Ask HN: Do you spend more time coding or debugging? - <AUTHOR> I find myself spending most of my time debugging older code, and I'm curious as to how other people's time is split at work, between developing new code, extending existing code, and maintaining existing code. Anyone care to share? <comment><USER3> I used to spend the vast amount of my time debugging.

Fast forward a few years - Experience, good programming habits, and the gratuitous use of assertions. Now I spend a negligible amount of time debugging, and it never ceases to amaze me how frequently things just work the first time.

Edit: I guess I want to say that there is one, and only one, bottom line: the relentless, ruthless pursuit of _quality_. It takes time to develop the good habits and watch for the pitfalls, but once you're there you develop your software products in a quarter as much time, with one tenth the stress, and everyone on your team feels proud of themselves and each other. Then with your free time you can focus on what's really important - your business and your life

<comment><USER4> Agreed, but with the addition of some periodic, many hour, something- completely-unanticipated-happened-and-I-am-so-perplexed debugging sessions.

<comment><USER5> This but let's also define debugging. From reading some of the comments left throughout the thread it seems like people don't think that a test failing and you having to go back and fix code (or even the test) is debugging but IMO it is. There is a bug, you are going back, finding it and fixing it. It usually means it is easier and faster to find/fix, but it is still time spent "debugging".

I spend more time creating then debugging when I write the code from scratch, but I still say I spend probably at most 70% coding if it is a new project. The rest is in failing tests and finding those weird screwed up errors that take multiple days of a debugging session to find. For existing code I take over, it is probably usually more like a max of 50-60% coding depending on the original authors skill.

</comment></comment></comment><comment><USER6> Neither, I spend more time writing or thinking about tests. When I was earlier in my career I used to insert debug comments, run code, look at output to figure out what was going on. Now, I try to write my tests that will eliminate the need to debug. If I'm trying to fix a bug, the first thing I do is write tests for what should happen if the tests don't already exist and work backwards from there. If you get in a good habit of this, it just becomes natural and with today's toolchains you can re-run tests with a watcher to achieve a real time feedback loop, which is better than a debugger IMO. The plus side is going forward you always know that the code works vs just seeing it work that one time. As your application grows, something may change what the value of the debug statement output and you'll never catch it, but your test will. /old man rant

<comment><USER7> I'd shift your statement slightly, "I spend my time Thinking" (elided "about test"), but agree entirely with the thrust of your point.

My reason for the truncation is that the thinking isn't just about what tests to write to validate the semantics you want, but what semantics do you even WANT? Happy path may take an hour to figure out, but getting to a point (for a reasonably complex system) where I feel confident that I've enumerated the "perimiter" of the mental model such that there are fewer surprises, gotchas, odd edge cases, usually takes significantly more contemplation of the problem space than modern big-co "DELIVER FEATURES NOW NOW NOW" would often like, certainly more time than spent actually implementing, by and large.

(you may sense some bitterness, it is largely because a respected mentor of mine made significant effort to stress to me that if I'm leaning on a debugger, or having to printf a lot, I probably don't UNDERSTAND what's going and and can fall prey to far more severe logical issues; and despite my observation that I became a far more robust engineer utilizing this strategy, it's often hard to incentivise balancing this against simply shipping, especially given the difficulty of empirically justifying "I need a day to think really hard about this problem to make sure it's not subtlety wrong" against the rebuttal of "what's the ROI")

</comment></comment><comment><USER8> From The Mythical Man-Month by Fred Brooks:

      """

No parts of the schedule are so thoroughly affected by sequential constraints as component debugging and system test. Furthermore, the time required depends on the number and subtlety of the errors encountered. Theoretically this number should be zero. Because of optimism, we usually expect the number of bugs to be smaller than it turns out to be. Therefore testing is usually the most mis-scheduled part of programming. For some years I have been successfully using the following rule of thumb for scheduling a software task:

      1/3 planning
      1/6 coding
      1/4 component test and early system test
      1/4 system test, all components in hand.
          This differs from conventional scheduling
          in several important ways:

1\. The fraction devoted to planning is larger than normal. Even so, it is barely enough to produce a detailed and solid specification, and not enough to include research or exploration of totally new techniques.

2\. The half of the schedule devoted to debugging of completed code is much larger than normal.

3\. The part that is easy to estimate, i.e., coding, is given only one-sixth of the schedule.

      """

<comment><USER9> and from Robert L Glass, Facts and Fallacies of Software Engineering (2003, but I think a self-reference from Building Quality Software, 1992):

"The data on the percentage of time spent in error removal has varied over the years, but the usual figures are 20-20-20-40. That is, 20 percent for requirements, 20 percent for design, 20 percent for coding (intuition suggests to most programmers that here is where the time is spent, but intuition is very wrong), and 40 percent for error removal."

</comment></comment><comment><USER10> It seems a lot of people here are talking about debugging in the context of automated tests and manually stepping through debugger loops.

For me debugging usually means "figuring out why we had an outage." This means looking at: 1) application logs, 2) server metrics, and 3) source code associated with the failed applications.

I recently had to ssh and run ngrep on 8(!) servers to see how groups of messages passed around and then look at timestamps to correlate what happened. It was very tedious. This could have been saved by better debug logging; we could have switched that on for 2 minutes, run the tests, and and the looked at everything in Logstash.

When this happens, I end up spending a ton of time tracking down errors. On a bad week, this can be half my time.

So to me, debugging is as much thinking about how you'll have to solve errors in the future and planning for it as it is writing unit tests and tweaking code.

</comment><comment><USER11> Definitely not debugging.

I am working on an existing distributed system with many moving pieces, which is rather prone to outages. This is fintech, so outages mean a lot of money for a lot of people. So my job involves overhauling the existing system, as I upgrade bits of the system slowly: A full rewrite at once would be madness, but I suspect nothing in the current system will remain in two years.

The biggest time sinks are stress testing any of the newer pieces that I try to bring in, followed by incident remediation. There's an incident that requires a human hand to fix it every couple of weeks or so, and I end up spending about three days each time writing better error handling code, adding observability and alerts, and if something is really recurring, writing automation to make the problem fix itself.

This is a fact of life in any distributed system that was written fast: People are start happy because it works most of the time, but as you want the 4th and 5th nine, you need people hardening the system. This is something that is very hard to do as you build anyway: While unit tests are good, there are entire layers of behavior nobody will be able to spec properly by looking one piece at a time, so stress testing, gamedays and such are the only ways to make sure not that the system works to a spec, but that we can even come up with a spec that behaves the way we want in practice.

There's value in evaluating scenarios in your head, but I've also seen what happens when mathematicians use that as their only weapon in a distributed system: Months are spent making sure the system is correct, but then lots of effort is spent on scenarios that are more theoretical than practical, and other scenarios are ignored, even though they occur a lot in practice.

In this respect, it's not very different from entrepreneurship: Getting an MVP out the door and doing things by hand instead of using automation is going to beat spending a lot of time making a product without having any idea of what the market really wants.

</comment><comment><USER12> There are two phases to programming: bugging and debugging.

</comment><comment><USER13> Sometimes I feel like I'm not writing code at all, just debugging till it works. :)

<comment><USER14> Implementing a feature is fixing a missing functionality bug, fixing a bug is completing a feature. There is no real difference between feature dev and debugging, except in how they are perceived.

</comment></comment><comment><USER15> Debugging.

I've sunk a lot of time into trying to change this. Among other changes, I've:

\- Improved crash dump collection, to spend less time reproducing bugs and be more thorough in addressing them.

\- Improved code debuggability - for example, writing scripts to inject call stack information into actionscript and java via disassembly, which I can then display on assert, especially on platforms where I have unreliable or incomplete debuggers.

\- Learn and use defensive coding techniques to make bugs fewer in number, shallow, and caught more quickly and with more context.

\- Write thorough tests to catch said bugs before I even run my main application, and more edge cases to input

\- Learned more tools to catch bugs I might not even know exist - valgrind, address sanitizer, static analyzers, fuzz testers, ...

I spend much less time debugging my own code now. If I'm lucky, I'll work on projects where I don't have to debug my coworker's code all that much either. That still leaves debugging 3rd party libraries and tools - which I may lack the source to entirely - that I suddenly have more free time to really properly investigate and get to the root cause of.

</comment><comment><USER16> Neither. I spend most of my time procrastinating and/or day dreaming.

<comment><USER17> Same here. I often spend time wondering if it's simply that this field isn't for me, 40hrs a week kills my drive, or if it's a bigger issue like depression.

Only thing I enjoy now are exercise and music.

<comment><USER18> Have you ever coded for a project you were excited about? Where you could feel really good about delivering a quality, useful product? If possible, try and find that at your current job. If not, a new job may be the best route. Management and bureaucracy are great at squashing good vibes here.

Also, see if you can find some satisfaction in expanding your programming skills through reading and learning. Not sure your experience level here, but I would recommend that to anyone -- it has made a huge difference to me personally.

<comment><USER17> Pretty early in my career. I've held two jobs that both sound wildly better than any other option in the near area (small startups with tons of work vs. big businesses where nothing gets done).

I intend to spend no free time on my career outside of work. There are far too many other things in life I would prefer to work on and experience, hence why I wonder if this is the right field for me.

Sorry if I sound so negative, it's just how I've felt since first starting out in my field.

</comment></comment></comment></comment><comment><USER19> I think a lot of debugging activities end up laying the framework for new features, so it's unclear how to separate the two.

</comment><comment><USER20> Working as developer supporting and maintaining web applications , over past few years , I have spent maximum time fixing bugs left behind by those came before me , and more even debugging to understand functionality and architecture. A significant amount of time unit testing ofcourse and lastly some amount of time adding new features or extending existing features. Ofcourse like many developers out there I do however look forward to truly build code from scratch, like from a whiteboard concept to a MVP at work. No luck there so far, cause I usually end up serving businesses that have due a number of reasons chosen to remain where they were a decade ago!

</comment><comment><USER21> Debugging tests. It's the worst because the feTure took an hour to add with ita own tests, but a day and a half of debugging how the changes broke other tests.

</comment><comment><USER22>
                    Analysis Programming Debugging Overhead
      </comment><comment></comment><comment>  </comment><comment>-- </comment><comment>----- </comment><comment>--- </comment><comment>--
      My Own Stuff    30%       60%         10%       0%
      Others' Code    50%       10%         30%      10%
      Enterprise      10%       10%         10%      70%

<comment><USER23> I get your point but my guess is the lack of analysis is only exacerbating the problem on the Enterprise end.

<comment><USER24> If he means reading code and documentation as the only activities of analysis, then I'd say the ratios are about right.

The overhead consists of endless meetings that never reach consensus, but arguably this could be filed under analysis

<comment><USER25> Meetings, discussions about meetings, pre-meeting discussions regarding discussion to be had in meeting, logging all time spent in meetings, discussing meetings, discussing discussions to be had in meetings, logging time lost to "noise" to figure out why nothing gets done on time, meeting to look at time spent on "noise", planning what to do with remaining time, having a meeting to discuss what to do with remaining time, updating numerous workload management tools with tasks to do with remaining time, spend time trying to get back into work, get pulled off to do something of far less value but which is "much more urgent", log time spent on that, have a meeting to discuss all upcoming urgent and unscheduled things, have a discussion about what wont get done, goto 1.

</comment></comment></comment></comment><comment><USER26> 50% design, 25% coding, 20% documenting, 5% debugging

But I have the luxury to work in a result-oriented environment with people too experienced to fall for "agile". So I can spend half of my week in a cafe with pen & paper as long as the project is done by Friday night.

</comment><comment><USER27> Preface: I work with C/C++ the majority of my time. C#, F#, and PowerShell are the bulk of my remaining professional time. Go & OCaml/F# at home.

When I started, the bulk of my time was debugging my own code. I am gifted with the ability to write vast swathes of code in a short amount of time and when I was younger, it was vast swathes of shit code.

A little later into my career years 3.5-5, I spent more time coding and less time debugging. I designed my code better, used better patterns, and generally was just an all around better engineer.

I've come into the third stage of my career now where I spend a good portion of my time debugging junior engineers' code in a complex system I work on. In particular, my focus is usually in reliability and performance. I don't tend to debug the junior engineer one-off issues but rather the subtle regressions introduced by seemingly harmless changes.

In this third stage, I still write a lot of code, but much more of it is investigative and refinement over existing ideas with occasional injection of something wholly new.

</comment><comment><USER28> I think it will really depend on the role.

\- One project is in active development, and I probably spend about 70-80% of keyboard time coding with 20% debugging.

\- A separate project is in maintenance mode, and obviously most of my time on it is debugging as bugs come in. So probably opposite, 70-80% debugging there.

\- Sometimes feature extension requests come in, in which case it's probably closer to 50/50 on that project.

</comment><comment><USER29> A bunch of time planning the change and reading through the current version of the code, so that I can add things without breaking everything else (and/or understand the current behavior and the desired behavior, so I can repair the bug). About half as long actually writing new code, and then debugging iterations until the tests work again. Some time writing new tests for the feature. Some time fixing integration issues (occasionally). A fair amount of time dealing with customer escalations (usually tiny edge cases really messing stuff up at a customer's site).

So, they're _all_ bugs, and in a sense, all coding is debugging. New-feature, regression, existing (from previous release), and escalation bugs. They're all basically the same thing: Identify the deficit, write a fix (includes what you might have meant by "debugging"), write tests to cover the changed behavior, check it in, deploy/release.

</comment><comment><USER30> I am currently integrating a handful of open source big data systems and frameworks, the breakdown of my time is

        60% debugging
        15% stack overflow
        25% email archives
        15% commit logs
        10% navigating code, spelunking
        12% jira
         5% writing tests to confirm config/state/feature availability
         3% coding

</comment><comment><USER31> Implementation (existing code) - 30%

      Maintaining - if this means soft feature creep, then 10%

      Maintaining - if this means bug fixes and other things, put in implementation, 5%

Creating nice PPTs and control documents about stuff - 30%

      I genuinely like this

      New functionality 20%, including sitting with users for new functionality requests, seeing their workflow

My main job. Having whittled this down to 20% of my day, I need to start ramping it up again. It is nice to have 10% time, and I loved 50% time, but 80& time may get discovered (though all time is dedicated to the company)

Other stuff. Like filling in timesheets, which assume hours can accurately be attributed to discrete tasks for discrete people any and all of the time.*

* Just set goals for staff. Do staff achieve their goals? If so, why timesheet? Or just timesheet roughly, my hour-by-hour 7 day per week sheet is a pain.

</comment><comment><USER32> I spent more time in the planning stages, followed by debugging, followed by writing code.

I work in an environment where tests are unheard of. Most of the Javascript written is erring towards the "simple" side with many edge cases as it is all written for front-end web development. Things like calculating the size of the header, adding/removing classes based on certain user actions, managing Google Maps or having logic for complex forms.

Most things are several small (<10 line) functions.

The most complex thing I've built is a pre-qualification form. Thank god for moment.js, because I never thought it would be so difficult to calculate if someone is between the ages of 40 and 82 (or will be 40 by October 15th of next year).

</comment><comment><USER33> Of all the answers here that provide stats, I wonder what percentage of those have actually measured the time versus just giving numbers that 'feel about right'. If there is one thing I've learned about stats it is that 96.60% of people's gut feel is usually wrong ;-)

That said, about the question asked. I can attest to the fact that in general thinking and writing good tests greatly reduces time spent debugging. Also, adding judicious and useful logging for the critical / edge cases helps a whole lot.

</comment><comment><USER34> Well, it's a fairly even split of both. But a lot of time is spent fixing projects that started as something really simple and immediately ballooned into some sort of bloated megaproject that ended up with no cohesive plan in regards to how anything would be tested.

Bonus points if the project started as one thing and pivoted to something completely different midway through development, and about 50% of the code is completely unused.

</comment><comment><USER35> I spend most of my time debugging or extending old code, but then again I'm personally responsible for about 600,000 lines of undocumented code without any tests (but there are a lot of daily reports which act as monitoring checks). I will say that I rarely need to debug my own code, it's usually old code that needs to be updated due to a data change or business logic change

</comment><comment><USER36> I'm not sure there's much than can be concluded by someone's ratio. I definitely wouldn't assume that someone who spent more time debugging was a "worse" programmer.

There are certainly practices that reduce the amount of debugging, but it's all relative. Personally, the question for me is nearer something like;

> When is the right time to let go of my current approach?

<comment><USER37> > I definitely wouldn't assume that someone who spent more time debugging was > a "worse" programmer

I believe that more time spent debugging, the worse the code you're debugging is. Now if you're spending most of your time debugging your own code, then likely you're a novice who hasn't learned the many ways to write quality code that "just works".

If, on the other hand, you inherited a codebase from someone who did not follow the tenet of "develop your code as if the next maintainer is an axe murderer who knows where you live", then spending a great deal of time debugging is understandable and likely unavoidable.

Personally, during the time that I get paid for programming, most of my time is spent writing tests and developing features.

On the side, however, I have a project that I inherited from someone who clearly never intended to have another person look at the code, and most of my time is spent spelunking and debugging (and slowly replacing every last line).

<comment><AUTHOR> I find myself doing the exact opposite. The time I get paid for is mostly spent fixing bugs in a codebase of variable quality that I've inherited. The hobby projects I get up to are entirely my own code and thus I get to spend the majority of that time implementing new features.

<comment><USER37> Well - my "hobby" project is running the league website for a pool hall that was written in PHP ~12 years ago. There are 4 different leagues, each on their own database, all running very similar (but not the same) versions of the code on similar but not the same db schemas.

So I'm trying to modernize it by building a separate app that can interoperate with the 4 different schemas and do all the same things that the old app did. It's an interesting exercise in replacing legacy code piece by piece while still using it (all the leagues would not function if the site didn't work, and there's basically 3 weeks out of the year when the leagues aren't playing).

Professionally, on the other hand, I work at a startup where I've more or less had my hands in the code from day one.

</comment></comment></comment></comment><comment><USER38> debugging. because coding is the easiest part. when I am asked to build any feature. I take some time thinking on what and how should I do (around 10%-20% of my time). Once I feel like I have a good idea I continue to code (But sometime when I start to code I spend more time on thinking on designing code, like best practises etc.) so I think like 30%-40% of my time go to coding and thinking about best code practises. But then comes the part where I really struggle DEBUGGING. Rest of my time go in debugging stuff,

But I am not sure how can I improve myself. I am not sure whether anyone faced this but I feel like the starters really feel the same way.

All fun lies in debugging I sometime love it. I find funny bugs in my code. But it is so time consuming and I really want to reduce that. Not sure how. Any help will be thankful.

<comment><USER18> Like other commenters have noted, the more experience you get and the more you learn to improve the design of your code right off the bat, the less debugging you should have to do. Hopefully then the coding part becomes just as fun as the debugging currently is for you -- a lot of satisfaction can come from coding something really well and having it work just as you expected the first time.

</comment></comment><comment><USER39> Lately, it's mostly debugging. I rarely find debugging difficult (tedious at worst), and I like fixing real problems (vs building a new feature or component I don't see the reason behind) so that suits me just fine.

Honestly, I'm probably better at it than building new features anyway.

</comment><comment><USER40> Not employed. As a hobby programmer I spend more time debugging. The larger the project the more debugging.

</comment><comment><USER41> I wonder if there is a study about the percentage of time spent debugging as you become more experienced.

</comment><comment><USER42> Roughly equal, probably debugging takes more time (or at least it feels that way!).

Usually can get through a chunk of code no problems but when that 1 inevitable bug arises it will take up a lot of time through trial and error, stack overflow and just generally googling to find a solution.

</comment><comment><USER43> It depends on what I'm writing. For portable data terminal programs, it was 90% coding, 10% testing and debugging. For the air traffic control software, it was 10% coding and 90% inspection, testing and debugging.

</comment><comment><USER44> Between developing, extending and maintaining code, I'd say about 20%, 60%, 20%.

That said, I'd say only about one-third of my time is spent on code. I spend significantly more of my time doing operations work and having meetings.

</comment><comment><USER45> My work is 50/50 fixing other's people code and writing new code and personally about 10/90, it's so much easier to debug things for me when I get that memory spark from writing it the first time

</comment><comment><USER46> If you consider that the life of a software product is 5 years, it would typically take the first 3 months to build v1. So coding vs debugging would pretty much be in the same proportion. 3:60 in this case.

</comment><comment><USER47> Coding is only the tool, i don't spent much time coding, i spent a lot of time designing/analyzing then i spent time debugging/testing which takes more time than coding.

</comment><comment><USER48> debugging the platform so i can get 10 lines of my code to run

</comment><comment><USER49> Lot of planning then Coding and Debugging - theres a lot of refinement going on during the debugging process. So I cant call it just debugging.

</comment><comment><USER50> Neither, reading and understanding occupies the bulk of my time programming, even when I'm reading and understanding code I wrote.

</comment><comment><USER51> Mostly coding & unit testing, but sometimes I hit an case where debugging becomes the focus for a while.

 _cough_.NET Parallelism _cough_

</comment><comment><USER52> 40% - coding 50% - unit testing 10% - <USER2>

</comment><comment><USER53> I am spending most of the time on coding. Debugging is "waste".

</comment><comment><USER54> [http://www.sciencebrainwaves.com/the-dangers-of-self- report/](http://www.sciencebrainwaves.com/the-dangers-of-self-report/)

</comment><comment><USER55> Depends on whether I'm coding or debugging.

</comment><comment><USER56> 80% implementation

80% maintenance

</comment><comment><USER57> 50% coding, 40% testing, 10% debugging.

</comment><comment><USER58> Before 40 Coding; After 40 Debugging;

</comment><comment><USER59> Am spend more time on debugging.

<comment><USER60> you need to debug this comment

<comment><USER15> Missing capitalization, and terminating semicolon.

I mean _period_. Terminating _period_.

</comment></comment></comment><comment><USER61> debugging. esp. not my code.</comment>


Remote Letter #7 - <AUTHOR> https://remoteletter.com/post/remoteletter-7 <comment><AUTHOR> Remote Letter is a curated newsletter about remote work. Since a lot of companies are moving to remote work temporarily or permanently, this newsletter can be handy for employees looking for news, products and content remated to remote work, productivity, travel, etc. This is the 7th issue of remote letter.</comment>


Eliud Kipchoge Breaks the 1:59 marathon - <AUTHOR> https://www.sportingnews.com/au/athletics/news/eliud-kipchoge-ineos-159-marathon-stream-watch-live-australia-world-record-attempt-vienna-two-hours/17gzou6d3tqgi1afwqct89wubl <comment><USER2> Expect to see this once unbreakable limit now be broken in rapid succession by other world class marathoners. It seems the limit is every bit as psychological as it is physical.</comment>


Journey To The Center Of The Earth - <AUTHOR> http://www.virginvolcanic.com/

<comment><USER2> Just one question:

Did you look at the release-date of the blog-post on the virgin-site?

[http://www.virgin.com/travel/news/richard-branson- launches-j...](http://www.virgin.com/travel/news/richard-branson-launches- journeys-to-the-centre-of-the-earth-through-virgin-volcanic)

It was released just shortly before 1. April. Don't wanna be a spoilsport, but that smells a lot like a cool practical joke.</comment>


Show HN: Silli – Change your friends phones background image - <AUTHOR> http://silli.co <comment><USER2> In this one they're both possessive... so to avoid looking unprofessional it would be:

friends' phones' background images

And on the web site, photos is _not_ possessive, so it would be spelled: photos

<comment><AUTHOR> Ahh that's embarrassing, my grammar is (obviously) not my strong suit. Thank you for correcting me!

<comment><USER3> You need to change let's to lets as well.</comment></comment></comment>


Salesforce, Honeywell, Amgen into the Dow; Exxon, Raytheon, and Pfizer Out - <AUTHOR> https://www.wsj.com/articles/salesforce-amgen-honeywell-to-join-dow-jones-industrial-average-11598305490 <comment><AUTHOR> Salesforce replaces Exxon Mobil. Data really is the new oil.</comment>


Unlocking my Lenovo laptop, part 3 - <AUTHOR> http://www.zmatt.net/unlocking-my-lenovo-laptop-part-3/ <comment><USER2> It makes me sad to think that first a group of engineers spend time writings this complex system of checksums, partially encrypted firmware images, proprietary challenge-response handshake and communications with the battery so that another hacker must spend days to allow himself to make a fix as simple as replacing the battery in _his own laptop_. Is this because of fear? Money? Greed? All three? _How much money_ does Lenovo make out of Lenovo batteries to make this all this extra complexity worth its salt in the first place? Consider that maintaining all that complexity is a recurring cost: it's not just writing the authentication scheme but making sure it works for each future firmware release.

I haven't let go of the 80's and I still think if you buy a car, phone, laptop, compact disc or a video disc, then it's _yours_ because you _paid for it_ in your _own money_. From that standpoint it's simply inexcusable for manufacturers to try to re-own parts of a device they've already sold to someone.

<comment><USER3> I think it's mostly about brand security.

If a battery works with the laptop, it's guaranteed to be a tested compatible one. Quickly slapping up a counterfeit and selling it as a brand-name thing won't work.

A battery ua a critical device, prone to fires or blasts if made improperly. One such incident would significantly tarnish the brand. Thus the over- reaction.

I wish there wad an open spec for certified batteries, to allow for third- party fixes and replacements, though.

<comment><USER4> By applying this logic a computer manufacturer should not allow any non certified OS to run on their machines.

Writing this on a ThinkPad running Linux. If this comes true I will stop buying Lenovo products. Until today I continue buying ThinkPads because their Linux support is among the best - and for the trackpoint and a good keyboard. But I definitely do not like how they behave lately.

I am watching very closely for alternatives, every time I or any of people I know need to buy a new computer.

As soon as the brand security will become more important as the requirements of their customers I will jump off the brand. A brand without customers is not worth anything.

<comment><USER5> There was a thread[1] recently in which a Linux (specifically systemd) bug was capable of bricking motherboards. ACPI bugs can cause overheating, failure to enter sleep mode, etc. In a perfect world of open source firmware this wouldn't be an issue, but until then the cover-your-ass behavior makes sense.

Does the cost of replacing a few bricked machines outweigh the reputation cost? Probably not, but it's easy to understand the liability issues that arise from non certified OS's.

[1] [https://news.ycombinator.com/item?id=11008449](https://news.ycombinator.com/item?id=11008449)

<comment><USER6> The way I see it the firmware has been implemented incorrectly - I don't think there's anything in the spec but shouldn't clearing all values == a reset to default, not a non-booting device?

</comment></comment></comment></comment></comment><comment><USER7> _The option of replacing the cells in a genuine battery may be worth considering as an alternative to modifying the EC firmware, the advantage being is that you can choose your own high quality Li-Ion cells versus whatever you might happen to get in a replacement battery._

I suppose the whole "safety culture" around lithium cells in laptops has yet to change, but high-quality 18650 cells have been available on the open market for several years now, with all the accompanying products that use them (torches, vapes, power banks, etc.) The general public handling bare lion cells has increased significantly, whereas the amount of incidents related to cells catching fire etc. doesn't seem to have increased correspondingly. The majority seem to be from lipo "pouch cells" which are definitely far more fragile and less resistant to abuse. (They're also higher density = more energy to cause excitement when things go wrong, this is the type that's been causing the hoverboard fires.) 18650s are more robust and it's hard to cause a fire unless they're seriously abused (e.g. severe overcharge or physical damage.)

Given that you can buy empty power banks and add your own cells like this...

[http://www.aliexpress.com/item/1Pc-6-X-18650-Battery-Case- Us...](http://www.aliexpress.com/item/1Pc-6-X-18650-Battery-Case-Usb- Charger-20000mAh-Power-Bank-Battery-Case-Box-Shell-With/1928848788.html)

...it's odd that I haven't found similar battery cases for laptops. (Or maybe they do exist and I'm just using the wrong keywords. If they do, please say so; that seems like a great product to have.)

<comment><USER8> _The general public handling bare lion cells has increased significantly, whereas the amount of incidents related to cells catching fire etc. doesn 't seem to have increased correspondingly._

This may in part be due to certification and testing methodologies [0] for battery packs. The issue is that not all cells/battery packs go through this testing, so unless the batteries have been appropriately certified, there are restrictions on the handling and transportation of these batteries (for example non UN 38.3-rated cells are not allowed on planes [1]).

CE manufacturers test and certify the batteries in their products ([2], [3], [4] for example) which is why Amazon can ship them by air and passengers can carry them on planes. The issue is that 3rd party batteries may be uncertified and possibly unsafe. Lenovo doesn't want to take responsibility for an uncertified battery in one of their laptops downing an airliner [5] so they disallow the use of batteries they haven't certified. I doubt this is a nefarious scheme and more about potential liability.

(at my company we use lithium-ion battery packs for our field equipment and had to become very familiar with these issues when IATA promulgated their lithium/lithium-ion battery pack shipping rules a couple of years ago.

[0] [http://phmsa.dot.gov/pv_obj_cache/pv_obj_id_D4B2D17039E70621...](http://phmsa.dot.gov/pv_obj_cache/pv_obj_id_D4B2D17039E706213B36C1B309D41DCF8B4A0200/filename/UN_Test_Manual_Lithium_Battery_Requirements.pdf)

[1] [http://www.iata.org/whatwedo/cargo/dgr/Documents/lithium- bat...](http://www.iata.org/whatwedo/cargo/dgr/Documents/lithium-battery- guidance-document-2016-en.pdf)

[2] [https://www.lenovo.com/lenovo/us/en/Lenovo_Battery_DoC_Lette...](https://www.lenovo.com/lenovo/us/en/Lenovo_Battery_DoC_Letter.pdf)

[3] [https://www.apple.com/legal/more-resources/docs/apple- produc...](https://www.apple.com/legal/more-resources/docs/apple-product- information-sheet.pdf)

[4] [http://www.dell.com/downloads/global/corporate/environ/compl...](http://www.dell.com/downloads/global/corporate/environ/comply/dell_battery_declaration_january_2013.pdf)

[5] [http://news.yahoo.com/fires-involving-lithium-batteries- plan...](http://news.yahoo.com/fires-involving-lithium-batteries- planes-191455142--finance.html)

</comment></comment><comment><USER9> So... you need to reverse engineer some "security" thing to put 3rd party battery in a laptop? The same Lenovo people are recommending everywhere?

<comment><USER10> Considering the damage a 3rd party battery can potentially cause, I can see where Lenovo is coming from.

Of course there's also the aspect of securing margins on accessories, but there's also the aspect of making sure people's machines don't go up in flames or fail in ways that might trigger expensive repairs (which Lenovo will have to pay for if the device is still in warranty)

<comment><USER11> Lenovo would only have to cover the repair if you had the incidental damage coverage - last I checked, they're pretty sticky about not covering things that aren't manufacturer defect unless you have it.

<comment><USER10> How would they prove that the damage was caused by a third-party battery if there was no security feature to authenticate first-party ones?

People would buy third party batteries and put the original back before filing a warranty claim

<comment><USER9> Heat damage or busted overvoltage protection diode. Is there something else a broken/wrong battery can do to a laptop?

<comment><USER12> It can literally burst into flames?

<comment><USER9> They sometimes do, but then it's obvious that the laptop has been damaged by battery so the user would better show remnants of a genuine one before asking for warranty replacement.

<comment><USER13> But warranty replacement is only one aspect, what happens when a social media website gets a tweet from someone saying their lenovo exploded?

Something like that could significantly hurt the brand

<comment><USER9> Various battery powered devices, including laptops, have been in use for decades.

How many times somebody publicly blamed 3rd party battery failure on device vendor?

Links or it doesn't happen.

<comment><USER14> Not batteries, but Apple has had problems with third party chargers in the past.

The initial reports often do not say whether a third party charger/accessory is used and just says things like "Chinese flight attendant electrocuted after picking up charging iPhone 5", which is not a good look for Apple.

* [http://www.pcmag.com/article2/0,2817,2484293,00.asp](http://www.pcmag.com/article2/0,2817,2484293,00.asp)

* [http://www.nydailynews.com/news/world/chinese-teen-dies-char...](http://www.nydailynews.com/news/world/chinese-teen-dies-charging-iphone-electrocutes-article-1.1886994)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Part 1 has been discussed on HN a week ago: [https://news.ycombinator.com/item?id=11041210](https://news.ycombinator.com/item?id=11041210)

</comment><comment><USER16> If you want a cheaper battery wouldn't it be simpler and safer to replace the cells in an old Lenovo battery than to buy one of these dubious copies? That way the charge electronics are all correct and you can also control that the cells are good quality. There are even places that will do that for you if you're worried about poor soldering or other issues with doing this kind of swap.

<comment><USER17> He did mention that possibility in part 1. The reason he didn't do it is because it's hard to open the original battery without damaging the case.

</comment></comment><comment><USER18> Nice article, that was a really enjoyable read. But one of the things that stuck out to me was:

> The last four bytes of the EC firmware image clearly appeared to be a > checksum, and there were some other locations that consistently varied as > well. I guessed (correctly) that if I programmed an image with the wrong > checksums the EC would fail to boot and I would have a brick on my hands, so > trial and error was not a very good option.

I was under the impression that the checksum is validated before flashing? Isn't that the primary purpose of checksums in ROM images?

<comment><USER19> It's not possible to verify the checksum before flashing in this scheme. The EC is the only device that can calculate the checksum (1), and its RAM is probably smaller than its Flash. So there isn't enough RAM to receive the entire update, checksum, and then flash. It needs to stream to flash. So the checksum is either checked after flashing, after which it's too late to go back, or it's checked by the EC during boot, which is again too late.

There are better ways of doing this, but based on the article it seems the EC didn't implement them.

(1) We know this because the checksums are calculated on the decrypted image, and only the EC has the keys to decrypt the image.

</comment></comment><comment><USER20> Well this is very interesting- I had no idea there was a BMC-like embedded controller for laptops. There is a standard way to update the BMC firmware: "ipmitool hpm upgrade". Also sometimes the server will have a JTAG header or even a socket for the flash chip.

</comment><comment><USER21> See also: [https://news.ycombinator.com/item?id=11086158](https://news.ycombinator.com/item?id=11086158)</comment>


Amputee controls bionic leg with his thoughts - <AUTHOR> http://www.latimes.com/science/la-sci-robotic-leg-20130926,0,7310017.story

<comment><USER2> This movement looks so incredibly natural. This leg looks like something from Deus Ex Human Revolution</comment>


Ask HN: How will I know when I'm ready for contract work? - <AUTHOR> Hi HN,
I'd like to switch to doing my work as an independent contractor. The web technologies I'd like to work with are somewhat new to me, but I'm getting good at them.
The question I have is, how do I know when I'm ready to start offering my services? I want to make sure I can deliver the right amount of value, but I'm not sure how to know when I've reached that point.
Thanks! <comment><USER2> After I got my bachelors and moved in with my girlfriend I figured I would make a living freelancing. I had a _few_ contacts from having done moonlighting and part time contracting work while in school. First thing I do is I call this guy I know out Arizona. We'd work together when he was doing some contract work before his current stable gig. Two days later he called me back with a great project that was kicking off "next week". That was May of 1995, it still hasn't kicked off so far as I know.

I took a regular job three weeks later. We'd talked, it was still "a week or two out." Eventually over the years, my Rolodex expanded to where I could take another stab at it when an economic down cycle made my job evaporate and I was kind of more or less able make it work.

You're ready to start when you have a signed contract and the retainer check has cleared. Software contracting is no different from any other type of contracting. 80% of it is sales. The other 80% is doing the work. Nobody who hasn't already asked you to do a project for them is likely to care on the day you open the doors and hang out a shingle. The three most important things are:

      1. Get the job.

      2. Get the job.

      3. Get the job.

Good luck.

</comment><comment><USER3> The biggest secret to contracting is that your technical skills aren't nearly as important as your ability to sell. I'd rather be a great salesman and a mediocre developer than the other way around.

<comment><USER4> Agreed on the first line.

I've been freelancing for people who sell my work at 10x what they pay me.

But honestly, you get money equal to the value you create. Having played both roles, IMO, the sales part is much harder. It is a lot of work to tell a client how much something costs.

Sometimes you deal with racist big company clients who lead you on but are just finding some excuse to reject you. You have to learn when to stop. Some clients are just using you as a point of negotiation, you offer them a cheap price and they bring it to some big shot contractor to negotiate.

And finally there is the politics of contracts and getting paid. Some people will try to sharpen their negotiation skills on you. I have seen deals like "On contract, we wrote $3M but I can only pay you $2 million. And you were 1 week late on delivering this animated PDF feature on Android so technically you violated the contract."

</comment></comment><comment><AUTHOR> Hey everyone, thank you for these replies! All of them were helpful. I came up with these takeaways:

\- Frame your services as creating solutions to business problems, rather than trying to sell developer skills. This explains the value in terms that a client understands, and more simply, it lets non-technical clients know what you do in a way that "AWS, Go, JavaScript, PostgreSQL" can't.

\- Focus on getting clients. This is a bigger barrier to entry than how good you are at creating software. Don't expect to do well just because you are good at making things.

\- You're probably qualified to do this if you've been a developer for a few years.

With this information, I'm going to follow the plan I already had, but with more confidence and focus since I feel more like I'm on the right track. I'm going to launch a few nice side projects with moderate levels of complexity to solidify my skills and figure out how long things take (important for estimates), and then I'll try getting clients using those projects to showcase what I'm capable of doing.

Thanks again everyone!

</comment><comment><USER5> The question is what you want to be doing in 5 years or so. You should start taking steps towards that goal. If you want to be freelancer, then you should start taking steps towards that goal. Your first goal might be to get a regular job to save enough money for 6 months of living expenses. Or maybe you don't need to save any money then start now.

As for technical skills, let me tell you a story of my friend. He was an average or below average programmer in university. We all got jobs in brand name companies; he could not get even an interview. Honestly, he was really bad programmer, I don't fault companies.

He expanded his job search from big companies, to smaller companies, to finally anyone posting a gig on Craig's List. He wanted to get hired by a guy who was setting up his band's blog. He had no idea what he was doing.

Eventually, he did a few fixed price contract work for setting up blogs. Then he got a contract to build Facebook for $500. He thought he could do that in a month. As deadline approached, he asked one of his unemployed friend to help him with it, who was also a bad programmer. They still thought they can deliver it within a few weeks. Of course, they never finished and not sure if they even got paid anything for it.

But they kept on bidding projects, taking on too much work to handle. They asked their friends including me if we wanted some side work. Of course, we said no when we saw type of work and money involved.

Eventually, they started a company to look professional. They hired part-time programmers. They even started an internship program with a local university.

Now 7 years later, they have 20 people working for them. They still like to code and they know they are bad programmers. They tell me that their programmers hate it when they get involved in a project. They are supposedly still working on Facebook clone website.

Now to be honest, they did had several advantages over many people in the US. They lived with their parents, so had no living expenses. Their education was paid for by their parents, so they graduated with no debts. So their success might not be easy to copy if you have bills to pay.

Also pretty sure all these perks came with daily nagging by their parents though.

</comment><comment><USER6> I started contracting after about 3 years of perm work. And have been contracting since then. So you are probably ready.

Contracting is mostly about delivering business value. Solving business problems is what you get hired as a contractor for, tech is usually not that important as most companies that hire contractors don't have a good understanding of tech anyways. So they'll be happy to let you recommend the technical solution that solves their business problem.

</comment><comment><USER7> You're ready right now. If you keep waiting for the right time to come or the perfect conditions to fall into place you'll quite likely never start but keep asking yourself that question.

So, start by talking to potential clients and try selling your services. At the very least this will provide you with invaluable information as to which skills you might need to improve or acquire.

</comment><comment><USER8> I'd say when you've saved up, say, 6 months of living costs.

</comment><comment><USER9> If you can fog a mirror, you're ready.

<comment><USER10> That's funny. What do you mean, though? That it's easy?

<comment><USER9> Yes, essentially. I've worked in the industry for close to 20 years and that bar for "contractors" is quite low indeed.

<comment><AUTHOR> Hey, thanks for your reply. Would you say that this low bar means that for an actually good contractor, there's a lot of opportunity for word-of-mouth references, repeat business relationships, or high hourly rates?

<comment><USER9> All of these things.

</comment></comment></comment></comment></comment><comment><USER11> When you land a contract.</comment>


CryptAByte.com: Making cryptography (more) accessible to non-hackers - <AUTHOR> http://lfb.org/today/cryptography-for-the-rest-of-us/

<comment><USER2> DO NOT USE FOR ANYTHING IMPORTANT!!!!! CRYPTOBYTE IS NOT SECURE AT THIS TIME!!!!!

The developer says:

       CryptAByte uses public-key encryption just
       like HTTPS/SSL and OpenPGP/PGP. The algorithms
       used are RSA for key pairs, AES 256 to encrypt
       messages and files, and SHA 256 for hashing. The
       servers hosting this application support can encrypt
       2.1 GB of data per second using the latest Intel CPU's
       with AES support built into the chipset.

Server-side encryption means that the people running the server have access to the plaintext. The web interface simply does a PUT request that sends the plaintext to the server.

Another problem is that they are storing your private RSA key on their server. When you ask to retrieve your messages, you do an AJAX POST request, giving a token to identify they key, and your password. Presumably, the key is encrypted using the password.

If their servers are compromised, whether by hackers or by search warrant, the security of your private key depends on how good your password is. They are pitching this as bringing good security to the masses. THE MASSES SUCK AT CHOOSING GOOD PASSWORDS. If you want to bring good security to the masses, it is ludicrous to make the security of the system rest on the ability of the masses to pick a high entropy password.

In defense of the developer, it is quite possible he knows all this. In the interview the article mentions ([http://libertarianstandard.com/2012/06/07/exclusive- intervie...](http://libertarianstandard.com/2012/06/07/exclusive-interview- with-cryptabytes-creator-david-veksler/)), it is clear that this is an experiment at this stage, and it is quite possible that the developer has simply not gotten around to addressing those issues yet. The author of the article clearly has no technical knowledge of cryptography whatsoever, and so may have not understood that CryptAByte is an early stage exploration of concepts at this point.

I've got some experience designing a similar product, and I'm pretty sure that when he does get around to dealing with those issues he's going to find that it cannot be done without abandoning the idea of doing at all on the web. As far as I can see, to be secure even with users who do not pick strong passwords, you need access to the local filesystem and to a local source of cryptographically secure random numbers.

From the article (so blame the article author, not the developer):

       But it gets more brilliant. How can you know that you can
       really trust the service, or that Veksler himself works for
       the FBI or the like? Well, you don't have to trust him. Veksler
       is making the entire apparatus completely open source so that
       anyone can inspect the code. He does nothing on the site that is
       not wholly open to the world, so that way anyone can know everything
       that is going on in the engine room but no one, not even the service
       owner, can know what is being communicated.

Pure bullshit. The user has no way of knowing that the code ACTUALLY RUNNING on the site is the same as the code that is released as open source.

<comment><USER3> CryptAByte author here.

The fundamental issue is whether you can trust server-side encryption. Theoretically you're right that you cannot absolutely trust my service to do what it says it does. And I would not trust it relative to client-side software either.

So, I would suggest that everyone use offline encryption, and my service exposes an API with offline encryption that works seamlessly with server-side encryption: <https://cryptabyte.com/Service>

Furthermore, I'm working on desktop apps which will do the encryption offline: <https://cryptabyte.com/Home/Apps>

But, for the average, non-technical user, the choice may be between not using encryption at all or relying on a poorly secured desktop environment and using my service. In that case, it may be more desirable to use my service than the alternative.

Regarding key strength, my hope is that most people do not enter a password, allowing the software to generate it for them. For the self-destructing emails (<https://cryptabyte.com/SelfDestruct>), I do not allow entering the password, but generate a secure, 32 character passphrase.

</comment></comment><comment><USER4> I'm happy to have another partner- in- debunking- broken- crypto here and so a little giddy at seeing the 'tzs comment, but he missed some stuff.

Grab the source code and you'll see that --- at least as regards the cryptography components of this application --- it's practically the "Hello World" example from the MSDN System.Security.Cryptography documentation.

That's not in itself a problem; lots of "hello world"-grade libraries are useful. Unfortunately, like every other low-level crypto library, the MSDN documentation does an appalling job of showing how to write a secure cryptosystem. Blame the docs, blame Microsoft, blame the developer, but this program gets a bunch of things painfully wrong.

By way of bona fides and to start this off: I'm pretty sure that using PBKDF2 to generate the key _and_ the IV for AES-CBC is broken; it produces a deterministic repeating IV for every message encrypted under a given key. Had the default mode for AesManaged been CTR, or had the developer chosen CTR mode, this would be a devastating problem; it would mean attackers without knowing anything about the key or even the encryption method could, in seconds, discover that CTR mode with a repeating nonce had been used _and decrypt the messages_. Fortunately, since the .NET default is CBC, it just subtly weakens the cryptosystem instead of killing it.

Why-oh-why derive the IV from the key? An idiom in modern cryptosystems: generate a random block and tack it to the front of the message.

Do you want to entrust your secret messages to developers who get this wrong? Only if you want to do that developer a favor. It's fine if you do, but I recommend trusting your real secrets to GPG/PGP.

There are significantly worse problems with this library (at least, I think; I read it for just a few minutes). Exercises for the interested reader.

<comment><USER3> Hi tptacek,

Thanks for your feedback. You're right that cryptography is not my strong point - but my hope in making the code open source is that others will help improve my code. I didn't write the AES code - I just used a popular sample, but a bad one it seems. What do you think of [http://msdn.microsoft.com/en- us/library/system.security.cryp...](http://msdn.microsoft.com/en- us/library/system.security.cryptography.aesmanaged.aspx) ?

Yes, using PGP is better. Yes, I ended up implementing a poor (but much better performing) copy of PGP. It's flawed, but I did it in a few days and I think it's not broken. For the next version, I will use BouncyCastle for a true OpenPGP implementation.

</comment></comment><comment><USER5> 'It is called cryptabyte.com. It is the first, easy-to-use, web-based service to provide _absolutely_ _uncrackable_ security in communications and file sharing."

(emphasis mine)

"CryptAByte uses public-key encryption just like HTTPS/SSL and OpenPGP/PGP. The algorithms used are RSA for key pairs, AES 256 to encrypt messages and files, and SHA 256 for hashing."

Soooo -- _like_ SSL and OpenPGP, but not actually OpenPGP. Yes, let's use AES directly some more and not release source code until some undefined point in the future -- that sounds like a fantastic idea!

Aren't plain PGP/GPG installables for all platforms user friendly enough already? If they're not, can we please make websites that are basically cheap shims over gpg's stdout/stdin?

<comment><USER4> He did release the source code.

On the other hand: don't trust secrets to developers who call passphrase-based encryption "absolutely uncrackable" because theirs contains the letters "A-E-S". The block cipher function this system uses has almost nothing to do with its security, which (modulo implementation errors, of which there are several) devolves to PBKDF2.</comment></comment>


In-person DEF CON 28 cancelled - <AUTHOR> https://forum.defcon.org/node/232005 <comment><AUTHOR> (For those unfamiliar: there's a tired annual joke about DEF CON being cancelled, the scene's equivalent of trying to sell the freshmen elevator passes, so expect lots of jokes about how the conference hasn't been cancelled. It has, predictably, been in fact cancelled this year.)

Along with Black Hat (the "professional" version of Defcon) and B-Sides Las Vegas, this is "security summer camp", the weeks at the end of July and beginning of August. None of these events are likely to occur on-site this year.

 _Later_

And, on cue, in-person Black Hat is cancelled as well:

[https://twitter.com/BlackHatEvents/status/125883283428810752...](https://twitter.com/BlackHatEvents/status/1258832834288107521)

Black Hat is still going to happen virtually (we just finished selecting talks).

<comment><USER2> Tired: "DEFCON is cancelled"

Wired: "'DEFCON is cancelled' jokes are cancelled"

I look forward to the virtual talks from both events. Some incredible talent in both pools.

<comment><USER3> DEFCON: The waffle house of security conferences

<comment><USER4> > DEFCON: The waffle house of security conferences

I'm afraid I haven't been to enough waffle houses to understand if this is a good thing or bad thing?

<comment><USER2> They're referring to the Waffle House Index.

[https://en.wikipedia.org/wiki/Waffle_House_Index](https://en.wikipedia.org/wiki/Waffle_House_Index)

<comment><USER5> To bad the Wikipedia entry is completely wrong on when he coined the term. If it was in response to the July 2011 tornados in Joplin, then how come I have a video of him giving the WFI anecdote in November 2009 at RHOK#0 (Random Hacks of Kindness hack day).

</comment></comment></comment></comment></comment></comment><comment><USER6> Given they have picked a few platforms, but are leaving a lot of choices up to the individual organizers, presenters, etc — aside from having:

— burner hardware, — one-time network connections, — one-time user accounts, — one-time identifiers, — read-only OS builds, — physically disabling sensors, — (insert suggestions)

What else might be options for securely accessing the event?

<comment><USER2> > What else might be options for securely accessing the event?

I generally recommend ensuring that your security posture for DEFCON is the same baseline security posture you should have at all times, and for all websites, and then adjusting your habits accordingly months in advance... and then just chilling out because you've adopted a more secure normal (and DEFCON isn't particularly risky compared to everyday life).

Pantomiming paranoid-level security during hacker summer camp is silly. This is true for both in-person events and this year's virtual event.

If you're worried about getting hacked at DEFCON, don't wait until DEFCON to become secure, and don't become lax after DEFCON is over.

<comment><USER7> If you _were_ a blackhat, burning a 0-day at DEFCON would be a huge waste. You probably wouldn't get anything interesting, and chances are someone would catch it.

<comment><USER8> It would be _fun_ though

<comment><USER9> And even more importantly, it might prove somebody wrong about something.

</comment></comment></comment></comment></comment><comment><USER10> This will be fascinating to attend/watch not just to see the impacts of doing it all virtual, but the fact that it's free is going to attract a monstrous (virtual) crowd.

<comment><USER11> Last time I went in person, you couldn't get into the best talks unless you picked one or two and camped for the day, because all the halls were overflowing with people. I think it was the last year they held it at the Rio.

<comment><USER12> That's been a constant DEF CON theme at least since the Rivera days but had (IMO) improved incrementally with the move to multiple larger venues and was expected to be all but resolved with the move to the new Caesars Forum

(New venue is/will be (?) absolutely enormous; featuring the largest "pillar- less" ballrooms in the world it promised the ability to accommodate not only all talks and villages in a single venue again but everyone in a single keynote talk. Looking forward to witnessing that next year.)

edit: It's occurred to me that it could conceivably be more difficult to get into talks at this year's virtual event than it would have been in-person. Perhaps they'll implement a virtual waiting room so we can get our LINECON fix.

<comment><USER13> > but had (IMO) improved incrementally with the move to multiple larger venues

I feel like it is getting worse, and can't wait for Caesars. With the multiple venues and hallway congestion most the people in my company were able to get to 2-3 talks a day max.

Counterfeit DEF CON badges (and a sanctioned competition for them) have really added to capacity issues since about 2016. I know of one vendor that sold over 1,500 last year.

<comment><USER12> I'm sure I'm devoting more time to villages, workshops, and non-DEF CON talks than I used to (after all the official talks end up on YT a couple months after the event). It did seem to me--CP elevator choke point notwithstanding-- that separating talks from the rest of the con by a 20+ minute walk did shorten LINECON but I'll concede there's a small chance that I'm becoming more patient or (more likely) that my experience was not representative.

Regardless, I am very intrigued by your experience with counterfeit badges. I'm familiar with the counterfeit badge contest and many jokes were made about last year's "urinal cakes on a lanyard" but this is the first I've heard suggesting there was effectively mass production of counterfeit badges. Can you tell us more?

<comment><USER14> there's a backup laminated paper badge for when the electronic badge runs out of stock, maybe it's that

<comment><USER12> While lame, that certainly seems much more feasible than mass-producing 1500 copies of an electronic badge (or even a mock thereof) in the span of a couple days but it also renders mention of the sanctioned (actual) badge counterfeiting competition (which to my knowledge involves paying competitors) irrelevant.

Given that #badgelife folks have difficulty manufacturing hundreds of badges they themselves designed and there's been no real scrutiny of attendee badges as would surely result if it were found that 5%+ of attendees had counterfeits, I have to call bullshit.

If reasonable evidence is presented to the contrary, I will eat my hat by donating the $300 I won't be spending for this year's DEF CON admission to the EFF.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> At least no weird room searches by Caesars this year

<comment><USER16> Our room in Planet Hollywood got searched last year.

<comment><USER17> WTAF?

Given the attendees, I'm surprised some didn't seriously mess with anybody entering their rooms. At the very least, one would expect all the goons getting doxxed, their phones pwned, and the whole shaming posted somewhere.

<comment><AUTHOR> It's not about the event; it's a thing Las Vegas hotels are doing now in response to the Mandalay shooting.

<comment><USER16> Is that for attendees to all conferences, or are we special here?

<comment><AUTHOR> I think if you just randomly visited Mandalay or Caesar's on vacation, you'd have the same likelihood of having your room looked in on. Every room has a notice to that effect now.

<comment><USER16> That's interesting. I'd assumed it was mainly for us.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Reviewing the post, it is unclear what if anything this update by DEFCON means to those who had not intended to attend, but might since it is now appears for this year a real-time remote access event only is being held.

What does this mean?

</comment><comment><USER18> It's incredibly disappointing to see DEF CON, a conference where you can still show up and pay for entry in cash, adopt a centralized, hosted, unencrypted system (Discord) that requires both:

1\. that you enter into an abusive legal agreement wherein you agree to give up your civil rights

and

2\. that you dox yourself to get an account (you have to give either a non-VPN IP, or a non-VoIP phone number)

My Discord account got banned from being created from Tor and using a burner number and linking my own friends to my own website in DM (because they spy on all the unencrypted messages, natch).

This means I won't be able to participate in DEF CON this year. :(

<comment><USER13> I would like to point out that you are posting this very comment on a centralized, hosted, unencrypted system.

But in all seriousness, the DEF CON Forums are generally full of helpful knowledgeable people who can help guide you in creating a non-attrib Discord account if you are having problems.

<comment><USER19> I would like to point out that one can assume different identities on the web, and that I am fine giving my personal email and address to my bank, but perhaps not to a hacker conference. Why? Because it's my choice.

</comment></comment></comment><comment> Pirate-of-SV This was going to be my first DEF CON to attend in-person. See you next year!

<comment><USER20> Next year is cancelled as well.

<comment><USER21> Next year is not cancelled.

> The good news is DEF CON will survive, and DEF CON 29 is planned for August > 5-8 2021, you can reserve your rooms now.

<comment><USER22> It's a common defcon joke. It's been "cancelled" for years.

</comment></comment></comment></comment><comment><USER23> Think I'm going to elect to use a burner machine to tune in to this one.

</comment><comment><USER24> We fucked it up :-(

<comment><USER25> Underrated comment :)

</comment></comment><comment><USER26> Also potentially relevant: [https://twitter.com/oooverflow/status/1258847818434801664](https://twitter.com/oooverflow/status/1258847818434801664)

</comment><comment><USER27> I really want to attend, especially since it's virtual and free.

But given some of the comments, I'm not really if I should and how, especially since I'll be dialing from home.

I can use VPN, but not sure how the streaming would be on it. Also, what all precautions I should take.

I'm sure many would love a how to guide..

<comment><USER28> Huh? Why do you have to take precautions to view a live stream?

<comment><USER27> Read some of the comments. Perhaps I'm over thinking.

I guess it depends on where the livestream is hosted. Is it YouTube or some other site?

</comment></comment></comment><comment><USER29> So... a virus took down the entire conference? How on brand.

</comment><comment><USER30> How is this different than just going on youtube and irc?

<comment><USER31> Part of DEFCON includes interactive activities such as labs and competitions.

</comment></comment><comment><USER32> Soooo quicker publishing to YouTube then?

</comment><comment><USER33> Even if it's virtual, the wifi will still not be safe...</comment>


Feeling bad about feeling bad can make you feel worse - <AUTHOR> http://news.berkeley.edu/2017/08/10/emotionalacceptance/ <comment><USER2> Something I wish my parents had told me when I was growing up:

You, the thing listening to this advice, is just a small part of a greater whole, much of which you (the thing listening to this advice) are not consciously aware of. This is because you were built by your genes to be good mainly at one thing: reproducing. That's all your genes care about. They don't care about your happiness or achievements or having a fulfilled life. In fact, they don't even really "care" about reproducing, except the same way that water cares about flowing downhill.

Your negative emotions are real. The pain you feel is real. But it's not _you_. It's something that is being _done_ to you. In that regard it is exactly the same as physical pain, which is also not part of you, but rather something done _to_ you. The fact that you're depressed is no more a character flaw than the fact that it hurts when you skin your knee.

<comment><USER3> I actually go the completely opposite way, and I'm the happiest person I know.

I own everything, everything that happens to me, everything that goes wrong around me, I take my share of responsibility in it. Analyze what I can do to improve it, and do it.

When I think like what you mentioned I tend to lose control of my emotions, I feel angrier, I feel sadder. When I own what happens to me, I feel peace. I know almost everything can be improved. Maybe not short term, but eventually.

Coming back to the other side, I think the core of it is that thinking that stuff is happening to me makes me feel like a victim. I don't take responsibility for anything, thus it must be the fault of some external factor. I try to rationalize and assign blame. All in all, it's a much more negative experience for me.

<comment><USER2> > I own everything, everything that happens to me

Really? Everything that _happens_ to you? What if you were mugged?

I think you can (and should) take responsibility for what you _do_ (or don't do), but I don't think you can (or should) take responsibility for what you _feel_ because you don't have control over that.

<comment><USER4> > What if you were mugged?

Walking down a dark alley, alone, at night and not having a sense of situational awareness. I was nearly mugged because of that, and now have a much greater sense of situational awareness.

I know, I know, blaming the victim is bad, but sometimes clearly assessing what led you to be in a certain type of situation can help you avoid those types of situations in the future.

<comment><USER5> Well not really in this case. This is still trying to align sense and structure to an otherwise random event. Suppose you got mugged with your partner on a lightly populated main Street in the evening by a stranger with a gun, as happened to my partner and I; what is the takeaway there? Muggings, like many other situations we imagine, tend not to happen as we've seen it in movies and tv but more so when we least expect it.

A lot about owning a situation is allowing yourself to do what feels right, not creating a plan for every contingency and situation. Muggings happen and they're very unfortunate and bad. But owning it well isn't as much about future prevention as it is trying to make sure that you still can have control over yourself afterwards. Sometimes things happen; why did some guy key my beat up old 95 Accord and not the dozens of other cars? Probably alcohol, but the point is less about the specific reason and more what you do in response and how you are able to gain control and feel comfortable.

<comment><USER6> cancer ?

</comment></comment></comment></comment></comment></comment><comment><USER7> I've come to accept this with regards to sexist/racist thoughts. Once you realize that it is a normal, ingrained biological urge to have these thoughts as a result of human evolution and cultural conditioning, it frees you to stop "feeling bad" about having those thoughts and trying to block them out, so that you can objectively assess the flawed assumptions behind them and reason yourself past them without the need for self shaming.

<comment><USER8> Looking at a young woman and the first thing that clicks on my head its asking and answering "is she attractive?" in a matter of milliseconds; its annoying as hell... why can't my first through be something more interesting? or at least why can't it be nothing at all so it doesn't interrupt my thinking? but I have come to realize that this is a more of a hormonal reflex than what we usually consider "a thought"; an annoying reflex which exists in a lot of other species as well, not just humans. I have noticed this reflex only weakens when I'm feeling depressed or other strong negative emotions; which I guess makes a lot of sense in an evolutionary context.

<comment><USER9> Why is it annoying? Who told you that you need to feel bad?

<comment><USER10> By having those sorts of thoughts, you are privileging that aspect of them over any other sort of accomplishments they might have. They have less opportunity to present themselves in the way they would like to.

Imagine if everyone around you in your workplace would think about how you're dressed instead of what you're actually trying to talk to them about.

<comment><USER11> Women have the same instinctive reaction to attractive men though. I do agree everyone should be aware of how attractiveness can influence their perception of another person, but I don't feel guilty about noticing whether a woman is attractive or not and I definitely am not going to make a futile attempt to prevent it.

<comment><USER10> We live in a society where this issue affects women way more than it does men (see Clinton getting lectured at about not constantly smiling). Bringing this up is part of a fight to reduce systemic bias.

<comment><USER11> I get that and generally agree. I am more challenging the idea of feeling bad / guilty about sexual attraction, which I interpreted as being implied by some of the other comments in this thread.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> I feel like this validates my tendency to deal with a serious Low Mood by turning out the lights, lying on the floor with headphones on, and listening to the saddest, loneliest music in my collection for a while. I'm gonna feel sad whatever I do, and I may as well make some time to give in to _really_ feeling sad and getting it out of the way.

When I feel bad I generally do a quick mental checklist: Have I drunk any water lately? Have I eaten? Have I had my pills? Usually the answer to at least one of those is 'no' and I feel better after correcting them. Then since my need for a warm place to sleep is pretty well settled, it jumps up a few notches to checking when the last time I cuddled someone was, how I feel about my current project, etc.

<comment><USER13> Thank you for sharing this.

</comment></comment><comment><USER14> This article is going to make you feel bad about "feeling bad about feeling bad"...don't go there. You've been warned.

<comment><USER15> Too late...I don't even know what level I'm in anymore. Hopefully this will stop before I experience a depression stack overflow.

<comment><USER8> Jokes on you, at 2 levels I already overflowed. I would buy more emotional DDR memory for myself but the human body is closed hardware with no extra slots available.

<comment><USER16> There's a slot in the back but it unfortunately isn't backwards compatible.

</comment></comment></comment></comment><comment><USER17> I learned to accept that I feel bad sometimes and it made me happier.

But I went farther than that.

I also learned to accept that my ideas and behaviors are inconsistent and it helped me better understand the world and myself.

And finally, I learned to accept that I sometimes do bad things (and desire to do even more bad things) and it made me a better person.

(Disclaimer: my experiments have n=1, no control group and subjective measurements chosen in hindsight.)

<comment><USER18> That touches on a couple of Buddhist thoughts.

The human condition is suffering. Suffering comes from desire.

Rather than desire your unhappiness to disappear, you've accepted it. Thus, you do not suffer from it.

Or so they say.

<comment><USER19> You're a bad Buddhist.

<comment><USER18> We all are.

</comment></comment></comment></comment><comment><USER20> This article sounds like a long version of Carl Jung's quote -> "what you resists, persists" to me. That's how I deal with pain. I don't try to resist it. I simply allow myself to go through the pain. Cry occasionally if I had to. Feeling bad about feeling bad doesn't make me feel better, it simply delays my healing.

</comment><comment><USER21> Been there, done that :( For me, it's been a negative spiral that ends with behavioral paralysis.

Over the years, I've managed to train myself to be amused by feeling bad. Because it's so pointless and silly. And so I smile, feel happy, and consider what needs done. Sometimes what needs done is sleeping for 15 hours. But that's very different from refusing to get out of bed.

</comment><comment><USER22> I wonder if causality is backwards. Perhaps if your negative emotions are really causing problems, you're more likely to actively to to stop them by telling yourself not to feel them.

<comment><USER23> It's both — it's a feedback loop. Here's a typical couple of days when you're dealing with uncontrolled anxiety:

You feel like shit, that makes you unproductive and slow and dull. End of the day, you didn't get anything done because you stare at your text editor and your brain just refuses to engage in anything but panicking over... something. You get home, Now you still fill like shit the same as before, but also feel like shit over the fact that you didn't get anything done today and and you need to make up for it tomorrow. But then you don't get any proper sleep and you still have to catch and on lost time and you're in for a pretty bad day, but you shouldn't think like that, why are you wallowing in self pity, just get over yourself and get stuff done. But that doesn't really work, oh shit oh shit oh shit thingsarespiralingoutofcontrolwhatdoIdo?

You fall into that trap and now you're proper screwed. Anxiety is causing problems, problems are causing anxiety. The alternative is to learn to cut the second order effect short, which stops the loop. Yes, you had a bad day, and yes, your project is delayed because of it. What's done is done, and you can't fix it, so just accept it. Let people know you're behind schedule, replan if necessary, and move on.

In many ways, breaking that cycle is an exercise in allowing yourself self- compassion without indulging in self-pity.

<comment><USER24> Agree with all of this. Additionally, splitting the idea of myself into past, present and future really helped as well.

That is, whatever past Foo did is done. Maybe he was a dickhead and didn't study for the exam that future Foo is gonna have to sit. So present Foo can be a better friend and get that shit out of the way now, so future Foo can relax, pass, and gets to drink beer.

Like that concept of being your own best friend, only the friend you're forgiving is your past self and the friend you're doing favours to is future you.

Helps to get away from hang-ups about what is already in the past, and for some reason many people struggle with the idea of themselves as a person they should be kind towards.

</comment></comment></comment><comment><USER25> I have learned some strategies for dealing with emotions from Feeling Good: The New Mood Therapy by David Burns. By controlling your thoughts you ultimately control how you feel.

<comment><USER26> Perhaps to a certain degree, but people with imbalanced brain chemistries who are affected by bipolar disorder, personality disorders etc. cannot simply 'think' bad moods away. It's unfortunately more complicated than that.

<comment><USER27> It's simple, if you want to fly, just fall and miss the ground.

Simple doesn't mean easy.

I used to suffer from severe clinical depression and ultimately the only thing that's helped was to learn how to control my thoughts. It still rears its head when I'm tired, hungry, or drunk enough so I don't have the energy to control my thoughts. Hell, sometimes I just relax too much and forget to and it comes rushing back.

But on the bright side, the need for constant productive output has really helped both my career and my physique. Pros and cons I guess.

Ultimately I find this much more desirable than the antidepressants that just made me numb to everything.

</comment></comment></comment><comment><USER28> I don't know if this claim is true or false but I'm pretty sure that doing a study on this kind of thing is an extremely fraught enterprise. Edit: more so than even simpler psychology studies, many of which are coming back with problems.

How does one determine that someone is really "feeling bad about feeling bad" or whether they're satisfying some expectation of the experimenter or doing something else? And moreover, cause and effect can be slippery, maybe those with more extreme problems tend to be caused to do the thing the experimenter thinks is a mistake rather what they do having an effect.

</comment><comment><USER29> Alan Watts said it better: [https://www.youtube.com/watch?v=emHAoQGoQic](https://www.youtube.com/watch?v=emHAoQGoQic)

worrying about worrying about worrying

<comment><USER30> Are there any existing recordings of Alan Watts that don't contain a distracting background track? If what he has to say is actually useful, there is no need for the cheap trick.

<comment><USER31> Yes: [https://www.alanwatts.org/](https://www.alanwatts.org/)

Also (good starter collection): [https://www.discogs.com/Alan-Watts-Out-Of- Your-Mind/release/...](https://www.discogs.com/Alan-Watts-Out-Of-Your- Mind/release/2831541)

(There seems to be a small industry of YouTubers taking snippets of Watts and adding music and images to make short inspiring videos. To be fair, most of them don't do the background music thing.)

</comment></comment></comment><comment><USER32> Somewhat similar to some problems I used to have with sleeping. If I was particularly stressed and had trouble getting to sleep a couple of days in a row. Then I would be stressed, tired because of lack of sleep and now starting to stress about not being able to get to sleep leading me to find it even harder to sleep.

</comment><comment><USER33> "Men are affected not by things but the view they take of them" \-- Epictetus, Stoic philosopher

</comment><comment><USER34> It feels like a "duh" thing to me.

Emotions are adaptations. They trigger in particular circumstances and they cause particular behaviors. The entire point of having an emotion is to engage in emotionally appropriate behavior until the circumstance has passed. Positive emotions are attractors towards the triggering class of circumstances, while negative emotions are repellers.

"Feeling bad about feeling bad" pretty much works out to be something like "naive gradient descent on the function that maps attention onto emotional valence". This doesn't solve the underlying situations that cause you to feel bad - it's like not looking at pictures of your dead wife, rather than grieving, getting support from friends and family, and then moving on with your life.

<comment><USER35> You rang?

Emotional Valence and the Free-Energy Principle (2013) [http://journals.plos.org/ploscompbiol/article?id=10.1371/jou...](http://journals.plos.org/ploscompbiol/article?id=10.1371/journal.pcbi.1003094)

</comment></comment><comment><USER36> This effect is at the root of homesickness, I think. In my experience you're never _really_ homesick when you're happy - homesickness only happens when you're sad for some reason and you can't separate it from the place/situation you're in. That reason is only sometimes a direct result of that situation, but your instinctive response is to think "this would be better if I were at home" regardless.

Getting over homesickness seems to be about being able to accept the bad thoughts as you would do at home and move on, rather than "feeling bad about feeling bad" in the form of wishing you could just go home.

I'm fortunate enough to have never experienced it, but I imagine serious grieving is like this too.

</comment><comment><USER37> This paradoxical idea of sitting with and being close to the very things that make you suffer is central to Alan Watts' teachings, who westernized Zen Buddhism in a secular way. Robert Wright also talked about this very topic in a recent episode of Fresh Air.

</comment><comment><USER38> If this piece interests you, you should read the "subtle art of not giving a f*ck." Its a nice down to earth book about dealing with negative emotions and high expectations.

[https://www.goodreads.com/book/show/28257707-the-subtle- art-...](https://www.goodreads.com/book/show/28257707-the-subtle-art-of-not- giving-a-f-ck)

<comment><USER39> Eh, you can skip that (it's not a bad book) and go directly read the Stoics.

<comment><USER38> Does the work of the stoics make you laugh and speed your eyes over their witty pages and puns? I also liked "a guide to the good life" [0], but the Subtle art is a much easier and lighter read.

[0] [https://www.amazon.com/Guide-Good-Life-Ancient- Stoic/dp/1522...](https://www.amazon.com/Guide-Good-Life-Ancient- Stoic/dp/1522632735)

<comment><USER39> Thanks for your downvote; it substantially aids your argument.

As I've said, the book does re-package some millennia old ideas and adds couple of hundreds usages of the f*ck world -- because it's of highest priority to be witty for some, apparently. Hell, CBT essentially does the same -- but it doesn't feels witty as it should be, right? Witty is of utmost importance after all.

<comment><USER40> > Thanks for your downvote; it substantially aids your argument.

How do you know who downvoted you?

<comment><USER39> Occam's razor.

<comment><USER38> Haha, Occam failed you this time ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER41> Maybe this sounds too simple and not academic:

The more I am busy (with meaningful work) the less time I have time to feel bad about feeling bad or just thinking about this.

This doesn't mean one should escape into random work but that there maight be a slight correlation.

<comment><USER42> I've found that when I'm in a better mood I find myself more busy with meaningful work, so the correlation may go the other way.

<comment><USER41> IDK and in my case the cause effect direction is the other way.

Imagine you get busy because of external deadlines you cannot influence and you need get things done and don't have time to think a second about anything unrelated.

Even if you are in a bad mood and don't want to work you MUST because of the deadlines. Once you are working towards the deadlines, all bad feelings are gone.

Not sure how it works the way around, I am happy, now I make myself busy with random taks?

Edit: Still thinking about your opinion and now I might agree. If you feel good you might have the willpower to start new meaningful things which make you busy again.

</comment></comment></comment><comment><USER43> Therefore.. Feeling good about feeling good, can make you ecstatic. <punExplainer>When you keep feeling good about your previous good thought, the system is stable, hence, 'static'.</punExplainer>

</comment><comment><USER44> I think the same goes for worrying too much about and trying to assert too much control over one's impulsive behavior. Like trying to eliminate it completely. It may paradoxically bring more of it.

</comment><comment><USER45> Reminds me of Mr Prosser who felt bad about vacating Arthur, then felt good about feeling bad.

</comment><comment><USER46> Is this why some antidepressants work, they can break the cycle ?

<comment><USER47> That's what being on an SSRI has felt like to me: it seems to dull neurotic 'loops' in my head. It doesn't make them go away entirely but, maybe, (it's hard to explain) it seems like the loop doesn't bother the rest of my brain as much.

</comment></comment><comment><USER48> Overthinking is a curse. JFDI.

</comment><comment><USER49> By controlling your thoughts, you control the universe. Mind blown.

</comment><comment><USER50> It's bad feels all the way down.

</comment><comment><USER51> No shit.

</comment><comment><USER52> > We found that people who habitually accept their negative emotions > experience fewer negative emotions

and

> those who generally allow such bleak feelings as sadness, disappointment and > resentment to run their course reported fewer mood disorder symptoms than > those who critique them or push them away, even after six months

Yet the comments so far are mostly about "controlling your thoughts", rather than accepting negative emotions (and maybe looking at what they're trying to tell you rather than killing the messengers).

<comment><USER53> I think recognizing why we feel a certain way is important but a little different than what the article is discussing at face value. A lot of what the article discussed seemed to describe people feeling added emotional stress because of a reluctance to believe that the negative emotions afflicting them were okay (for lack of a better term). It's like the difference between struggling to swim out of a powerful current versus simply letting it carry you and waiting for the lifeguard because you know you're already caught. Granted, you should probably signal the lifeguard but that breaks the metaphor.

<comment><USER24> How about the waterfall metaphor - If you get washed over a waterfall (or a wier) you'll stick in the eddies below, your instinct will be to swim up and try to keep your head above water. But, doing this will ensure you keep getting washed back under the waterfall. Instead, a better approach is to swim down, then away downstream.

Point is directly fighting against something can keep you trapped by it. Rolling with it and working yourself into a better position without resistance can, eventually, take you away from the problem.</comment></comment></comment>


Ask YC: CS/Programming Online - <AUTHOR>

Where's a good place to get a CS or programming degree via online courses? <comment><USER2> I'm finishing up my degree online this year. After a lot of research a couple of years ago, I settled on the University of Maryland. : <http://www.umuc.edu/online_ed.shtml>

Here's my criteria: I needed a Bachelor's degree program. I wanted an actual brick and mortar school that offered it's courses online. And, I wanted it to be as geeky/CS heavy as possible. UMUC fit all of those.

While they don't offer a full CS degree, their full online degree is Computer and Information Science. That's more of their Software Engineering major as opposed to their Computer Science major. It's a "Java school." So, take that for what it's worth. I wish I had more algorithms/compiler type classes. But, I knew that I wanted to do web apps when I was done, so that's what I focused my schooling on.

I'm sure that you might be able to skate through your degree, but it's far from a diploma mill. I've worked full time the whole way through, and have only been able to carry 9 credits at the maximum. Generally I've only been able to carry 6 credits. The University of Maryland has a decent reputation. For what it's worth, after my first year, I got an email from the National Security Agency inviting me to apply for a full ride scholarship. I doubt that you'll get that at Kaplan, Capella or at U of Phoenix.

UMUC has a big contract with the military, so you're doing a lot of your distance education with people in the military or work for companies that do military contracting. I took classes with other students who were working in the Intelligence community, who were in combat zones, and one guy was doing penetration testing for the State Department. I'm careful with what I post online, and we don't chat about our jobs much. :)

All in all, it's been worth it, and I'd recommend it as long as you use Ratemyprofessor.com. Like any University, some teachers are tools, some are phenomenal. Like any degree, you get out of it what you put into it.

<comment><USER3> I've hired UMUC online grads before (not from the CIS program, but other subjects), and I would agree its a strong school. I was actually going to recommend it, as well, but the OP seemed to want a CS program. I think there are several other state schools that have CS/CIS/MIS programs, too (MA, CT, etc.?)

</comment></comment><comment><USER3> I know University of Illinois at Springfield has an online CS program.

University of Illinois at Urbana-Champaign is a great school for CS with an impressive history of startup founders (Netscape, YouTube, Firefox, Oracle, Siebel, AMD, Lotus, etc.) The Urbana-Champaign CS program is usually ranked third in the country, after Stanford and MIT. If you did very well in your online classes with Springfield, you could probably continue on with the MS program in CS at Urbana-Champaign if you wanted to do so.

[Don't get me wrong, Springfield's CS program is the ugly third cousin of UIUC, but it is still much better than Kaplan and UPhoenix and the rest of those online busywork diploma mills. No offense to any Kaplan/UPhoenix alumni ;-) ]

<comment><USER2> If I were to do a Masters in CS online, I'd go with UIUC. The school has a great reputation, and I've seen a couple of their online lectures. They're pretty good.

</comment></comment><comment><USER4> Maybe try Kaplan University? I haven't done enough research to know what's good. Would be interested to hear what others say.</comment>


WORLD EXCLUSIVE – Meet this extinct cave lion, at least 10,000 years old - <AUTHOR> http://siberiantimes.com/science/others/news/n0464-meet-this-extinct-cave-lion-at-least-10000-years-old/ <comment><USER2> Put them in the cloning machine! quick!</comment>