment><USER16> Every other comment here boils down to "get an iPhone". If the claim that this is also happening on iOS is true then it's highly relevant to the discussion.

<comment><USER7> Apple users have the need to defend Apple at every turn.

Android users enjoy bashing Google at every turn.

Just like I bash M$ despite loving windows 10 and Excel... (actually I've gotten better about this)

<comment><USER17> Don't worry, I bash Windows 10 and Office too (yes, including Excel), and I'm someone who actively dislikes them. OTOH, the best thing I could say about Apple these days is that iOS is genuinely better built than it's obvious alternatives (Android and ChromeOS) and that they do a tolerable job of supporting their mobile hardware, but that's kinda damning with faint praise.

</comment></comment></comment></comment></comment><comment><USER18> I don't have a FB app on my phone, I have a FB account that has no posts. I look at it occasionally to track my "likes". Last week I was a conference in downtown Boston. I have no connection to the conference, I was there to meet my friend's daughter who lives oversees. While standing in line, people watching, I couldn't help but notice an extravagant fellow, I later discovered he was a an out of town PHD student there for the conference. Imagine my shock when my next web login to FB offered me this very man as a suggested friend!

<comment><USER19> Is there a definitive answer on how these suggestions happen? (Other example: talk about X with someone; start seeing internet ads for X afterwards). Is it coincidence?

<comment><USER20> For every ad or suggestion that elicits that kind of response, how many are completely unremarkable and immediately forgotten? It's largely explained by the survivorship bias.

</comment></comment></comment><comment><USER3> Where are the torrent links?

Anyway, There are more paid tracking SDKs in the wild and probably more invasive than Facebook's.

For example, in Poland there is a service called Cluify which supposedly tracks millions of phones to then target ads at them. Although they're Google ads. In fact, they're a "proud partner of Google."

On the website [https://cluify.com/](https://cluify.com/) they mention using wifi but in sales pitches they boast inclusion in many popular apps. As their client you can geofence an area and buy ads directed at devices which frequent them.

I purged and fumigated most of these parasites from my phone. Going even as far as replacing the OS because LG thought the Facebook app should be an integral part of their distribution and not removable. Hopefully they at least charged Facebook dearly for it.

<comment><USER17> You can use adb commands to "disable" system apps FWIW, all you need is the "developer options" menu, to temporarily enable adb access from USB. This lets you use all the features of a "locked", stock "ROM" (payment services, DRM apps, better camera), and also works on "locked down" devices where you can't unlock the bootloader and install a different OS. Of course, it's only worthwhile if you trust the "ROM" vendor (LG in your case) and can isolate the problem to some specific app(s).

<comment><USER21> This type of control is still possible on android devices?!

I had given up on buying new devices because of how restrictive and abusive phone manufacturers have become towards their customers. If adb can really do what you say it can, maybe I can finally upgrade my phone after all these years. Can you recommend an online article that goes over using `adb` like this? (especially for disabling locked apps)

<comment><USER17> See e.g. [https://github.com/jaredsburrows/android- bloatware/blob/mast...](https://github.com/jaredsburrows/android- bloatware/blob/master/README.md) the "non-root" section. Some tutorials suggest slightly different commands, viz. `pm hide` rather than `pm disable`, and that in order to 'uninstall' apps without root the command `pm uninstall -k --user 0 com.bloatware.app` should be used. Either way, _do_ backup your data before doing any of this stuff (if stuff gets screwed up, you might need to perform a factory reset from recovery mode in order to revert to a sensible state), and _do not_ expect this to always work; it might not, depending on the specific "rom" you're running.

</comment></comment></comment></comment><comment><USER22> I use Netguard ([https://github.com/M66B/NetGuard](https://github.com/M66B/NetGuard)) and block out access to Facebook's Graph API by every app on my phone. Works very well.

<comment><USER23> I did exactly the same thing using NetGuard. It opens your eyes to how much tracking happens with almost every app.

I also block Wi-Fi and mobile data access wholesale for apps like virtual keyboards and most pre-loaded crapware that can't be uninstalled.

</comment></comment><comment><USER24> Android also had an issue where an app could deceive a user by requesting the permission to manage WiFi (CHANGE_WIFI_STATE) which is considered non- dangerous ("normal") [1] and is granted automatically without any prompts [2]:

> If your app lists normal permissions in its manifest (that is, permissions > that don't pose much risk to the user's privacy or the device's operation), > the system automatically grants those permissions to your app.

But the app could use it to determine user's location (by scanning for WiFI access points identifiers) without any notification. So the user wouldn't realise that the app now knows their location.

You can see it in the docs [3]:

> Android 8.0 and Android 8.1:

> A successful call to WifiManager.getScanResults() requires any one of the > following permissions:

> CHANGE_WIFI_STATE

So this issue was fixed only on Android 9, and had been working for years. Any application could secretly determine your location. That's the state of privacy protection on Android. It is difficult to believe that Google developers who are very smart people couldn't foresee it for years.

I googled a little and found a confirmation that this method was working: [4]

[1] [https://developer.android.com/reference/android/Manifest.per...](https://developer.android.com/reference/android/Manifest.permission#CHANGE_WIFI_STATE)

[2] [https://developer.android.com/guide/topics/permissions/overv...](https://developer.android.com/guide/topics/permissions/overview)

[3] [https://developer.android.com/guide/topics/connectivity/wifi...](https://developer.android.com/guide/topics/connectivity/wifi- scan)

[4] [https://blog.trustlook.com/2015/06/02/how-apps-tracking- your...](https://blog.trustlook.com/2015/06/02/how-apps-tracking-your- location-without-asking-for-permission/)

<comment><USER25> _That 's the state of privacy protection on Android. It is difficult to believe that Google developers who are very smart people couldn't foresee it for years._

"It's difficult to get a man to understand something when his salary depends on him not understanding it".

</comment></comment><comment><USER26> Wrangling 3rd party application access to platform providers' suite (ios, android, browser extensions).

Cookies seem to be the majority of the aggregate identity/behavior data, which you can use various rules in the protocol to limit tracking to some extent.

I've found that opting out on a regular basis of the large adverts for a little extra peace of mind.

uBlock/uMatrix Origin, ghostery, duck.com, dns encryption, vpn, ip6.

removing old wireless access points from history/cache and disabling nfc, blutooth advertisement.

removing duplicate/shared passwords from your various authentication providers and using keypass or a secure password scheme that is easy to remember.

Log out manually of various applications such as facebook, google, microsoft, etc.

Contacts list. Clean em' up.

Keep your phone and hands sanitary at all times :)

<comment><USER27> one thing that irks me is ppl blindly suggesting duckduckgo over google

DDG is _fucking horrible_

It doesn't work. I'm almost always going back to Google.

There should be a service that searches Google for you behind 7 proxies.

<comment><USER28> That is searx. Self hosted and fully randomizing. I use it, and it works very well for general web searches

Image search is subtly broken in the packaged releases tho, so you'll either have to hit up google image search or use the git version

<comment><USER27> nice find. that is exactly what I was looking for.

DDG at the end of the day are no more disposed to exposing their users at the behest of the gov than FAANG

</comment></comment></comment></comment><comment><USER29> What are the names of these companies? I would love to send them all a GDPR request asking for my data.

<comment><USER30> With regards to the the findings, I think that'd be the wrong part of the GDPR. The issue is that applications are immediately sending user data to FB without authorization through the FB SDK - it's possible that many of the application developers don't actually have anymore information on you than indicated in the application and/or agreements.

You'll need to ask about their data processors I think.

</comment></comment><comment><USER31> Time for some hefty GDPR fines.

<comment><USER15> Word. And it looks to me like both Facebook and every app dev that includes their SDK is liable.

</comment></comment><comment><USER32> I have a more technical question, It was my understanding that Android apps no longer trusted user added certificates by default starting Android 7 ([https://android-developers.googleblog.com/2016/07/changes- to...](https://android-developers.googleblog.com/2016/07/changes-to-trusted- certificate.html)), but on the talk, they were able MITM Android 8.1, are they modifying the apps to trust their CA certs or is there something I am missing?

</comment><comment><USER33> To block this on android without root, install dns66 from f-droid (an adblocker that emulates a VPN and works with hosts files) and add [https://a.uchi.moe/jwmkqn.txt](https://a.uchi.moe/jwmkqn.txt) as a host file. I think when first installing there still is a 'bug' where you have to edit the url of included Peter Lowe's list from http to https before you can update the lists.

</comment><comment><USER34> I am surprised that on opting out of ad tracking in Android, they found that the opt-out flag was set to true, but the size of the tracking payload shot up i.e. more attributes being tracked. Not sure what to make of it? Is it possible its a legal thing that once you opt-out of ads, it enables less risk for the company and therefore more tracking, perhaps?

<comment><USER35> That would need to be reproduced. I suppose the app itself could also have been put in a different state / with different settings between the two events.

</comment></comment><comment><USER36> The article focuses on FB, but identifies Google as a bigger tracker:

> "Previous research has shown how 42.55 percent of free apps on the Google > Play store could share data with Facebook, making Facebook the second most > prevalent third-party tracker after Google's parent company Alphabet."

</comment><comment><USER37> I wonder how these researchers would have been able to find this out if the servers were not clearly identifiable as being Facebook's.

Also, what happens if Facebook starts to introduce strong(er) incentives for app developers to share user data?

</comment><comment><USER38> Does this also affect iOS? I imagine if the app is transmitting data to Facebook, then there's nothing stopping it on other platforms either.

<comment><USER39> The Kindle app on iOS gets blocked attempting to connect to Facebook every time I open it.

<comment><USER40> Blocked by what?

<comment><USER39> AdGuard Pro with facebook.com and facebook.net added to its DNS blacklist.

When the app attempts to connect to graph.facebook.com it gets NXDOMAIN.

</comment></comment></comment></comment><comment> awinter-py Is anyone grounded enough in the tech/law here to explain why the app vendor doesn't funnel user data to FB from their backend? Connecting directly to FB seems like an unnecessary giveaway.

Is it just about ease of implementation or are there legal implications? People have quoted the wiretap act to me but the argument doesn't make sense.

<comment><USER41> It has nothing to do with law. That's just the easiest way to send them data, especially when some apps might not have back ends

</comment></comment><comment><USER42> I'd like to have an app that creates virtual android environments that I can run my apps in. And the possibility to spoof the sensor data for the environment with configurable profiles. Like "rich geek in Silicon Valley traveling occasionally to Caribbean" or maybe "suburban middleclass housewife in Florida".

<comment><USER43> perhaps you can get close to this goal by

1\. installing the Android dev SDK (complete with emulator images) on to your laptop

2\. having a distinct emulator instance for each of your chosen profiles

</comment></comment><comment><USER44> It's been years since I banned Facebook apps from my phone.

m.facebook.com for the casual check, and mbasic.facebook.com for an admittely crippled but functional access to read the seldom chat message.

I'm happy that Fb Messenger is the tool of choice for 0,0% of people around here...

<comment><USER15> If you watch the talk, that's not good enough. Any app you've installed that includes the FB SDK is leaking your data back to FB. And, according to the talk, that's a majority of popular apps.

<comment><USER17> F-Droid apps aren't going to include proprietary SDKs. Yet another reason to use F-Droid (on Android/AOSP).

<comment><USER45> Tracking may be reduced, but being in F-Droid doesn't really mean anything. Take this on a per-case basis. You would need to check the traffic of each app that you use.

<comment><USER46> Being on official f-droid categorically means no proprietary sdks. The app could still make calls to random servers, but that would be in the open since the app needs to be open source.

<comment><USER47> Is that true? F-Droid usually lists apps that I "won't like" because they include non-free software.

<comment><USER46> F-droid doesn't have non-free software. F-droid flags some apps with anti- features for various reasons like non-free network services ([https://f-droid.org/wiki/page/Category:Apps_with_NonFreeNet_...](https://f-droid.org/wiki/page/Category:Apps_with_NonFreeNet_antifeature)), which is quite useless honestly since it makes no difference even if a remote service is free since you don't control that end. Perhaps historically f-droid allowed non-free dependencies ([https://f-droid.org/wiki/page/AntiFeatures](https://f-droid.org/wiki/page/AntiFeatures)), but I don't think that's a thing any more. I don't see any major apps in that category.

<comment><USER47> Ah, admittedly it has been some time since I've tried to run a completely free Android device so I may have been mistaken.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> lota-putty Using [https://zenz-solutions.de/personaldnsfilter/](https://zenz- solutions.de/personaldnsfilter/) without rooting doesn't help? Hard-Coded IPs can't be blocked presumably without rooting(iptables) ;-)

I get "0" Ads on my Android, also I'm a bit paranoid, I block every suspicious domain, only allowing Mobile/WiFi access to trusted apps.

Sadly this behaviour is easy to fingerprint.

</comment><comment><USER48> I decided to try to replicate this on my iPhone and looks like Acrobat Reader and the Readdle PDF viewer both use Facebook SDK and send data automatically.

</comment><comment><USER29> Side note: I noticed that these days articles from Chaos Computer Club get into the top quite often?

<comment><USER49> It is because of 35c3: [https://events.ccc.de/congress/2018/wiki/index.php/Main_Page](https://events.ccc.de/congress/2018/wiki/index.php/Main_Page)

</comment></comment><comment><USER50> Whats a good, slim solution for a VPN I can setup on my host to filter these tracking sites?

I already have OpenVPN set up, does it have filtering features that could help block this unwanted traffic?

<comment><USER51> I have heard people use pihole linked with a VPN to act as a way of minimising tracking whilst on 3G/4G. It acts as a DNS server, so you could tweak your VPN config to run all queries through your pihole instance.

</comment></comment><comment><USER52> Facebook + google android = data harvesting dream come true for these companies.

</comment><comment><USER53> YouTube link for folks who are having buffering issues [https://www.youtube.com/watch?v=vYam1GqtoLY](https://www.youtube.com/watch?v=vYam1GqtoLY)

<comment><USER54> I get 'video removed by user' with that url.

<comment><USER53> They seem to have reuploaded the video in YouTube channel.

[https://www.youtube.com/watch?v=y0vlD7r-kTc](https://www.youtube.com/watch?v=y0vlD7r-kTc)</comment></comment></comment>


Show HN: PleasantFish Apply to best jobs by showcasing your skills and qualities - <AUTHOR> https://www.pleasantfish.com/ <comment><AUTHOR> Hi

We are thrilled to introduce you to PleasantFish, a job recruitment platform for top tech professionals.

Pleasant Fish is a job marketplace for top professionals. It allows them to showcase their skills and capabilities (reviewed through their coworkers) and apply to the matching jobs relevant to their skill-set. Its a reverse of GlassDoor as it gives insights about potential candidates and their performances at their previous workplaces reviewed only through their coworkers anonymously.

How it works?

\- Candidates lists down their current skill-set and ask their colleagues to give them private/anonymous reviews. \- We provide candidates with relevant jobs based on their skill-set. \- Employers/Recruiters can see get insights about their potential candidates from their coworkers. \- Candidates also improve upon their skills through custom skills-related content network handpicked from best sources.

Looking forward to hear your feedback!

</comment><comment><USER2> It might be interesting to read a blog post about PleasantFish's history and development and scaling.

<comment><USER3> Here you go brudgers :)

[https://medium.com/@aliibrahim_36896/story-of- pleasantfish-a...](https://medium.com/@aliibrahim_36896/story-of-pleasantfish- a-professional-growth-platform-c2d1364ff73b)

Looking forward to your feedback!</comment></comment>


List of Patterns in Computer Languages - <AUTHOR> https://codelani.com/lists/patterns.html <comment><USER2> My money is on C++ as the winner for "language which supports the most number of these patterns".

<comment><USER3> Either C++ or typescript I believe they are the two most featurefull programming languages to exists

</comment></comment><comment><USER4> From line 5:

> psuedoExample

should be _pseudo-_. Then I looked at the language page on C. The second sentence begins

      C (, as in the letter c) is a

which seems to be a wikipedia quote, so I looked. Wikipedia has

      C (/siː/, as in the letter c) is a</comment>


Software Engineering ≠ Computer Science (2009) - <AUTHOR> http://www.drdobbs.com/architecture-and-design/software-engineering-computer-science/217701907 <comment><USER3> Software engineers need to know to recognize and classify problems in CS. You need to know what algorithms and data structures exist, what their properties are, and what they are called. The areas that come up will come from Math and Computer science (which are closely related). A solid computer scientist person knows how to derive some Dijksttra algorithm from first principles. A good software engineer _recognizes_ the problem at hand, and recalls the algorithm to pick when presented with the problem.

What is that problem in front of you? Gradient descent? Tree traversal? Multiple dispatch? Path finding? What structure represents the data or algorithm? Ring buffer? Blocking queue? Bloom filter?

You rarely need to remember a pathfinding algorithm or trie implementation by heart. What's important is that you a) recognized the problem at hand as "path finding", "bin packing" or whatever. Terminology is _important_ here. The good software engineer needs to know the proper names for a LOT of things. Recognizing and labeling problems means you can basically look up the solution in no time.

So CS is definitely very relevant for software engineering - but you need a broad understanding instead of a deep one.

There is always the argument that a lot of devs basically to monotone work with SQL and some web thing in node and rarely even reach for a structure beyond a list or map. That's true - but sooner or later even they bounce into a performance or reliability issue that's basically _always_ due to incorrect choice of data structure or algorithm. I'm only half joking when I suggest that most of todays "scaling" is compensating for CS mistakes in software.

<comment><USER4> Eh, I'd much rather "software engineers" had good product and business sense, since most product managers and CEOs sure don't. No point in building the wrong thing well.

<comment><USER5> If the product managers and CEOs don't have it, how do you expect the software engineers to do better? That isn't our area of strength.

<comment><USER4> Problem solving is our area of strength.

</comment></comment></comment></comment><comment><USER6> I don't understand why the author is so suspicious of formal methods. Other engineering disciplines are based on the application of solid, well-understood principles from the natural sciences to practical problem domains. There are few solid, well-understood principles in computer science that are directly and obviously applicable to software engineering so far.

I vigorously contest the idea that software engineering cannot be rigorous and so shouldn't try.

<comment><USER7> Because there are what, six types of bridges? (EDIT: 36 according to wikipedia.)

There are six _thousand_ types of programs (as a wild guess), and they all interact with each other in an exponential explosion of complexity.

For a formal method to work, it has to be generally applicable across a wide range of situations. There are methods like that in software engineering, and you see them in situations where the program is potentially life-threatening. But most programs would be hindered by this rigor.

<comment><USER6> I'll put it this way. In mathematics, the atomic unit of progress is the proof. Proofs are constructed from axioms and other, smaller proofs. The Curry-Howard correspondence is the direct correspondence between computer programs and mathematical proofs.

When programming in a well-typed language, everything we do is a degenerate proof of something. I think it's entirely reasonable to try and make it easier to make less degenerate proofs, and encourage the re-centering of proofs as the atomic unit in programming, because they are for programming (as in math) a well-defined, solid formal system that solid systems can be built on in a way that nothing else can be in software, at least thus far.

In a world where software flows more freely than water, the correctness and reliability of software systems must be taken with utmost seriousness. This applies to basically any tool that contacts end users, and a lot of ones that don't as well.

What do you propose as the theoretical basis for the engineering science of software development?

<comment><USER7> I think it's self-evident that there is no theoretical basis for software development in the way that would satisfy your criteria. Software dev is generally a scattershot haphazard endeavor that involves trying dozens of angles until one of them works. That's an unsatisfying answer, but if we try to hide from the implications just because we don't like it, we'll end up creating companies that fail to startups without these constraints.

It's also self-evident that in most situations, correctness and reliability aren't a concern. The counterexamples account for maybe 1% of the field. 99% of the time, if your program breaks, you can pay someone to go fix it and no serious harm was done. Even Github outages, which affect almost all of us, hardly matter.

<comment><USER8> I havent thought of this before but i was a mathematician that does software engineering, and Im starting to see some stark similarities between a mathematical proof and a "test" as in a unit test. I imagine if you went down this road you would end up with something very similar if not identical to TDD. What i was hoping this thread would discuss is how to turn software design patterns like the adaptor or factory patterns into a science in the same way that differential topology turns differential equations from a haphazard collection of methods into a rigorous science. I dont know why more people havent focused on formulating this more practical side of software engineering. Why is it that SOLID works so well, etc

<comment><USER9> Dijkstra spent a lot of his research effort on ways to prove that programs are correct.

"Today a usual technique is to make a program and then to test it. But: program testing can be a very effective way to show the presence of bugs, but it is hopelessly inadequate for showing their absence. The only effective way to raise the confidence level of a program significantly is to give a convincing proof of its correctness."

[https://www.cs.utexas.edu/users/EWD/ewd03xx/EWD340.PDF](https://www.cs.utexas.edu/users/EWD/ewd03xx/EWD340.PDF)

<comment><USER10> "I don't need to waste my time with a computer just because I am a computer scientist." \- Dijkstra

<comment><USER11> This basically describes the dichotomy between CS and software engineering.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Here's the graphic transcribed as text for non-English speakers.

Software Engineering: Requirements, Modifiability, Design Patterns, Usability, Safety, Scalability, Portability, Team Process, Maintainability, Estimation, Testability, Architecture Styles.

Computer Science: Computability, Formal Specification, Correctness Proofs, Network Analysis, OS Paging/Scheduling, Queueing Theory, Language Syntax/Semantics, Automatic Programming, Complexity, Algorithms, Cryptography, Compilers.

In my opinion, some of those could be on the other side of the line (estimation could be CS, language syntax/semantics and network analysis could be SE). But I agree with the general division.

I studied Electronic Systems Engineering, but somehow always found jobs in software companies. One problem I struggle with is the division between DRY (Don't Repeat Yourself) and WET (Write Everything Twice) coding styles.

Most programmers hate it when code is repeated. They prefer to spend days trying to integrate external libraries instead of just copying the necessary functions into the main branch. There are good reasons for this (benefiting from new features when the library gets updated), but there are also risks (the code breaking when the library gets updated).

Software Engineering priorities include Safety, Portability, Modifiability, and Testability. I interpret that as a WET programming style. "If you want it done well, do it yourself." There's no arguing about responsibility then - <USER2> code is mine, and I should fix it if it breaks.

<comment><USER13> > _but there are also risks (the code breaking when the library gets > updated)._

This is the entire _point_ of Semantic Versioning: to communicate breaking changes through the version number, and to build tooling to programmatically avoid breaking dependent code.

(No, it isn't generally perfect: it does require that human realize what the API is that that a given change is breaking it. If we had some programmatic language for specifying the API… type systems start this, but tend to not capture everything¹)

¹I suspect there are some formal analysis folks who know more than I do here, screaming that there is a better way. I work in Python day-to-day, so generally, it's _all_ on the human.

<comment><USER14> See this talk [0] about this addition to Clojure called core.spec [1]. I read the paper first, and it isn't until the end of the presentation that I understood how it was related to the feature at all. Basically, core.spec is a kind of formal verification tool designed to deal with the growth of software. It is _not_ a type system, though it resembles one in some ways. The objective is to support comparisons between the signatures of a function at two different points and say, are these compatible? Is this a breaking change? You have to design for growth: make no assumptions about unspecified keys and always assume that later versions may return _more_ than they used to. And so on.

If you're a fan of semver, be warned.

[0] [https://www.youtube.com/watch?v=oyLBGkS5ICk](https://www.youtube.com/watch?v=oyLBGkS5ICk)

        https://news.ycombinator.com/item?id=13085952

[1] [https://clojure.org/about/spec](https://clojure.org/about/spec)

</comment></comment></comment><comment><USER15> I've seen similar articles to this one, both in print and on web sites. I used to explain it to people as the difference between 'coders' and 'engineers' but I think my own hubris at having a degree got in the way of my thinking on it.

Over the decades I've met a bunch of people who program computers for a living, and there is clearly a spectrum where on one end is a person who spends the weekend benchmarking different sort algorithms under different conditions for the fun of it, and the guy who left the office at 5PM once an integration test passed on a piece of code that he pasted in from stack overflow was deemed to have no regressions. There are many different disciplines that have such a wide dynamic, from chefs who spend their weekends trying different flavors to cooks who take frozen patties out, reheat them and serve. Painters who throw human emotion into a painting and painters who lay down a yellow line on a road according to a template for $20/hr.

It seems to me that most, of not all, of the 'theory' stuff in computer science is just math of one form or another. This is not unlike all the 'theory' stuff in electrical engineering is just physics. You can do the tasks without the theory, but you rarely invent new ways of doing things without that understanding.

But just like carpenters and architects there is a tremendous amount of depth in the crafting of things. That brilliance should be respected, college trained or not, so trying to 'split' the pool doesn't lead to any good insights about what being a good engineer is all about.

<comment><USER16> You seem to be labeling overworking as "good" and in-time as "bad"... Here's an alternative perspective - I've seen underperformers who try to make it up by staying late and even allocating weekends for their employers, on the other hand, I've seen brilliant engineers who do the job and leave the office at 5PM, spending personal time on recreation, including learning other tech/stuff not relevant to their employers...

<comment><USER17> That's because you just fixated on the 5PM and not the rest of the words in each sentence.

<comment><USER16> I don't think so, since the examples mention overworking towards the current assignment. Anyway, 5PM stigma exist and there is no harm to reiterate this topic.

</comment></comment></comment></comment><comment><USER18> I didn't study Computer Science in college. Not one single course. But I'm not stupid. I made straight A's in math through Calculus III. So a lot of these comments frustrate me. I've taught myself literally everything I know. I've read dozens of books. I practice coding obsessively--it's my passion. Do I "get shit done"? Yes, absolutely. Do I not care about the efficiency of my algorithms? No, I care deeply. I don't always know the "computer-sciency" term for things. But my goodness, get off your high horse and tell me what you want accomplished. Chances are I'll implement a solution that's just as efficient and arguably much better than most "engineers" can. And no, I'm not going to be obsolete at age 40. By the time I reach age 40, PhD's will be coming to be for advise. Because I didn't study computer science in college. I'm studying it for life.

<comment><USER19> That works great for _you_. What happens when my objective is to develop a solution that requires 100s of developers, spans multiple years, costs billions, and has major liability concerns?

<comment><USER18> My recommendation would be to hire people who are smart, responsible, and passionate. The language or framework can be taught. That's what the FAA does. Their initial assessment exam determines cognitive aptitude--not textbook knowledge. And air traffic controllers from all backgrounds are responsible for billions of dollars worth of aircraft and the lives of hundreds of thousands of people every single day.

<comment><USER19> You're confusing systems engineering with knowledge and skills

</comment></comment></comment></comment><comment><USER20> I'm convinced that the only useful definition of a Software Engineer is "someone who has 'Software Engineer' in their job title". Most other Engineering disciplines are far more rigorously defined. That said, observing a disconnect between theory and application is hardly novel or unique to software disciplines.

</comment><comment> amw-zero > all computer hardware is essentially equivalent.

This is quite inaccurate. Hardware directly influences software. "if" statements, functions, and threads didn't exist at one time, and all require explicit hardware support. I believe that as we come up with different abstract constructs at the hardware level, we'll influence the possible software that can be written.

<comment><USER21> Sometimes true (e.g. the PDP-11 instruction set did influence C), but software can also influence hardware.

Many early computers had very rudimentary subroutine call mechanisms (e.g. the B-line of the Elliott 803), but this didn't prevent programmers from using functions which returned values, sometimes recursively.

Burroughs mainframes were designed to run Algol 60 (with a few additional instructions for use by COBOL programs), and Lisp Machines were designed to run Lisp. In these cases, the influence of the languages extended to the entire instruction set. This is a better approach, as it's easier to experiment with language design than it is with hardware design.

<comment><USER22> > software can also influence hardware

This happens more often than you'd think. Intel (and later, AMD) added AES primitives to their instruction set to speed up encryption. VT-x (and the AMD equivalent) were both designed to improve the performance of virtualization. Outside of the realm of CPUs, the use of FPGAs -> ASICs for accelerating bitcoin hashing certainly wouldn't have existed if not for the software. Hardware support for CUDA / OpenCL accelerated existing parallel workloads.

> This is a better approach, as it's easier to experiment with language design > than it is with hardware design.

FPGAs certainly lower the barrier to experimenting with hardware design, although yes, it's probably still higher than language modifications.

</comment></comment></comment><comment><USER23> Software engineering is where the rubber hits the road in terms of requirements definition, creating a solid design, fitting stuff into an existing legacy environment (SAP anyone? Java EE?), iterating prototypes with stakeholders... and usually in large corporations. It was out of many years of budget overruns in defense procurement that software engineering cornerstones such as CMMI emerged.

To me, the essence of software engineering is that 20% is about building the 'good' solution itself, e.g. architecture, code, release / deployment, ... the remainder of the engineering is navigating / tolerating the inherent corporate messiness of politics, opinions, power, and everything else... engineering the solution is the easy part; engineering good requirements and quality is tough.

</comment><comment><USER24> Let's revisit the definition of "engineering", in a simplified form:

        Science -> Engineering -> Technology

Engineering borrows scientific[1] knowledge to create[2] technology[3]

[1]: or empirical knowledge

[2]: or maintain or implement

[3]: or processes

The relationship between science and engineering has been clear for a while now, even before the appearance of software engineering.

There's a lot of science at work in existing software, so it would be inaccurate to say that software is "unscientific". However not many people get to work on those projects.

A vast majority of people can make a decent living working on user facing technologies built with existing technology. At that level appealing to non- technical stakeholders has much more weight than applying engineering rigor.

But that's not the reality for everyone.

</comment><comment><USER25> The author has a slightly funny use of the word engineering. If you look at its use in a conventional field like making cars then the science bit is the basic physics and chemistry of how gasses expand etc, the engineering is designing the machinery so the brakes work, the engine produces enough power and doesn't break and the like and then human issues like whether the workers go on strike or the end users are idiots and crash are not engineering.

Similarly I'd say in software the engineering bit is making reliable systems that are fault tolerant and secure and so on and then the people bits like the user interface are something like design and psychology, not engineering.

</comment><comment><USER26> Most developer jobs contain parts of both, with more time spent in software engineering.

Software development, app development, game development, web development are all probably 90+% software engineering and 1-10% computer science depending on the project. Specific projects may differ such as writing standard libraries, engines, data, standards, teaching, etc. In the end most of it is production and maintenance as part of shipping.

</comment><comment> Chiba-City These are complicated terms. Harvard's CS was part of their Applied Math department. There are Applied Maths of scheduling programmatic Engineering outcomes for sure. Fred Brooks taught us all that.

I studied Russell, Godel, Tarski and Quine and then compiler and runtime logic (as a Philosophy major). Back then CS was mostly a realm of 3-Page proofs on alpha renaming or newfangled Skip List speed/space utility.

As an old VAX/Sun or 512K/DOS C programmer working in DC for decades around lots of TC, datacenter and transaction processing folks, an SE MUST have basic speed/space, set theoretic, programming by contract, data integrity and MTBF abstractions in their heads while they plan and develop. Both accuracy and performance against test and measure just matter for the business cases 24/7.

Content software developers patching together framework components on 2 day schedules for consumer Web bloatware rarely understand something like data integrity needs of billing system logic embedding in redundant switches failing over on rough schedules. Typing commands is not even Software Engineering.

Software Engineering is not an individual identity phenomenon. SE is how groups show responsibility for stakeholder outcomes unrelated to paychecks. First rule of SE is everyone on the team passes the bus test. Nobody is essential. Unless we seek luck, we can't improve what we don't measure. Learning how and what to measure takes real training and group method application. So many out there never know what they are missing.

Business competition minus lucky windfalls is largely based on COST ACCOUNTING. Successful operations will discover heat dissipation costs challenges. Basic CS speed/space, contract covenant assertions, data integrity and MTBF logic in Software Engineers translates very easily into understanding business innovation problems.

</comment><comment><USER27> rarely has asymptotic complexity mattered to my code. usually the most important factor is modularization and readability. i spend more of my time reading or re-using code, and my time is more expensive than a computer. plus, highly optimized code can sometimes be unreadable and lead to bugs, which are also more costly.

<comment><USER28> > asymptotic complexity

If it hasn't mattered to you, it's probably because you are using libraries or apis which have solved for optimal performance.

In short, performance mattered a lot to you code. Only, you didn't slog long hours to make it so.

Back to the topic at hand, if you didn't spend time to understand why a particular module or library is part of your code base - be it for performance or maintainability or any other -ities - you're halfassing your job as a software engineer. Would a structural engineer ever claim with a straight face that they have never worried about the integrity of their struts? That's basically what you said with your claim.

<comment><USER29> Nah, that isn't what was claimed. What you describe is more like claiming an engineer is half assing it if he doesn't verify that a given strut (library) that has been analyzed to death (already verified to have characteristics meeting the requirement) in fact meets them.

<comment><USER28> The OP said they don't care/haven't had to care about performance. What you're saying is that they used a library which is known to be performant. If the OP knows it to be performant, they are misstating that they don't care/have never been asked to care about performance. If they truly don't know about the performance and picked a library at random, they are halfassing it and aren't doing their job as a software engineer.

<comment><USER30> Well, remember: don't start with performance in mind unless you have to or you already know the right way.

Take a Python library like requests. Who the hell will read the source code and run a profiler on that module if you see a consumer? I don't care until I have to. Perhaps before shipping my production code I can run a profiler. If you are going that deep at the beginning, you are wasting your time instead of building MVP and iterate. Library's code out there is ever changing. One version can br slower than another. You aren't doing meaningful work if you start with performance.

OP didn't say he/she is picking a random library out of the blue. I don't remember reading that "random" part.

<comment><USER28> This entire discussion is about what an SE does vs what a CS does. Item #1 for an SE is to pick a library to use instead to reinventing every wheel every time. OP says they don't care about performance which is a naive, potentially stupid, approach to software engineering. Beyond this, I'm out of crayons.

Just because some hotshot (PG?) said to not optimize prematurely doesn't absolve you of your responsibility towards picking a library to use. Don't optimize early by all means but at least know why the library you picked might not be a great choice for problems you face in the real world.

Do you write your websites in C outputting raw HTML? I'm sure you don't. Clearly you made some sort of reasoned deduction about the tools at hand and went with one which got the job done. Why did you not pick C code spitting out HTML? No point premature optimizing your productivity, right?

<comment><USER31> The "hotshot" was Donald Knuth, and he was talking about getting clever before you're sure your program does what it's meant to do. The keyword is _premature_ ; analysis and optimization pretty much forms the bulk of his body of work, although he doesn't believe in sacrificing readability until you're out of other goats to kill.

<comment><USER28> You're right! @ Knuth. I knew that but it got overwritten by PG's point about scaling prematurely.

Like a good astrologer, I'm going read into your comment to assume support for my larger point - know your tools.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> In Germany we have Informatik, which was treated as CS&SE long time.

Lately there are sprouting more and more SE degrees.

On the other hand we also have universities of applied science, where Informatik is often more like SE

<comment><USER33> In Peru we also have "Informatics Engineering", which is my degree. It is a mixture of CS courses (and a lot of math courses as well), plus SE and also EE courses (i.e. digital electronics' fundamentals / computer ALU/CPU design).

</comment></comment><comment><USER34> Scientists use the scientific method to make testable explanations and predictions about the world. A scientist asks a question and develops an experiment, or set of experiments, to answer that question. Engineers use the engineering design process to create solutions to problems.

</comment><comment><USER35> We also wrote an article about this about a year ago: [https://code.berlin/en/blog/computer-science-software- engine...](https://code.berlin/en/blog/computer-science-software-engineering/)

</comment><comment><USER36> I neither agree nor disagree with the article. I think it conflates a lot of stuff.

But look, what the math and science sides of the room throw at us _definitely_ informs the engineering. In every other engineering principle from architecture to ditch digging, there is a feeder system from a variety of mathematical and scientific disciplines. While many other engineering disciplines are well established, they are not immune to this and in general don't begrudge it.

Doctors are required to keep up on the state of treatment. Architects need to keep up on materials science AND new mathematical modeling techniques and tools. Car designers care about new discoveries in lighting, battery and materials technology.

Here's a good example of the kind of stuff we all should be on the hook for. I've tried to push this paper up to the front page a few times now because it's roughly the same as if someone walked up and calmly announced they'd worked out how to compress space to beat the speed of light:

[http://www.diku.dk/hjemmesider/ansatte/henglein/papers/hengl...](http://www.diku.dk/hjemmesider/ansatte/henglein/papers/henglein2011a.pdf)

Folks are _generalizing_ linear sort algorithms to things we thought previously were only amenable to pair-wise comparison sorts without a custom programming model and tons of thought. No! And then a famous engineer-and- also-mathematician made an amazingly fast library to go with it ([https://hackage.haskell.org/package/discrimination](https://hackage.haskell.org/package/discrimination)).

We're seeing multiple revolutions in our industry made of... well... OLD components! While deep learning is starting to break untrodden ground now, a lot of the techniques are about having big hardware budgets, lots of great training data, and a bunch of old techniques. The deep learning on mobile tricks? Why that's an old numerical technique for making linear algebra cheaper by reversing order we walk the chain rule. O(n) general sort is arguably bigger if we can get it into everyone's hands because of how it changes the game bulk data processing and search (suddenly EVERY step is a reduce step!)

We've similarly been sitting on functional programming techniques that absolutely blow anything the OO world has out of the water, but require an up- front investment of time and practice with a completely alternate style of programming. But unlike our fast-and-loose metaprogramming, reflection and monkey patching tricks in industry these techniques come with theorems and programmatic analysis techniques that make code faster for free, not slower.

Even if your day job is, like mine, full of a lot of humdrum plug-this-into- that work, we can benefit from modern techniques to build absolutely rock solid systems with good performance and high reliability. We could be directly incorporating simple concepts like CRDTs to make our systems less prone to error.

It's our job (and arguably it's the hardest job of the field) to dive into the world of pure research, understand it, and bring what's necessary out to the world of modern software. That means more than just tapping away at CSS files, or wailing about NPM security, or shrugging and saying, "Maybe Golang's model is the best we can hope from in modern programmers."

</comment><comment><USER37> What is software Engineering !? Making an excel sheet ? Making a web site ? Writing SQL ? Using programming language X, Y, Z ?

</comment><comment><USER38> Software Programming != Computer Science Software Programming and Science != Engineering

While we're drawing distinctions stop calling yourself an engineer unless you're legally licenced as one. Programming may share similarities with engineering but it lacks the professional accreditation and liability.

</comment><comment><USER39> Computer science is neither about computers nor is a science :).

<comment><USER39> People are obviously not getting this popular joke in academia. Open a book such as Introduction to Algorithms by CLRS and you will see its all about creating algorithms in pseudo-code, proving its correctness, evaluating runtimes etc. Authors not only pass on "systems engineering" but even producing algorithms in actual language that can be compiled on actual computer. Don't get me wrong, I love the book and have gone through every single page and vast majority of excerices twice and truly enjoyed it. It is then when it hits you what computer science is really about.

The folks in fields like mathematics or physics didn't used to consider "Computer Science" as "real science". As fun fact, there were no journals on computer science for quite long time. Researchers like Dijkstra would identify themselves as "Mathematician" and publish their now very well known algorithms in mathematical literature :).

</comment></comment><comment><USER40> This is not a particularly new observation.

My half-assed analogy:

CS is to SE as Physics is to Mechanical Engineering.

In both cases, it's unwise to trust one category with screwdrivers...

<comment><USER41> I've often thought there should be a third position a 'software designer' someone whose job it is to translate customer requirements into a design which the engineer can build.

In Engineering you have architects/industrial designers etc. They work out the product specifications and then ask the engineers to deliver an efficient workable solution that fits those specifications.

Sometimes at least from my view it feels like software engineering reverses the two roles. i.e The Engineer supplies the api and customer works around design. Think about something classic like Unix it feels like in some cases engineering has constrained the design rather than design constraining the engineering. This is not necessarily a bad thing but it is different.

<comment><USER42> > In Engineering you have architects/industrial designers etc. They work out > the product specifications and then ask the engineers to deliver an > efficient workable solution that fits those specifications.

I've always thought programming would eventually go the way of mechanical engineering with engineers doing design vs fabricators doing the manufacturing. The closest we've come so far in software I think is having one person doing architecture or write a spec and others implement the code. Not quite the same but I wonder if we'll get there eventually.

</comment></comment></comment><comment><USER43> Sure. Engineering is an applied science. So, these cannot be equal.

</comment><comment><USER44> 100% agree.

So unless you spend all day writing compilers from scratch or calculating Pascal's Triangle, please stop with the ridiculous CS questions in interviews.

Software Engineering is more of a trade, and requires vocational knowledge and experience. A mountain of theory may not always be required to Get Shit Done.

<comment><USER13> I disagree.

* I routinely find people using the wrong data structure, when there exists a better one, with better O() time/space.

* I find people tend to not understand BTrees, particularly when there are two attributes being indexed. Given an index on (a, b), I find it common misconception that the BTree can efficiently answer `$a_min < a < $a_max AND $b_min < b < $b_max`. (I.e., people do not understand that the tree cannot make use of the second < condition, and must scan potentially many more rows than they intend.)

* Graph theory. git uses it. Any sort of dependency tree uses it.

That said, I acknowledge that software engineering does require a lot of non- theoretical knowledge, which is why I ask _both_ types of questions in an interview.

<comment><USER45> Does your job actually require knowledge of BTrees?

<comment><USER13> Yes. They're the typical data structure backing most relation database indexes. Knowing when they will perform well (and more often, when they won't) follows directly from knowing their structure. (The example of trying to do a range search on two dimensions in the post above is an example that doesn't perform as well as — again, I find — people naively expect it to.)

Have I ever implemented one? Not yet. Do I ask for a BTree implementation or exact, low-level understanding on an interview? No.

</comment></comment></comment></comment><comment><USER46> Yeah, no shit...

Truck Driver ≠ Road Planner</comment>


Ask HN: How often do you experience self-control issues? - <AUTHOR> Related to this HN post on how to overcome instant gratification: https://news.ycombinator.com/item?id=14751439
I find myself a lot of times that I go to bed 1 or 2 hours too late, get distracted a lot from work by all variations of bs (especially when working from home), and think that there should be easy steps to solve this problem.
Does the HN community feels the same way? I'm curious as to when it's particularly annoying/relevant. For instance sleep, studying, working, doing chores, etc. Let's discuss! <comment><USER2> Used to be all the time, which is one of the factors that lead to my heroin addiction at the age of 16 until I was 22. Clean for five years now, and one of the key things for me has been cognitive behavioural therapy, along with having reasonably defined mid-term goals.

The other thing is not to beat myself up when I slip up; to use the "going to bed" example, if you miss your bedtime by 20 minutes and beat yourself up mentally, it's much easier to rationalise "may as well stay up another couple of hours, I've already ruined it".

Instead, let it go; this alone has helped me tremendously :)

<comment><USER3> Great advice on your point to not beat yourself up at slip ups. I was also advised to learn to forgive myself (it's seriously much more difficult than it sounds).

Also, major kudos on being clean for five years. While I can't relate to it, I can certainly appreciate the accomplishment that it is.

</comment></comment><comment><USER4> I experience self control issues on a fairly regular basis.

Computer, phone, daydreams, etc. I'm just recently keeping bad sleep habits at bay (usually, still occasionally let the lure of the shiny keep me up).

On a solution-level, I've found that exercise + proper rest tends to have the greatest singular impact on my self control. My willpower tends to scale with my energy-levels. In addition, adding little obstacles between you and the distraction (noprocrast setting on hackers news, forestry app for phone, etc) can often give me just enough time to pull myself back to important things.

<comment><AUTHOR> What percentage of that is phone and computer related? If you were unable to visit particular sites (maybe during particular timeslots), how much would that solve the problem? What other things could solve the problem without changing your actual habit?

<comment><USER4> Hard to say currently, as my phone broke about a month ago and I intentionally didn't order a new one until just recently.

I'm also just bad at quantifying anything as a whole. I generally have trouble getting distracted whenever important things aren't attention-grabbing and shiny things are few clicks or taps away...

</comment></comment></comment><comment><USER5> I find my self control issues all stem from not having a solid plan to do something.

I know that I could be doing things "better" but I don't have a strong enough emotional reason to.

I've found if you want to change something then you need to think of a concrete plan and attach emotion to it (good or bad).

</comment><comment><USER6> _> I find myself a lot of times that I go to bed 1 or 2 hours too late..._

I've dealt with this one a lot. For me, it's partly caused by having bright lights everywhere while I work through the evening. The bright lights are really helpful while I'm working, but not when I need to wind down.

What helped me was setting up a 'night mode'. I put tealight candles everywhere (in Australia, Dusk is a great store for that sort of thing). I also have a lamp with one of those "vintage" bulbs with long straight filaments that outputs an orange-yellow glow (in Australia they're called Mirabella Vintage). For bonus points, I run Netflix's "Fireplace For Your Home" on the TV. Whatever it is about that dim light ambience, that signals my body to start winding down for sleep, and it's usually about 1 - 2 hours earlier than without it.

[I took a photo at the beginning of my night mode setup here: [https://twitter.com/syneryder/status/766299439489097728](https://twitter.com/syneryder/status/766299439489097728) ]

As for work distractions, I work solo so I don't get many intrusions that way. But I am ruthless in turning off notifications on my phone (and I deactivated Facebook, because it was a constant stream of distraction). I got a Pebble Time Steel watch, and set it up so only urgent notifications go to the watch (like downtime alerts). If my watch isn't buzzing, it isn't important enough to interrupt what I'm doing.

</comment><comment><USER7> Do you feel passionate about what you do? Do you /like/ what you do? (Don't confuse those.) I constantly struggle with distraction at work -- and I'm becoming increasingly convinced that the problem is, at least in significant part, that I /just don't like it/.

</comment><comment><USER8> All the time. My big things are:

* Going to bed too late

* Cleaning the house (that is, I have trouble doing it)

* Sticking to my eating plan (I'm not _too_ bad at this, but need to get better)

* Buying crap I don't actually need. I'm not rich, there are better things to do with my money.

* Inability to let things go - that is, if I am stuck on a problem at work but still have ideas for what to try next, I will have trouble going home until I've tried all of them. I'll keep thinking "I'll just try this _one_ more thing..." If I do force myself to go home, it will often haunt me until the next morning.

</comment><comment><USER9> I use a three-pronged approach:

1) Put my vices out of reach. I don't keep candy in my house and I use [https://freedom.to/](https://freedom.to/) and [https://selfcontrolapp.com/](https://selfcontrolapp.com/) to block distracting websites.

2) Build habits and structures to take care of my physical health. I use a spaced-repetition flashcard app [https://ankiweb.net/](https://ankiweb.net/) on my phone to remind myself of the habits I should be following. I go to sleep at 11:30 and wake up at 8:30 (+/1 30 minutes either way) so I get 9 hours of sleep a night. If I feel anxious when going to sleep, I put on an audiobook. I do a 20 minute workout (run 1km, bench press, situp, back-up, lunges) before work. I'm not building muscle, but it makes my mind clearer.

3) Reinforce mental toughness by explicitly saying to myself "this is frustrating, but it is worth it to work through it and I'm stronger than I think."

</comment><comment><USER10> All the time. The solution is usually mindfulness. When you're lost in HN at 2AM when you should be sleeping (or when you're coding and in the zone), your focus is _inside_ what you're doing. You won't stop doing it until you pull your focus back and look at _what_ you're doing. That allows you to assess whether it's what you want to be doing _now_, and whether it's a good use of your time.

To prompt yourself to pull your focus back , you can condition yourself to respond to certain cues - typically sounds - and program your phone or computer to produce those cues every N minutes. Meditation can also help develop your ability to be mindful of what you're doing and why instead of getting caught up in the moment.

</comment><comment><USER11> Interesting to read the experiences of others.

I experience difficulty with task switching. When I latch onto a problem, I feel like I cannot do anything else until that problem is solved. This makes for very inefficient studying as often I just need time to digest. This also creates problems for multi-tasking.

What I find strange is that I have much less of a task switching problem when it comes to programming.

As others have pointed out, will-power comes and goes with energy levels. On afternoons I'm practically useless. In my experience the disparity between what one wants to do and what one ends up doing is function of available energy, as a form of mental agility.

</comment><comment><USER12> keep one habit all the time, and never try to change it, like do some running every morning, I think it can help you coming back very soon.

</comment><comment><USER13> I'm pretty sure my whole life is one long lapse in self-control.

<comment><USER14> "The only way to get rid of a temptation is to yield to it." - Oscar Wilde

</comment></comment><comment><USER15> Sometimes I do after few drinks...</comment>