How AI based programming could work - <AUTHOR> http://bjenik.com/AIBasedProgramming/ <comment><USER3> The keyword you want to search for is "program synthesis." It already exists, and no neural nets need apply (neural nets tend to be useful only if you can't get anything else to work). As a bonus, it's not probabilistic like AI techniques tend to be but exact, based on SMT solvers and verified proof correctness.

An example of work showcased at this year's PLDI that's capable of doing this sort of stuff:

Fast synthesis of fast collections ([https://homes.cs.washington.edu/~mernst/pubs/collection- synt...](https://homes.cs.washington.edu/~mernst/pubs/collection-synthesis- pldi2016-abstract.html)): specify a database-like data structure for a collection of objects and the list of queries performed on that data structure, and get out code that's as fast as hand-tuned data structures with fewer bugs.

Programmatic and Direct Manipulation, Together at Last ([http://dl.acm.org/citation.cfm?id=2908103&dl=ACM&coll=DL&CFI...](http://dl.acm.org/citation.cfm?id=2908103&dl=ACM&coll=DL&CFID=609587099&CFTOKEN=40441624)): Take an image generated by code (e.g., periodic stripes), and be able to manipulate that image by drag-and-drop, e.g., changing stripe size or period.

Stratified synthesis: automatically learning the x86-64 instruction set ([https://stefanheule.com/publications/pldi16-strata/](https://stefanheule.com/publications/pldi16-strata/)): 60% of the x86-64 instruction set can be formally specified starting from about 60 base or pseudo-instructions (basically, describing each instruction as an assembly program of simpler instructions).

<comment><USER4> Nice, thanks- particularly the x86-64 instruction set learning. I would kind of put that down as grammar induction rather than program synthesis though.

</comment></comment><comment><USER5> The author proposes a lot of vague ideas in this article (for example "I believe one of the biggest problems is the use of Error Propagation and Gradient Descent") without references or any solid proofs why they are necessary to solve the proposed program (Automate programming using ML?).

In fact there is already a lot of solid work just on this subject:

* Learning algorithms from examples [http://arxiv.org/abs/1511.07275](http://arxiv.org/abs/1511.07275) [https://arxiv.org/abs/1410.5401](https://arxiv.org/abs/1410.5401)

* Generating source code from natural language description [http://arxiv.org/abs/1510.07211](http://arxiv.org/abs/1510.07211)

* And, the most closest work to what author probably wants, a way to write a program in forth while leaving some functions as neural blackboxes to be learned from examples: [http://arxiv.org/abs/1605.06640](http://arxiv.org/abs/1605.06640)

* Also there is a whole research program by nothing less than Facebook AI Research that explicitly aims at creating a conversational AI agent that is able to translate user's natural language orders into programs (asking to the user additional questions if necessary): [http://arxiv.org/abs/1511.08130](http://arxiv.org/abs/1511.08130) (there is also a summary here [http://colinraffel.com/wiki/a_roadmap_towards_machine_intell...](http://colinraffel.com/wiki/a_roadmap_towards_machine_intelligence) )

And deepmind is also working on conversational agents: [https://youtu.be/vQXAsdMa_8A?t=1265](https://youtu.be/vQXAsdMa_8A?t=1265)

Given current success of such models, automating simple programming tasks maybe not as much research as engineering and scaling up problem.

There is a lot of exciting machine learning research out there nowadays. Almost all of this research is available for free from papers posted on arxiv. It is a really good idea to read more about state of the art before coming with new ideas.

<comment><AUTHOR> The forth black box paper seems to be quite close actually. The big difference is that I would like to go for higher level tasks. The low level variant - having code missing a few lines/functions and filling those is indeed quite well researched. More interesting would be the opposite: Having blocks of code (called components in my text) and letting the net find a good way to use them. Normally the way a programmer would build something like let's say the amazon website is sketching up a few ideas how it could look - cutting it into small parts and then writing (or reusing) the code for the small parts.

A lot of the "using AI for programming" papers (AI in this case being anything from nets to logic stuff) focus on building these small parts - I'm more interested in the levels above that. The "generating code from natural language/dialogs" also kind of misses my idea as it still assumes a "programmer" to tell it what to do (in the amazon example "display the products on a grid" or "make the buy button bigger"). The programmer would in this case either guess the right thing ("everybody has their products in a grid") or run something like A/B testing against some metric ("items sold" or "$ revenue") and then go back to the conversational programming tool and tell it "change the button". Why not skip the programmer and give the metric directly to the net? The thing I would like to get working is telling the net "here is a ton of different buttons, grids, lists and a lot of other UI stuff, and there are all our products - I want to maximize revenue - do whatever you like to get there".

Regarding the vague ideas: I believe (also totally unsubstantiated - <USER2> research in this area would be quite interesting) that writing down ideas first and then looking into them (either by reading other papers or doing own research) is far better than the other way round, because it has a higher probability of leading to something new, because you don't follow assumptions and errors others potentially made which could lead to a dead end. Of course there is a certain trade off, because if you try to reinvent everything you will not get to the point of something new.

<comment><USER6> > The thing I would like to get working is telling the net "here is a ton of > different buttons, grids, lists and a lot of other UI stuff, and there are > all our products - I want to maximize revenue - do whatever you like to get > there".

As you referenced in your footnote, this goal is a little like the goal of putting a man on the moon, if the year is 1900. One could the make the case that something resembling an AGI agent would be needed to design/manage a merchant website with any degree of introspection and customizability. Your machine would need to understand business objectives, UI patterns, aesthetics, etc before taking the helm, and these things take years to learn even for even humans. This is not to say that AGI isn't an admirable goal, but that it's an obvious one, just as I imagine reaching the moon was in the centuries leading up to 1969.

Scientific research is certainly a massively parallel effort, pushing the boundary of our knowledge in many different direction at once, but rest assured that there are many good men and women working in this specific direction.

(also know that I have a lot of respect for this kind of vision-oriented thinking, especially because it generally leaves the writer vulnerable to criticism like this)

<comment><USER5> IMHO talking about AGI here sounds like "all or nothing" type of thinking. Almost all problems can be formulated as [perhaps very hard] machine learning problems of 3 basic types [https://en.wikipedia.org/wiki/Machine_learning#Types_of_prob...](https://en.wikipedia.org/wiki/Machine_learning#Types_of_problems_and_tasks) .

Every ML problem has a lot of algorithms that can be applied to it to solve it. Previously unsolvable problem (e.g. learning playing atari game from pixels) can become solvable if a better ML algorithm is devised, more compute power is applied, or the problem is simplified (maybe with data augmentation or feature engineering, or constraining the domain).

I think the problem you are stating - finding the best configuration of website to extract more ad revenue - can be simplified until it is solvable by currently available algorithms and hardware. Big companies are already doing similar things - Google uses reinforcement learning to recommend new items on its services, Facebook is known to use machine learning to somehow make more profit from users.

Given expert knowledge of the problem and good algorithms, it can be solved in some form, that's my point here.

<comment><USER6> Sure. I think what the OP was playing around with was whether we could generalize from, as you said, "expert knowledge of the problem[s] and good algorithms" so that AI could replace components in the incumbent programming paradigms. Agreed, when the end problem is well-defined and you know how "do" machine learning, the world is your oyster.

</comment></comment></comment></comment></comment><comment><USER7> Interesting idea, but to be honest I think it will never take off in a large scale.

If you want to write a vague and generic piece of code that can figure out by itself what it is that its outputs ought to be with regards to its inputs, you are, with effect, creating artificial intelligence.

This, in turn, requires teaching.

What if suddenly you have new pages on your website? Your AI program thingy wouldn't be able to serve them until you taught it what these pages are and in what situations the end user might be interested in viewing them. Imagine having a 5 year old kid handling your shop's cashier. And now a new product arrived and you have to explain to him/her that there's this new product, what it's called, the price and which types of people are allowed to buy it (e.g., alcohol couldn't be sold to people younger than X years old). If you're really teaching your application with natural language, like you would with a five year old, then the effort it'd take to get that info into your system would defeat the purpose of actually using a computer to do it (computers are good at storing and looking up stuff in large data sets, better than humans for really large data sets).

This whole hype of machine learning is suitable for situations where you have large amounts of data and you want them crunched according to some basic pre- established and non-changing logic without relying on actual human labor. If the logic evolves, you'll always require humans to sit at the helm and steer the right and wrong.

My 2 cents.

<comment><USER5> 3 years ago many systems that exist today would be regarded as "scifi" or "maybe 10 years into the future". One of the most striking examples is Visual Question Answering with dynamic memory networks [1]. The model is given raw pixels and encoded question in natural language, it should output a natural language answer. See how it works on data it hasn't seen: [http://i.imgur.com/074G9pg.jpg](http://i.imgur.com/074G9pg.jpg)

Do not underestimate what good ML model can learn given enough data. And in case of online shopping there usually is more than enough data, and big companies like Amazon have been using ML (context bandits) for quite some time.

1\. [https://arxiv.org/abs/1603.01417](https://arxiv.org/abs/1603.01417)

<comment><USER8> Then would know that visual question answering performs quite poorly. It makes for a nice demo, but it's trivial/quick/easy to find entire areas of questions where the models completely. The questions have to be worded very carefully. The models are quite finnicky and dumb. For example, dynamic memory nets aren't the state of the art - the state of the art for these datasets doesn't use anything nearly as complicated as memory, etc.

<comment><USER8> *completely fail

</comment></comment></comment></comment><comment><USER9> Starts off with an interesting idea (programming is perfectly specified versus being underspecified but more efficient due to shared context) but then devolves significantly: neural networks are not the be all end all of smart computers.

Interesting part is that a smart computer could resolve ambiguities in a human description of program desired in a way similar to humans. Missing part to this idea is that unless it's perfect, it would need a way to explain choices and results and probably some dialog system to iteratively improve upon how it resolved ambiguities.

E.g, make me an app like Uber but for cats -> here is a version you can play with -> oh I don't really like the cat icon, can we change it -> sure, which of these would you like ; etc etc

Computer requires ever changing human context, and maybe could have individualized context. So it has to learn over time. The point is to maximize efficiency of getting things made: how little needs to be specified before computer gives you something you accept / how fast can you go from some vague idea in your head to working acceptable software.

You should at least be able to get as good as an arbitrarily large number of people who lived a very similar life to yours and were put in a time bubble where you could talk with them to have them write software for you, assuming they're organized very well and highly motivated and great programmers and all that.

</comment><comment><USER10> Suppose you have an AI that generated some code for you, but it doesn't do exactly what you want. Now try to debug it...

 _what if programming wouldn 't involve defining exact steps, but instead just roughly defining what we have and what we want and maybe giving a few hints, and having the computer generally do the right thing - wouldn't that be awesome?_

I experience enough frustration with things like debugging generated code, ostensibly "smart" devices which seem to "have a mind of their own" (maybe that's the point, but it's not doing what I want), and getting Google's search engine to find exactly what I want with its pseudo-AI machine-learning algorithms doing completely inexplicable things with my queries, that I think "generally do the right thing" is not a good idea. Edge cases matter a lot.

<comment><USER11> Don't we already have a similar situation today with the compiler and application stacks? I'm not writing my business logic in assembler -- I'm writing it in Java, maybe pulling in some third party libraries, using Spring, and then running on the JVM. All kinds of opportunities for things not to work as I expect and then I have to figure out why.

<comment><USER10> The difference is that, as the article points out, traditional programming languages are far more 'exact' \- large systems can become difficult to debug, but that largely arises from the complexity of layered abstractions, whose behaviour is still exact. AI-based systems not only add the complexity of abstraction, but also with their inexactness.

</comment></comment></comment><comment><USER6> Why do we need to jump to ML-based programming again? I'm confident that as we build simpler interfaces and workflows for replacing the most modular components in our programs with AI, we'll begin to see which components are the next lowest-hanging fruit and what concrete ML problems need to be solved to model them.

We imagine a future where AI becomes a dominant paradigm for "writing" software -- I think that will be the case, but not in the way everyone suspects. I think 80% of the new _value_ of software in the future will be derived from AI components, but that 80% of the production _costs_ will still go into the structural glue code that supports the value-powerhouse models. Thus, most of the software _written_ in the future will look similar to most of the code written today.

I also suspect that as the complexity of AI models increases, the structural code required to support these models will keep pace in complexity. For this reason, I see a future where the unit cost of high-quality software does not see any big drop, but where the value of this software continues to increase exponentially. A corollary to this is that valuable software will be no easier to program in the future than it is today.

</comment><comment><USER12> >what if programming wouldn't involve defining exact steps, but instead just roughly defining what we have and what we want and maybe giving a few hints, and having the computer generally do the right thing - wouldn't that be awesome?

So, Prolog?

<comment><USER13> Why Prolog? I have never noticed that Prolog was any better than other computer languages at reading one's mind!

<comment><USER3> Prolog, or at least logic programming languages, were thought to be the wave of the future of programming in the 80s. They, of course, turned out to be a massive bust.

<comment><USER14> You are factually correct

But, a key problem was the runtime (in)efficiency of the prolog implementation engine. Maybe today with x1M more powerful computers it is worth trying again ?

Neural networks were abandoned in the 80s and made a massive comeback with a. more compute power b. convolutional networks

In fact, maybe a ML-optimized VM will make higher-level languages useful again ;)

<comment><USER15> No, the problem was not that Prolog was too slow. The problem was that it was too stupid.

Prolog's strict left-to-right, depth-first search strategy allowed the implementations to be, in fact, quite fast. But that same strategy also kept it from being more than a small step toward true declarative programming, because Prolog programmers have to understand the order in which subgoals are tried. For example, consider a goal that can be satisfied by either of two clauses, which we'll call A and B, and where every problem instance can be solved by exactly one of these; however, clause A always completes (either succeeding or failing) in constant time, but clause B, if invoked on an instance that would cause it to fail, goes into infinite recursion (an easy thing to do by accident in Prolog). It's imperative (ha!) for the Prolog programmer to make sure that clause A is tried before B.

This kind of thing comes up all the time in Prolog programming. On the one hand, you have to be aware of the order of operations so you don't cause infinite recursions (or, short of that, cause your program to take exponential time); on the other, Prolog programmers frequently exploit the left-to-right, depth-first strategy by using the operator known as the "cut". The cut is a non-logical operator in the sense that its semantics can be expressed only by reference to the Prolog search order.

Programs written in a true declarative language might superficially look a lot like Prolog programs, but the implementation would need to be much smarter -- doing things like figuring out the correct order of operations on its own. (I think machine learning might actually turn out to help with this.)

Anyway the problem with your suggestion that we just need to throw more hardware at Prolog should be evident by this point. It doesn't matter how fast your machine is if your algorithm is exponential in the typical case (never mind if it contains an infinite recursion!).

<comment><USER4> >> The problem was that it was too stupid.

It's ... a programming language? It's Turing complete. Nobody said it's intelligent.

>> It's imperative (ha!) for the Prolog programmer to make sure that clause A is tried before B.

That is one of those cases where Prolog takes the pragmatic approach to allow efficient computation rather than sticking to "pure" semantics of the kind that tends to make a big mess of things just to keep things "clean" (like, oh, I don't know... monads?).

Btw, I've written reams and reams of Prolog in the last five or six years. The fact that your code has two readings, declarative and imperative is only a problem if you allow your mind to remain stuck in some purist definition of declarative programming that looks beautiful but doesn't really work.

If you accept that we live in an imperfect world, have to contend with primitive computers and limited resources of all kind, then Prolog is fine and miles and miles ahead of anything else in terms of declarative semantics. Even lisps have magickal and mysterious stuff like eval etc.

In actual Prolog programming practice the imperative reading means you can actually debug your code and follow it around as it falls over your own bugs. A purely declarative program would also be purely undebugable.

The dual semantics is only a problem if you don't understand the language. And in what language is that not what you'd expect?

>> Prolog programmers frequently exploit the left-to-right, depth-first strategy by using the operator known as the "cut".

No, let's say things the way they really are. The cut is there to allow a branch of the depth-first tree to be, well, cut. Correct, its semantics are purely imperative. Its real use though is to stop unnecessary searching and backtracking and therefore make your program more efficient.

It's not there to "exploit" anything. The fact that it can be exploited is troublesome, but so is all sorts of stuff in programming, like buffer overruns or sql injection. It sucks, but ... imperfect world, scarce resources etc.

>> your algorithm is exponential in the typical case

What? Why does your algorithm _have_ to be exponential if it's in Prolog? What the hell are you on about?

<comment><USER15> I guess my use of the term "stupid" made my post sound more pejorative than I meant it to be. I have enjoyed writing Prolog programs on occasion. Some of my best friends are Prolog programmers!

But I was trying to explain why Prolog is not the declarative language that we all hope for (well, a lot of us do, anyway) and that it initially appeared, to some, to be. And I think the answer to that is exactly what I said. That doesn't mean it's not a useful tool!

> [The cut is] not there to "exploit" anything. The fact that it can be > exploited is troublesome, but so is all sorts of stuff in programming, like > buffer overruns or sql injection.

Whoa! "Exploit" is a general term; it doesn't just refer to security vulnerabilities. Dictionary.com offers this definition for the verb: "to utilize, especially for profit; turn to practical account: _to exploit a business opportunity_ ". (The definition I would offer is "to take advantage of", which _can_ mean to make use of a vulnerability, but doesn't have to: you can take advantage of a convenient feature of a program.)

So when I say people "exploit" the search strategy by using the cut, I mean only that they gain benefit from it; if the search strategy were not so well- defined, the cut would be unusable.

> Why does your algorithm _have_ to be exponential if it's in Prolog? What the > hell are you on about?

If you try to write a significant Prolog program _without understanding the search strategy_ , as if it really were a declarative language, your program will wind up being exponential or worse. Merely throwing hardware at this problem won't fix it. That's all I'm saying. I agree I didn't say it well the first time.

<comment><USER4> >> Some of my best friends are Prolog programmers!

:P

>> Whoa! "Exploit" is a general term; it doesn't just refer to security vulnerabilities.

Of course. I didn't mean it in that sense. Buffer overruns can be exploited for non-malicious purposes also. Basically, any quirk of any language or architecture, or really any system, can be exploited for whatever purpose. Let us pause for a second and reflect on The Story of Mel [1] as handed down to us by our forefathers and mothers of old.

So what I'm saying is that the cut is there to stop unnecessary backtracking and not to change the behaviour of your program, but of course there's nothing stopping some poor fool from using it in the latter manner, as indeed I've done too many times in the past myself, being the particularly foolish fool that I am. Prolog programmers even have a term for the two types of cut: "green" and "red", respectively. Any Prolog tutorial or bit of documentation will tell you that the cut is to be used sparingly and only to stop unnecessary backtracking, not to make your program change behaviour. The good ones go to some lengths to give you examples of what happens if you don't stick to the advice. If you screw up after that you have nobody to blame but your inexperience, and that gets better with time.

So the cut is dangerous, but that's all it is.

I learned to program with C# oddly, at the University of Hull in the UK. There, our programming 101 tutor explained why C#, or, hell, Java- and not C or C++. His point was that those other languages are more powerful but because of their power they give you the tools to cut yourself to pieces. He used a metaphor involving a chainsaw, that I don't remember very well (that was back in 2005, 11 years now). But basically his point was that a chainsaw is powerful but you can really hurt yourself with it if you don't know how to use it, so you don't want to start learning ... er, forestry? with one.

Well, think of Prolog as a particularly dangerous language. I will admit this: Prolog is not your friend. It doesn't even try to make things easy for you. It's not an "easy language to pick up and start hacking in immediately". It takes a long time to learn it well and it keeps surprising you in very nasty ways for a very long time.

But- once you've learned it pays back in spades and you can do stuff in it that you can really not do in any other language, like declare grammars and then execute them, and use them to parse strings and generate strings. Or run your code backwards. Or do list appends in single-steps and so on.

Well. Apologies, that got a bit out of hand.

[1] [http://www.catb.org/jargon/html/story-of- mel.html](http://www.catb.org/jargon/html/story-of-mel.html)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> The whole point of programming is to get exact results by solving all edge cases. Machine learning/Neural nets are only good at guessing results, and cannot solve all edge cases without specific direction.

<comment><USER17> Sure,

A program that looks at a pattern, emulates it and then enumerates the various edge-cases, looking for further patterns from the programmer's answer.

It would still require effort but it could be a lot easier than present approaches and it might even find edge-cases a human would miss.

<comment><USER18>
        > A program that looks at a pattern [...]

This is what programming already is, the "pattern" being code. A compiler is a program that looks at a code pattern and, if it's a good compiler, it can tell you if you've missed edge-cases through compile time errors.

</comment></comment></comment><comment><USER19> Since the c language is already a human readable abstraction away from the actual hardware instructions, which then again are abstractions on what actually happens on the chip with the transistors and electrons, you could argue that programming in c is already pretty much 'talking to the computer human-style'.

As others said the use of frameworks and even higher level scripting languages with an ide is already a dumb-ai kind of human-friendly conversation with the machine.

A problem with driving this further down the road like the article suggests could be, that if i wanted to talk to the machine like i talk with other persons, the natural language used in this case migh not be very well suited to express what i actually want. I would need special definitions and terminology, and in some cases a general description would not suffice, so the need for precision in expression might stay.

The actual dialogue with the machine then might last as along as a programmer would have needed to program it. I could see how this might work for very simple programs (like for some uber-app which is not much more than a wrapper for a telephone call to the taxi central), but inherent complexity that other programs need cannot be simplified away by switching the language to a conversational chit chat level.

</comment><comment><USER20> In a sense we already do this. For example, every time you create a website in HTML/CSS and javascript, you use high level instructions and a lot of declarative stuff. It is already very far away from the actual hardware. If you use some framework with builtin templates, all you need is the actual content and some plumbing. Everything else is handled by the lower layers and it is much more declarative than you realize. It also means that you do not specify thousands of things/little details and you trust the lower layers to do the right thing. It is already happening and it will only get better.

People freak out every time when this idea appears and the recurring argument is that "the AI will not do the right thing, it is too stupid". They forget that our frameworks/libraries and complicated software stacks already work as dumb AIs. They follow hardcoded rules and try to please us and most of the time it actually works otherwise we would not use libraries. Using a neural network may not be the right choice for this problem but the general idea is correct. A good library should hide the "how" as much as it can and only require the user to specify the "end goal".

</comment><comment><USER21> I suspect we'll see supervised seq2seq generated code first.

Like:

\---

Programmer inputs on left:

 _compute std dev of x please_

AI on right proposes edit to code:

 _\+ import numpy as np

...

\+ stddev_x = np.std(x)_

\---

Not super complicated to start with, but you can see where it will go from there.

<comment><USER22> How in the world do you train that? Where's the corpus of english <-> code mappings come from?

<comment><USER5> The corpus can be acquired from companies that host coding competitions. In this paper [http://arxiv.org/pdf/1510.07211v1.pdf](http://arxiv.org/pdf/1510.07211v1.pdf) (I already mentioned it many times, but it is very relevant) researchers took the data from a similar source

>To accomplish this goal, we leverage a dataset from a pedagogical programming online judge (OJ) system,2 intended for the undergraduate course, Introduction to Computing. The OJ system comprises different programming problems. Students submit their source code to a specific problem, and the OJ system judges its validity automatically (via running).

And trained seq2seq model on it _on character level_ and it almost works, barring a few typos. IMHO this is an underappreciated breakthrough. With more data and a better model generating competition-grade programs seems possible.

</comment></comment></comment><comment><USER23> My project, improve.ai, is a first concrete step forward in this direction.

We start by replacing if/then statements with a decide() function and some goal events.

I've used this approach in my app, 7 Second Meditation, to achieve a solid 5 star rating across 248 reviews and 40% first month retention.

[https://itunes.apple.com/us/app/7-second-meditation- daily/id...](https://itunes.apple.com/us/app/7-second-meditation- daily/id667197203?mt=8)

I'll be writing some articles deep diving into 7 Second Meditation and breaking down how I'm achieving this results. For now, here is a taste:

[https://blog.improve.ai/hi-world-how-to-write-code-that- lear...](https://blog.improve.ai/hi-world-how-to-write-code-that-learns- efdb8b5af940#.1upmk4vxo)

</comment><comment><USER24> Very intersting ideas! I also think that in the future we will see a lot more declarative programming languages that model high-level concepts of a given program, while low-level "plumbing" code will be generated automatically. I'm not yet sure about the role that AI will play in this process though, and I think there are many things that we have to solve before we'll see something that can write generic programs.

Program synthesis is a very active field of research and many AI-based methods have been proposed in the last decades, IMHO what most systems lack is the applicability to real-world programming languages and use cases though.

Having worked on static program analysis, I know that even our current ability to understand and reason about existing programs is still very limited. A main reason for this is that most real-world systems are composed of many parts that are not easily specifiable under a single paradigm (e.g. templates, database code, configuration files).

To build a usable AI-based programming system, we will need:

* A description languge that is able to model ALL aspects of a given real-world system under a single paradigm

* A system to analyze and understand the artefacts produced by the above system

* A way to generate real-world code from the specification above, including a way to "fill in the blanks" that the user did not specify (as leaving out the details the whole point of such a system)

* A way to test the generated code against the specifications provided by the user and further "reasonable" assumptions, which will be needed as the specifications by the user will not be complete, see above

* A way to guide this process towards a reasonable program through user feedback within a reasonably small number of steps

While none of these things are impossible, implementing them is a significant challenge with a lot of unknowns for which we don't have good solutions yet.

I therefore think the first AI-based systems which we'll see in the coming years will be limited to specific problem domains (e.g. data analysis, logic programming) for which we can more easily build a system as the above.

</comment><comment><USER25> I feel dumber after reading this article. So much, that my own human net of neurons can't figure out or explain why.

A partial explanation is that I dont like the assumption that once work is being performed at higher and higher abstracted layers, that machine hardware, OS kernels, compilers and linkers, package and dependency managers, and all other systems software supporting high level programming paradigms (including AI based methods) are going to fall in line at the application layer.

<comment><USER18> I think the quality on Hacker News would benefit from more people being able to downvote. At least take away people's right to upvote if they have no right to downvote. It seems to me there's missing a balance if we can't downvote a story that turns out to be lower quality than what it appeared to be.

</comment></comment><comment><USER4> >> I believe a lot of research today is limited by first looking at, and becoming an expert in, the status quo and then building small iterative improvements. It would be better to first find a goal and then looking for a way of getting there - at least that's the way we got to the moon.

Nope.

</comment><comment><USER25> #3 on HN for the moment is very relevant to some of the discussion in this thread pertaining to websites.

[https://news.ycombinator.com/item?id=12198572](https://news.ycombinator.com/item?id=12198572)

</comment><comment><USER26> I've been toying around with the idea of making user agents that simulate the functions a user must be able to accomplish through a software and using that as a cost function for some evolutionary algorithm.

</comment><comment><USER27> Interesting, how AI based project management could work? It is much simpler to implement and could really save lots of money for organizations, imo

</comment><comment><USER28> It's kind of vague. It would be better if he used a concrete example to illustrate how AI help programming.

<comment><AUTHOR> Actually the examples in the text are quite concrete - the few lines would be everything you'd have to write to get such a site working (modulo a bit of http plumbing). Obviously we are nowhere near such a thing. The rest of the text acts as a bit of a pointer what could help to get there.

From my other comment (in this case the example was an amazon like shopping site):

> The thing I would like to get working is telling the net "here is a ton of > different buttons, grids, lists and a lot of other UI stuff, and there are > all our products - I want to maximize revenue - do whatever you like to get > there".

The way of telling a neural network these things would be these few lines of code which would hook up different parts to get it working.

<comment><USER25> You're gonna have to make a clear distinction between web dev project configuration, and AI for making good choices that optimize meeting sales and marketing goals.

How is your 'project codebase markup' any different from filling in some radio buttons on a template generator or a CMS?

</comment></comment></comment><comment><USER29> neural networks != AI

<comment><USER14> "How ML based programming will allow us to program using a higher-abstraction programming language"

Better ?!

There is also the famous quote about how any working (and understood) AI is no longer considered AI...

<comment><USER29> That quote will apply up until we encounter real AI.</comment></comment></comment>


How not to check the validity of an email address - <AUTHOR> http://www.dellsystem.me/posts/dont-do-drugs-kids/ <comment><USER3> In college I was hired to build an auction site. I was billing my client $20 / hour and subcontracting out the work to some of my fellow classmates at $10 / hour. I was swamped with other work and didn't have much time to review the code. I just made sure it satisfied the specifications and shipped it. We launched the site and did a few hundred thousands dollars worth of transactions in the first 24 hours. Then something strange happened... all of the bids mysteriously disappeared from our admin panel and users started emailing in asking why their bids weren't showing up anymore. I got a panicked call asking what had happened. I had no clue, but promised to look into it. I started digging through the server logs and noticed that all the bids had been deleted around the time that Google had discovered and crawled the site. Sure enough, my friend had added links to delete bids via the admin panel that were executed via GET requests. It wouldn't have been that big of a deal except the poor guy had used JavaScript for authentication! Google's crawlers had carefully hit every single Delete link and wiped out the site. I fixed the authentication system, refunded everyone's credit cards and relaunched the site with a huge apology for the issues. Needless to say, from that day on I became far more diligent about doing code audits.

<comment><USER4> This story almost had me in tears (a mix of schadenfreude and shame for my profession). I hope they learned something _not_ to give business critical work to college students. Makes me think that IT Risk management should be right at the top of what MBAs have to learn.

<comment><USER5> Wow. Just because someone is a college student doesn't mean they are incompetent! Plenty of people do business critical work as college students, haven't you ever heard of co-op before? A degree doesn't make you competent either, I've worked with enough people who have degrees who are completely incompetent. College students might need some extra supervision to make sure they are doing the right thing, but so do jr engineers.

Anyways, those are the things that a code review would catch.

<comment><USER4> I think you got me wrong, sorry for not having myself made clearer. I worked through college as an IT consultant as well, however as you noted _under supervision_ of a consulting company with seniors. Hiring a college student directly, without a company attached that can be made liable, is just a bad idea, both for the customer and the student. Just imagine the customer had sued parent. I wasn't talking about technical competence - it's all about liability as well as having proper processes for design, implementation, review, testing and rollout in place - a thing that can easily he seen even before signing a contract.

</comment></comment></comment></comment><comment><USER6> Every single legacy application I've ever worked on has had analogous code buried in it somewhere.

An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a web page. The page takes around 20 seconds to load. Switching it to use a single properly formatted SQL reduced load times to under a second.

Another legacy app I'm employed to "repair" has one single 'template' for every page on the whole site. Its first ~500 lines conveniently consist of a giant and highly nested if/else clause to set the page variables and inline javascript.

Such things are the result of "IT experts," "Software Managers," and "Product Administrators" who've never done real software/web development in their lives hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP.

It only gets lovelier when eventually somebody realizes it's a huge security risk and hires an outside development firm to "secure" it. (Giant eye roll. If they couldn't vet a programmer, you can bet they're great at vetting security consultants and contract developer shops.) Did you know that randomly moving code into folders named "private" and "public" for a few thousand dollars can solve giant architectural and security issues like ridiculously easy XSS and SQL injection?

I don't know what the deal is, but a huge proportion of people writing code are plain incompetent.

At my last company we fired someone who created huge amounts of work for everyone (he thought he could secure page content and alert messages by using base 64 encoding as a stand in for hashing and encryption, for example) and a few months later he was hired as lead developer by a pretty reputable educational business.

... sigh

<comment><USER7> > hiring random "programmers" who have history or psychology degrees and think > they can program because they made a form in PHP.

That's pretty unfair to people coming from history or psychology who actually _can_ write good code. Just because you don't have a degree in CS doesn't mean your code is shit. This is purely anecdotal, but my predecessor at my current job was a CS graduate and wrote code like in the OP.

<comment><USER8> As a history major, I would agree with you.

One of the real issues has to do with the mentality of coding. There are people regardless of background who approach coding as a job, and those who approach it as a craft. You want the latter, not the former.

Here's my rule:

If you don't look back at code you wrote a decade ago with some degree of horror, you are either an extraordinarily good coder, or you aren't a good coder at all.

<comment><USER9> A decade is a long time at a single job... Try six months for a good start :)

<comment><USER10> Six months? I come in after the weekend and constantly want to rewrite the whole goddamn thing.

<comment><USER11> This^ and I'm only a student; I'll write a program in the evening and by the following morning I'm all, no, no, no!

<comment><USER8> I tend to spend a lot of time planning (almost as much as coding). I do tend to notice big changes over a period of 2-3 years but areas where I can notice improvements in say six months.

<comment><USER10> I think I spend too much time planning and not enough time just getting shit done. It's one of the things that I feel like I have to work on this year.

<comment><USER8> I don't think it is necessarily a bad thing. I spend a lot of time planning because I find my coding productivity is higher. Often it's better to let problems sit for a bit than to code then first, or if one does a mock-up it is an exploration that is part of the planning, to be discarded and done right a second time.

But what this means is I rarely come in the next week and wonder what I was thinking (it does happen, but rarely). More often I look at things, over a few months figure out better solutions to coding problems and my style changes accordingly.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Gradebusters / Making the Grade, or something with names like that, used to use a Java applet to "secure" the web site with student grades. You could just download the applet and decompile it to figure out their trivial encoding of the IDs and PINs (which were just params in the HTML).

Or you could figure out just an ID (typically a student ID number, although more than a few were social security numbers, apparently), and use "1066" since they had a backdoor PIN in quite a few releases. Battle of Hastings, eh?

Want to know how users did web security instead of asking their admins for a proper .htaccess/server-level config setup? That's how.

<comment><USER13> Education software is literally the worst.

Moodle was pretty ick to begin with, but you should've seen the state of one install I had to work on by the time I got to it.

I still have nightmares.

<comment><USER14> Needs disrupting

<comment><USER10> It's extremely hard to break into because like healthcare these gigantic institutions where nobody can get fired made choices ten to twenty years ago that have now become "the way it's done" and they won't accept a better solution.

<comment><USER14> I know. I am at one of those institutions. We practically have a social sciences lab for the Dunning-Kruger effect in place of IT decision makers.

</comment></comment></comment></comment></comment><comment><USER15> Clearly they should have optimized this by stripping the @mail.mcgill.ca on the server side before serving the list.

<comment><USER16> Clearly you must be joking. They should've kept the emails on the server-side the entire time. Then would be a matter of validating the request by searching the email in let's say SQLite. Would it be done? Probably not. But at least it'd be a lot stronger than sending sensitive data to clients every damn request.

<comment><USER17> You're missing the sarcasm :P

<comment><USER16> Unless it's clearly stated sarcasm gets garbled over the wire. So in the hope of helping those who don't get it I decided to do the right thing just to be on the safe side. ;)

<comment><USER18> From now on, when you see a post taking the form "Clearly [obviously bad idea]", please read it out loud in The Simpson's Comic Book Guy voice and place extra emphasis on the irony. This ensures you will get the correct intent 99% of the time.

<comment><USER16> Clearly, acting like a dumbfuck in order to become enlightened is obviously the right thing to do.

<comment><USER19> 'eh; keep trying, you'll catch on someday.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> I've had something similar delivered to me on a project I hired out. The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky.

Worse yet, was an initial claim that it was more efficient to do it that way. That was followed up with a claim that doing it differently wasn't possible.

Needless to say, I stopped working with that team of "developers".

<comment><USER21> >The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky.

This is always the worst. I've had experiences like that on many an occasion, where the person is simply like "huh? what's wrong?"

You can't really fix that level of sheer incompetence, ignorance, and arrogance all wrapped into one.

<comment><USER22> > You can't really fix that level of sheer incompetence, ignorance, and > arrogance all wrapped into one.

Sure you can. You can tell them why it's wrong and point them at reading material to fix it. Fixes incompetence and ignorance, and if you're lucky, arrogance. All wrapped into one.

Everyone had to start somewhere.

<comment><USER21> True, but it depends how arrogant and stubborn they are. If they're just simply arrogant and don't understand, you can do something, but in many cases they'll insist "this is fine. what's your problem?"

</comment></comment></comment></comment><comment><USER23> Man. Reading posts like these has several effects on me. One is utter shock that anyone could be so stupid. Another is to remind me of how little I know (because I'm sure in the eyes of someone who actually knows anything about security, I'd probably provoke the same reaction). I'm also amazed that some of the people responsible for these things can still find work.

Here's my own personal story. The other day, I had a brain fart regarding my password for my online banking account. So, I got lazy and just clicked the "forgot password" link, answered the security questions, and within seconds, I got an email. It had my old password in it. Yes, my bank stores passwords in clear text. _sigh_.

BTW, I'm also looking for a new job right now, so if you're after someone with 2 brain cells to rub together who also happens to be a decent Python programmer, shoot me an email. (It's in my profile.)

<comment><USER24> Not necessarily. They may be using a reversible hash. Not much more secure, but it beats plaintext.

<comment><USER25> Yeah, maybe they just look up the MD5 hash on [http://md5.gromweb.com/](http://md5.gromweb.com/) and sent him the result.

I used that site to show my boss his plaintext password to explain why MD5 alone is barely more than security though obscurity when trying to convince him that we needed to salt them as well - he agreed with me on the spot.

<comment><USER26> I actually did that for a system. I had grown a major case of the ass about my job. I hated working there and I hated spending effort on the work they made me do. They hired me to fix the legacy systems the previous .NET developer had made (and they were all OS X people who didn't have the courage to even look at a Windows machine), but every time something went wrong, they wouldn't let me fix the issue, they would only approve me time to fiddle the data in the database. "Just brute force it" was some kind of mantra from our CEO. Somewhere in the last 5 years, it seems non-technical people overheard the "brute force" meme and display the notion that they believe it's the always- practical, never-difficult solution to a problem when the programmer would prefer an overly engineered solution of negligible or negative gain.

So I had gotten tired of people forgetting their single-english-word passwords and making me overwrite their MD5 hashed password to a known-value that mapped to something like "password123" (yes, no salting for the hashes). So instead of manually resetting the password in the database all the time, I banged out a small web app that ran on my machine for printing every user and reversing all of their MD5 hash'd passwords. It didn't work for the ones who had chosen actual, random strings for their passwords, but that was maybe 1% of cases.

And then I shared the IP address to my machine as a link for every other engineer in the company (all 3 of them). One of the other engineers freaked out that I had "exposed" the passwords, but as far as I was concerned, the passwords were already exposed. He shut up when I pointed out that the work was done and that I had other things to do, things that were his responsibility but he couldn't do because he had a habit of taking on too much work.

From that point on, any time I had more than 2 repetitions to do something, I'd write the most basic of web app to do it, and I'd shove it onto that little server on my machine. The future repetitions would invariably come in and I'd save tons of time not doing it the manual way.

Seriously, this was easy stuff. Don't take this to mean I'm bragging about it. I'm mentioning it because it _is_ so simple and so obvious of work to do in these cases, and it eventually got me fired. I made the mistake of trying to get credit for the work I did, for saving the company time, freeing myself up to do other work, and all the CEO could see was that I was no longer able to charge 3 hours to create new accounts in the system now that it took less than a minute through my admin app. "Wasn't bringing enough value to the company." One of my reports found a quarter million dollars in lost licensing revenue. Wasn't bringing enough value to the company.

So it's not just programmers who can be grossly incompetent. Oh, they certainly can be, I've had to clean up my fair share of systems. But I've found far more often that systems are bad because the programmer's manager was an asshole idiot who made unreasonable demands and forced the programmer to make compromises. Maybe that programmer wasn't the best programmer, but nobody can do as good of work as they are capable in that situation.

</comment></comment></comment></comment><comment><USER27> Gosh. For some reason, the "right answer" I expected to see was "do not try to validate the address; just send the e-mail and handle the bounce if it fails".

There is a whole other layer which is very good at handling incorrect or undeliverable addresses.

<comment><USER28> Not sure you read the article - there is an additional constraint in that only email addresses pertaining to the institution in question are allowed.

<comment><USER27> Yes, I decided to ignore that constraint because it doesn't make sense :).

The article suggests performing "server-side membership testing, which is O(1)", but I think this is a bit too much — you can do even easier server-side validation without the list of all valid e-mail addresses, just the information that "@[anything but these two domains] is not an OK target".

<comment><USER29> > Yes, I decided to ignore that constraint because it doesn't make sense :).

Then the customer won't pay you because you ignored their requirements. They might even sue you because you breached contract.

If the customer asks you for a mound of poo you write them a mountain of poo; you try your damned hardest to make sure that the room smells like poo when they are using the app. If they go home and tell their wife and kids about the giant mound of steaming poo they have been using all day then you have succeeded because they will go back to the one developer who knows how to stick to their senseless requirements.

At the end of the day all the other developers are giving them apps built on principles that only make sense to developers - principles that only really make sense for millions of users and not the few thousand that they have. Principles don't put a house over your head and food on the table - <USER2> does.

<comment><USER27> Heh, yes, the smiley face there encodes something like of ", although of course I know that in the 'real world' people can't just ignore product requirements that don't make sense, and hopefully people will challenge at the design phase insane requirements like 'client-side validation of all possible e-mail addresses' rather than implementing them."

<comment><USER30> As I understand it, it wasn't the customer who requested client-side email validation; the customer just requested validation against a list of known good addresses (instead of just against a list of known good domains), which is a perfectly reasonable requirement (for reasons given in other posts in this thread). It was the programmer who (insanely) decided to do the email validation client side instead of server side.

</comment></comment></comment></comment></comment></comment><comment><USER31> A timely reminder to everyone:

[http://thedailywtf.com/](http://thedailywtf.com/) is still going strong! Be there or be ... competent?

<comment><USER32> I quit them when Alex tried to takeover Programming Praxis by force when negotiations didn't seem to be moving fast enough for him.

<comment><USER33> This was news to me.

[http://programmingpraxis.com/2009/08/13/the-daily-wtf- malici...](http://programmingpraxis.com/2009/08/13/the-daily-wtf-maliciously- infringes-programming-praxis-trademark/)

</comment></comment></comment><comment><USER34> Am I the only one who thinks that the repeated attacks on drugs and drug usage are really unnecessary (and not well informed on the topic)?

<comment><USER35> Nope, blog post was loaded with snark - her attitude offended me more than the poor code D:

<comment><USER36> Glad to hear that I wasn't the only one.

</comment></comment></comment><comment><USER37> You know what would be awesome?! If the developer in question happens to frequent HN and responds to this thread, eh?

<comment><USER38> Developers like these don't even know HN exists.

</comment></comment><comment><USER39> One coder used framework he didn't completely understand. Originally there wasn't password requirement for users. But when site got more confidential data password feature had to be added. Well how it was done? When user gave login and clicked ok, came page asking for password. But if you changed url at this point, everything worked. When I checked the actual code, the user form logged user in and password form logged user out if password was incorrect. Oh boy, I did praise that guy. Same guy used base64 encryption, so urls would be unguessable. Guess if there's real authentication at all if you modify the url content correctly. - Well, of course there isn't. Btw. Why there aren't negative recommendations at linkedin?

</comment><comment><USER40> It's good to be reminded how many employed programmers don't actually know how to program.

Actually, I'm not quite sure why or whether it's good to be reminded of this. Maybe it's better to try and forget it.

</comment><comment><USER41> I love how she gives away the name of the actual software (desire2learn) in the tag. :-)

<comment><AUTHOR> she

</comment></comment><comment><USER42> McGill seems to use a LMS branded as "myCourses", apparently the newest label Blackboard is using for it's "Learn" line.

<comment><USER43> McGill switched to 'Desire2Learn' last summer as Blackboard no longer supports 'webCT', I think (access to old courses hosted on webCT is now very limited). 'myCourses' was the branding chosen by McGill... I think now they just call it 'myCourses2', after the switch.

<comment><USER44> Hm... how come Desire2Learn hasn't been sued by Blackboard yet? Usually, as soon as a uni stops switches away to use a competing course management software, the competitor get sued based on the LMS patent: [http://patft.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sect2=H...](http://patft.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=6988138.PN.&OS=PN/6988138&RS=PN/6988138)

UPDATE: they //did// get sued, but won, and the above patent is invalid now. Way to go! [http://en.wikipedia.org/wiki/Blackboard_Inc.#Legal_matters](http://en.wikipedia.org/wiki/Blackboard_Inc.#Legal_matters)

</comment></comment></comment><comment><USER45> I've once come across:

       if (!Boolean.FALSE.equals(aBoolean)) {
          // ...
       }

I was pretty baffled.

<comment><USER46> I've seen a surprising amount of code that does:

        if (aBoolean == true) {
           ....
        }

<comment><USER47> Typically that isn't done from ignorance, just some (imho misguided) idea about readability.

<comment><USER46> Probably the same kind of place that bans use of the ternary conditional operator because it's "too complicated" <sigh>

<comment><USER47> Eh, I can't say that I have any love for the ternary if operator. It is an ugly construct made necessary by the other flow control constructs being statements. Scala lets you just use if/else like that, the result is much clearer at the cost of 4 or so characters.

</comment></comment></comment></comment></comment><comment><USER48> Somewhat unrelated, but out of curiosity, does anyone know of a site that lists — for all popular languages — various libraries/code snippets/routines which one can use to correctly (according to the RFCs) check the validity of e-mail addresses?

If not I may be compelled to create one.

<comment><USER25> @"^[^@]{1,}[@]{1}[^@]{1,}\\.{1}[^@]{1,}$"

I check it with this RegEx to make sure it's in the right format of [string]@[string].[string] to make sure that user at least tries to enter an email address, but beyond that sending and email and getting a response is the only way.

<comment><USER49> > @"^[^@]{1,}[@]{1}[^@]{1,}\\.{1}[^@]{1,}$"

Is not

> [string]@[string].[string]

It's mere ^.+@.+\\..+ (in both POSIX extended and PCRE dialects) that properly represents the latter.

And even such regexp filters out many technically-valid but obscure cases of RFC-compliant email addresses (for example ai, io, kh and ws TLDs have MX records, and supposedly hostmaster@io should be a valid email address).

</comment></comment></comment><comment><USER50> People who write similar code are what I like to call _low-hanging fruit factories_. I'm counting on them to make things as rubbish as possible, as long as they're not involved in any service I use, so anyone tempted to find vulnerabilities will go there first.

</comment><comment><USER51> I'm sad to see so many smart people wasting their time discussing what some stupid person did. :(

I'm also disappointed I lost a couple of minutes of my life reading about this stupidity as well... just because it got 233 points.

So, I'm looking at YOU 233 who upvoted this. WHY DID YOU DO IT?

<comment><USER51> As expected. :)

Just click the downvote button on my comment. Don't bother to explain anything.

Oh, I know, you disapprove I called you smart. Sorry about that.

<comment><USER52> I've been on HN for a while (lurking), never seen a downvote button but here people referencing them on occasion. Why do I not see downvote buttons? Or is this some inside joke?

<comment><USER53> You need 500 karma to get a downvote button.

"Why don't I see down arrows?"

[http://ycombinator.com/newsfaq.html](http://ycombinator.com/newsfaq.html)

</comment></comment></comment></comment><comment><USER54> Hate to burst people's bubble here on the privacy of email addresses, but it's routine at universities to have open, relatively unprotected LDAP directories or even web listings. That said, under Canadian PIPEDA (privacy laws), email addresses are considered personal information, so this would be a severe breach... As are all the times I get CC'd a bulk email rather than BCC'd.

</comment><comment><USER55> "I stumbled upon this snippet while doing research for my thesis, 'Prolonged drug use and its effect on code quality.'" Lol.

<comment><USER39> Old slogan, booze bottle a day, keeps good code away.

</comment></comment><comment><USER56> This made my day. After spending the last 6 months turning down developers based on horrible code reviews, I finally feel vindicated for sticking to my instincts and hoping to eventually find someone that doesn't think code like that from TFA is "programming" and subsequently destroying my codebase and crushing my soul.

</comment><comment><USER57> In order to truly understand the madness at play here, we really need to know how the list of email addresses was generated.

</comment><comment><USER58> This would have been so simple to just make right in the beginning. They should have just hashed each of those user names and put the hash into a dictionary. Whenever someone entered an email check if it is in the dictionary. O(1) time and it wouldn't be a "data leak vulnerability". So close...

</comment><comment><USER59> > I would really like to know the combination and quantities of drugs consumed > that resulted in this code. Do you know? Can you hook me up?

Meth. Two week binge. SilkRoad.

I can't imagine opiates did that.

And the only thing you'd do on coke is more coke in combination with hating yourself; not coding shit like this up.

</comment><comment><USER60> Check out our Eduware startup Coursio [http://coursio.com/](http://coursio.com/) for hassle-free education!

I vouch for the code, wrote it myself with some really good advisors around! ;-)

Get in touch with me personally, I'll give you a brief introduction!

</comment><comment><USER61> Unrelated fact: Desire2Learn likes to employ large quantities of first year CS student interns.

</comment><comment><USER38> Gee, what a newb. Here's how to do it in O(1):

        return userNamesStr.indexOf(curForwardUserName) >= 0

;)

(I'd love to not have to explain sarcasm, but people have an incredible difficult time understanding it here.)

<comment><USER54> lol, I was thinking that too -- "but indexOf is faster..."

</comment></comment><comment><USER62> Am I the only one who thinks that the amount of flaming is kind of unproductive?

<comment><USER35> It's a common thing I see with programmers. I know I've been guilty of it before. I see some poorly coded module and I'm just disgusted of how bad it is and then proceed to say some of the nastiest things about the developer who wrote it, sometimes just aloud to myself, other times to my peers.

These days I do my best to try to remember we all make mistakes, and that instead of flaming whoever is responsible for a mistake when it rears its ugly head, it's probably best to take it as an opportunity to discuss what I saw as shortcomings in the code with them and turn it into a learning experience if possible. Sometimes of course this isn't possible when you inherit code from devs who are long gone. Either way, I'm not sure any good is done throwing all that negative energy into the air.

</comment></comment><comment><USER63> For me it depends on what "validity" means.

1.) Prevent typos etc. Regex or Mailgun or Kicksend is enough. 2.) Prevent bounces, prevent wrong signups one needs to do double opt in.

<comment><USER64> The article has nothing to do with this aspect of address validation

<comment><USER63> 1.) Yes, the article was about choosing the right approach for validation

2.) I urge developers to step back and think about the requirements they get. Concerning those I would have thought what validity in this situation means, e.g. light validation in JS, send validation / validation list on the server etc.

</comment></comment></comment><comment><USER65> there is a huge market (education and higher education) where institutions (sometimes governments) will pay huge money for these sorts of apps, and for whatever reason, the only real players are often of this quality

at my university we use a similar system called OWL, which replaced a system called Web-CT. Both are horrendously slow, with fantastically poorly thought out interfaces.

There is a ton of money to be made here. Low hanging fruit.

<comment><USER66> How ironic that you mention WebCT, because that's what McGill in the article uses until very recently.

</comment></comment><comment><USER67> this should be submitted to thedailywtf.com...

<comment><USER68> It's #1 on HN, it has plenty of exposure already.

</comment></comment><comment> w-ll

         if input_email in valid_emails_set:
            send_email(input_email, another_param, etc)

Their solution, while isn't wrong, could still be improved. With a somewhat modified 2822 regex with a more strict domain rule. But I would also assume you could just query the db.

<comment><USER69> You assume "in valid_emails_set" doesn't make a query.

It's fairly trivial to define your own __contains__ in python.

<comment><USER70> Indeed, since this is an internal system validating the uni's own emails it could easily query the uni's MSA for valid addresses.

Although for a set of 80k items and long-running processes (fcgi or wsgi) you could also load the whole thing in memory directly and not bother with a custom `__contains__`.

</comment></comment></comment><comment><USER71> Dang, that programmer sure gets around! They did a stint on my team, too.

</comment><comment><USER72> Sadly, this looks like something my boss might try to pull off...

</comment><comment><USER73> i wouldn't blame drugs... this is just stupidity, or perhaps even naivete. :)

</comment><comment><USER74> lol

</comment><comment><USER75> I was waiting for the part of story where she would describe how the developer had an actual drug habit or something, so much she talked about it. I wonder if she's ever really met someone who 'uses drugs', this mockery seems incredibly infantile.</comment>


FTC To Examine Apple's In-App Purchases For Being Too Easy - <AUTHOR> http://techcrunch.com/2011/02/22/ftc-to-examine-apples-in-app-purchases-for-being-too-easy/

<comment><AUTHOR> I kind of understand why (this one and many others):

"My cousin who is 8yrs old proceeded to make nearly AUD$1500 worth of purchases of these gold coins within the app, without any need for password or any warnings. Remember this game is designed for children." [http://discussions.apple.com/thread.jspa?threadID=2589575...](http://discussions.apple.com/thread.jspa?threadID=2589575&tstart=45)</comment>


Show HN: Quality photo prints of your favorite Instagram moments - <AUTHOR> https://keepsakemail.com/

<comment><AUTHOR> Many of my friends and family use Instagram and I wanted to surprise them with photo-quality prints of their Instagram photos. I couldn't find a super simple solution that would let me do this, so I built one over a weekend or two.

</comment><comment><USER2> Good job on shipping. Have not used it so I can't comment on the product itself.

<comment><AUTHOR> Thanks! Happy to refund your purchase under $10 if you'd like to try it.</comment></comment>


Adobe claims rtmpdump 'can be used' to infringe - <AUTHOR> http://www.chillingeffects.org/anticircumvention/notice.cgi?NoticeID=25159 <comment><USER2> SourceForge has removed the homepage of the program, but Yahoo still has a cached copy[1].

From the page: "A small dumper for media content streamed over the RTMP protocol. Supplying an rtmp url will result in a dumped flv file, which can be played/transcoded using ffmpeg/mplayer, etc. Download scripts for BBC's iPlayer and hulu.com streams are included."

It seems like they chose to describe it as an infringement tool that can be used for other things (debugging?) as well.

[1] [http://126.96.36.199/search/cache?ei=UTF-8&p=rtmpdump&...](http://126.96.36.199/search/cache?ei=UTF-8&p=rtmpdump&u=sourceforge.net/projects/rtmpdump/&w=rtmpdump&d=XkmTI0xIS12y&icp=1&.intl=us)

<comment><USER3> Are you implying that it is somehow illegal or "infringing" to dump a data stream _being sent to your computer_ to a file?

I cannot imagine what insane logic could lead to such a conclusion. If we were using this logic 20 years ago, VHS recorders would have been deemed illegal.

<comment><USER2> _> Are you implying that it is somehow illegal or "infringing" to dump a data stream being sent to your computer to a file?_

No, what I'm saying is that if you write a script to dump Hulu.com files and advertise it on the main page of your project as a main feature of how you can use it, you really shouldn't be surprised that people think the main use of your program is to infringe.

<comment><USER3> Again, how is that infringement?

 _They are sending you data_. You have the right to put it in a file. That is not infringement.

If you aren't legally allowed to put it in a file, they weren't allowed to send it to you, so Hulu is infringing, not you.

<comment><USER4> What's legal, especially under the DMCA, isn't defined by what you feel is common sense, unfortunately.

<comment><USER3> Indeed, it's not defined by common sense or (thank god) what you "feel is right": it's defined by the law, which doesn't agree with such absurd concepts as it being illegal to save data onto a disk.

Even the DMCA doesn't prevent that: it prevents bypassing certain types of copy protection schemes. By your logic, the DMCA makes it illegal to dump a DVD to your hard disc, which is categorically false: it is only illegal to break the CSS encryption, not to dump the data. It is also not illegal to dump the video data after it has left the decoder.

I suggest you do more reading on the legal system and its precedents (particularly Sony Corp. of America v. Universal City Studios, Inc.) before you attempt to comment on it.

Of course, this all applies to the US. Your mileage may vary in other countries.

</comment></comment></comment></comment></comment></comment><comment><USER5> A summary based on what I've read elsewhere:

rtmpdump is a stream recorder that can save videos streamed by Adobe Flash's RTMP protocol

Adobe has a more "secure" version of that called RTMPE

surprise! it's not really secure. Analysis: <http://lkcl.net/rtmp/RTMPE.txt>

Quote: "the Adobe RTMPE algorithm tries to provide end-to-end secrecy in exactly the same way that SSL provides end-to-end secrecy, but the algorithm is subject to man-in-the-middle attacks, provides no security, relies on publicly obtainable information and the algorithm itself to obfuscate the content, and uses no authentication of any kind."

So the DMCA anti-circumvention provision makes this software illegal in the US, even though the "protection" that has been circumvented is laughable.

Apparently that could be a basis for a challenge, i.e. nothing has been circumvented as there is no protection there in the first place.

(Odd note: the examples of content that could be infringed are shows on a British channel. As far as I'm aware this software is legal in the UK)</comment>


Ask HN: Has technology benefited the classroom? - <AUTHOR> As a teacher, I've seen new technologies being pushed into the classroom as tools to help students: from the SmartBoard, iPads, being allowed to use cellphones in the classrooms, carts full of laptops, etc.<p>Is there any research out there that shows the benefits of technology being incorporated in the classroom? Does the opposite exist? If research does exist, are these studies independently funded or are they funded by the companies of these techonologies? <comment><USER2> > Is there any research out there that shows the benefits of technology being > incorporated in the classroom?

Yes.

> Does the opposite exist?

Probably.

> If research does exist, are these studies independently funded or are they > funded by the companies of these techonologies?

Both.

I think that educational technology is still at a point of "throw it at the wall and see if it sticks". I also think a lot of technology is being deployed without adequate professional development for teachers.

They have the technology, but haven't been gotten the proper level of training nor had the proper resources to develop effective curriculum using technology.

Thus far, effective programs always seem to have a "rock star" teacher/instructor at the center, going the many extra miles needed to establish gravitas.

</comment><comment><USER3> Not sure if you are looking for specific data about "brick and mortar" classrooms or if you are open to digital and blended classrooms, too. You can see videos and papers about new educational technology here: [https://www.imsglobal.org/2016-learning-impact-awards- public...](https://www.imsglobal.org/2016-learning-impact-awards-public- voting)

I haven't looked at all of them, but you should be able to see some data/research by the participants supporting their educational technology.

Also, voting is open to the public until 2016-05-24 @ Noon.

<comment><AUTHOR> Ah, I knew I had forgotten something. I'm specifically looking at "brick and mortar" schools. The reason is that I've noticed in my school board that a lot of new technologies seem to get implemented very quickly and without proper reflection on choice. For example, almost all schools in my school board have been equipped with SmartBoards. These are huge money pits: they break down often and I see very little ROI as a teaching tool (especially within the senior level courses). But somehow, their numbers keep proliferating... This seems to be the general outlook on most technologies being implemented in the classroom.

</comment></comment><comment><USER4> My company is of the mind that many ed tech products are not impactful because they don't take a rigorous approach to curriculum (notwithstanding the absolute buzzword status of "rigor" in K12 education). Our approach is to use tech as a lever to transplant a successful curriculum into areas that otherwise wouldn't have this curriculum.[0]

SRI reviewed the research on our impact with fairly positive findings.[1]

[0] - detail on the approach in the International Journal of Artificial Intelligence in Education: [http://ijaied.org/pub/1368/](http://ijaied.org/pub/1368/)

[1] - [https://www.sri.com/work/publications/strength-research- reas...](https://www.sri.com/work/publications/strength-research-reasoning- mind)

</comment><comment><USER5> [http://rer.sagepub.com/content/68/3/322.short](http://rer.sagepub.com/content/68/3/322.short). You can go through this research paper. I feel before implementing the technology we really need to check all the pros and cons and then we should decide.

</comment><comment><USER6> This may be relevant watching: [https://www.youtube.com/watch?v=GEmuEWjHr5c](https://www.youtube.com/watch?v=GEmuEWjHr5c) ('This Will Revolutionize Education').

</comment><comment><USER7> Here's a relevant article that just came up in my twitter feed: [http://www.eschoolnews.com/2016/02/15/what-does-research- rea...](http://www.eschoolnews.com/2016/02/15/what-does-research-really-say- about-ipads-in-the-classroom/)

</comment><comment><USER8> My mother is an elementary school teacher. She recently bought a set of ipads to use in the classroom. She cant get them to work because the internet at the place is set up improperly and they wont let me fix it for her either.

Schools suffer from bureaucracy, not a lack of tech.

<comment><USER9> Has she talked to the IT guy directly? As an IT guy I would bend over backwards for this type of request.

<comment><USER8> There is no such thing as an IT guy. The district contracted the work out to a company. My mother talked to them, they told her what needs to be done and wrote a proposal to the district administration. Those guys rejected it on the basis of "because fuck you, thats why".

It's a small school. Not a big network. Basically your average household internet with a $20 router and a bunch of cables. I could set the whole thing up in an hour but that's not going to happen either.

</comment></comment></comment><comment><USER10> To me, it seems that an academic literature search is closer to the daily activities of one than to a random population of tech nerds particularly in regard to questions of professional educational practice.

Good luck.</comment>


Gmail not allowing push notifications on iPhone Mail app, should've been illegal - <AUTHOR> How is it still possible for Google to disallow iPhone's Mail app from receiving push notifications? I am not asking how it is possible technically, but asking how is it possible legally.
Isn't this practice against some of the antithrust laws? How is it "enough" different from what Microsoft had been doing?
I have just got an old iPhone from a relative for my convenience, and blown away. This is not a new thing. Google, somehow, have been getting away with this practice for many years now. To me it seems as extremely foul, and I just cannot understand, how? <comment><USER2> EDIT: I was wrong. Gmail supports IMAP[1], so this is entirely Apple's fault if they're using POP instead of IMAP for accessing Gmail.

iPhone Mail uses POP, an open standard for email, to connect to Gmail. POP doesn't support push notifications. All POP clients (Gmail itself, Outlook, etc.) must use polling to find new emails.

You could blame Gmail for discontinuing IMAP support, or you could blame Apple for refusing to integrate with Gmail using their API (which supports push and is faster than POP).

Either way, this is a natural consequence of competition. Neither company wants it to be easy for you to use the other one's product.

1\. [https://support.google.com/mail/answer/7126229?hl=en](https://support.google.com/mail/answer/7126229?hl=en)

<comment><AUTHOR> I am clearly blaming Gmail for discontinuing IMAP support, which seems to me clearly as a foul practice of abusing dominance over the market via introduction of non-standard ways, while also halting support for the standards. They would perish if they were to do this as a small company, and make benefit out of it by "pushing" their products as a bundle, just because a sizeable amount of people are dependent on their services.

<comment><USER3> When did this happen?

I have things still happily using IMAP, in fact gmail on my iPhone is still showing IMAP-like folders, further more the gmail help still shows the IMAP configuration procedure[1].

[1]. [https://support.google.com/mail/answer/7126229?hl=en](https://support.google.com/mail/answer/7126229?hl=en)

<comment><USER2> Sorry, you are absolutely right. Gmail supports IMAP as a server.

Email discontinued support for importing emails from IMAP sources in Gmail itself. That's what I was thinking of.</comment></comment></comment></comment>


'Steve Jobs' Bombs: What Went Wrong with the Apple Drama - <AUTHOR> http://variety.com/2015/film/box-office/steve-jobs-flops-1201626243/ <comment><USER2> Typical hollywood self-delusion.

> after Leonardo DiCaprio and Christian Bale passed on the title role, it > lacked a major star, limiting its commercial prospects

> Having a DiCaprio or a Robert Downey Jr. in the title role may have > broadened "Steve Jobs'" appeal.

Fassbender came out looking like Ed Harris. Audiences want to see Jobs in his prime, as Ashton Kutcher played it. Nothing to do with a "big name actor" and everything about sex appeal. Apple has always been about image and the movie is no different. The fact that the sexy version of Jobs was already done is why it failed and the hand wringing in this article looks idiotic. Everyone considers a 20$ ticket to the new Jobs a wasteful risk, despite hearing how existing mediocre fall films are doing. Quit putting out schlock and your art- film remakes might do better. They certainly won't be hits, either way.

<comment><AUTHOR> Personally, I think people are just plain tired of the Steve Jobs narrative.</comment></comment>


Ask HN: Who would you revive from history? - <AUTHOR>

If you would have the power to revive anyone from history and have them live another 30 years, who would that be?<p>Please pick someone who you think would have a big impact on our world if he/she would be alive today. <comment><USER2> I think it's really hard to make a realistic scenario given the shock any person would go through if something like that would happen. It could well be that the revived person goes crazy or dies again of heart attack. But suppose I could choose anyone, increase the time span a little more(let's say 50 years) so that they'd have enough time to adapt, make sure that they don't go crazy or die of heart attack, I would choose someone with a combination immense intellectual power and ability to make things happen like Isaac Newton. Also I would choose someone like him because of the potential unpredictability(exponential effects) of what he would be capable of. Though it's still unclear what would actually happen if someone would indeed be revived. :)

</comment><comment><USER3> Carl Friedrich Gauss. I am amazed how often his name comes up in Physics&Mathematics. Probably he would need some time to get on track but still it would be awesome.

</comment><comment><USER4> The Prophet Mohamed. Considering the recent global conversation about religion, science and the future of humanity it would be interesting to see what the Prophet would have to say about Islam and how it has evolved over the past 1450 years and more importantly whether or not he approves of the direction it has been moving towards.</comment>


German nuclear plant infected with computer viruses, operator says (2016) - <AUTHOR> https://www.reuters.com/article/us-nuclearpower-cyber-germany-idUSKCN0XN2OS <comment><USER3> If a virus can cause accident that releases radiation, it's not a computer safety problem, it's a failure in nuclear plant automation design.

Modern nuclear plant's usually have analog monitoring and safety system's parallel to digitized control in critical parts like neutron flux measurement and calibration, fuel loading monitoring, control rod position indicator, control rod actuators, .... Any error caused by virus attempting sabotage the plant should result shutdown.

You can divide the system into 1) process automation 2) limiting systems and 3) Protection systems.

Process automation can be fully digitized and computerized. If it fails or computer virus attempts to sabotage the system, it should not cause critical conditions because limiting systems have diversified digital and analog control systems that limit given parameters. If that fails independent protections systems trigger shutdown if those same parameters are exceeded.

Another way to divide the safety is four principles:

1) parallel principle: parallel subsystems

2) separation principle: parallel subsystems are placed so that simultaneous damage to all of them is very unlikely.

3) diversity principle: same function is implemented with different operating principles. The same valve can be operated using electric motor, compressed air, or manually.

4) safe-state principle: system failing falls back to the safe state

<comment><USER4> A shutdown is still a denial of service attack, which might be bad enough on its own. How well can the grid compensate for one or several plants suddenly dropping offline? We know cascading grid failures can happen.

But, I guess the risks there are about the same for a nuclear plant as they would be for a computerized non-nuclear plant.

<comment><USER3> This is a unique new category for networked digital automation that is absent from other systems. I don't think computer security people take it seriously enough.

Say, you sabotage "dumb" automation system to break and turn the car suddenly right. When the failures starts to happen, manufacturer eventually notices it and recalls vehicles. Maybe tens or hundreds of people will be injured.

But what if the system has access to date and time trough CAN bus? If design a system that steers all affected cars suddenly right at the same time the cascade can kill and injure thousands and cause huge panic. People are afraid to drive until the problem is fixed.

<comment><USER5> High-assurance security has been pushing separation kernels to solve that kind of problem for a long time. Vendors even list automotive in their Solutions menus. Two got evaluated by NSA for security. I think NSA cancelled that protection profile because the hardware and firmware were having too many leaks to find a software solution believable. The boards aimed at that market are also increasingly complex. However, the separation kernels and virtualization platforms were the strongest thing produced for this goal with some still available.

Here's a good explanation of default, architectural style used in high- assurance security from a team that FOSS's a lot of their prototypes:

[https://os.inf.tu-dresden.de/papers_ps/nizza.pdf](https://os.inf.tu- dresden.de/papers_ps/nizza.pdf)

Here's a commercial one used in an automotive platform that got certified to high assurance at EAL6+:

[https://www.ghs.com/products/safety_critical/integrity- do-17...](https://www.ghs.com/products/safety_critical/integrity-do-178b.html)

I'm not endorsing the [closed-source] product so much as the methods it claimed to use to get the job done. Look at the architecture, minimalist runtimes (esp for Ada), determinism, partitioning, and certification data on bottom-right. That last part hints at the kinds of things they have to do and get reviewed for the certification. If a developer claims to do security, ask to see the Covert, Channel Analysis of their product. That certification requirement/activity is how cache-based, timing channels were discovered in 1992 by VAX Security Kernel team among other leaks. Covert and side channels are getting popular again but most still don't apply storage/timing analysis.

You'll find that most developers and "security professionals" don't build secure stuff using methods proven to work in the past. Companies building tech like this sell it for high price since there's so few buyers. The networking- oriented ones started at $50,000 when I priced them. You can bet the big companies whose products are getting hit could've afforded them, though. Especially the royalty-free options.

<comment><USER3> Partitioning kernels have been used decades in aviation and other safety critical systems. I have developed software for integrity for example. It's commercial software and not proper open source, but the code is available for their their customers.

These system address the issue of separating different functions as well as possible. What they don't address the problems that widely used homogeneous systems face when a way to compromise the system is found.

<comment><USER5> I first encountered them made for aerospace for DO-178B. What's the oldest one you know like a separation kernel whose design details are publicly described? I like giving proper credit and knowing the history.

For me, we went from security kernels to Rushby's concept to separation kernels. Then, they did aerospace versioms first since safety requirements were already a subset of security requirements. Plus, aerospace companies would actually buy it. Hard to sell that stuff in non-regulated markets.

<comment><USER3> I'm not good at history of operating systems.

Separation kernel is efficiency thing. The oldest and most secure way to solve the same problem is separate computers and put data diodes between them if necessary. Need for integrated modular avionics was the driving force for the development. Aircraft have space and weight limits.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> This quote sounds strange to me:

" _As an example, Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its planes every week of malware designed for Android phones. The malware spread to the planes only because factory employees were charging their phones with the USB port in the cockpit.

Because the plane runs a different operating system, nothing would befall it. But it would pass the virus on to other devices that plugged into the charger._"

What kind of malware would that be? Also obviously the OS is at risk since it also must have been infected to be able to pass the malware along (I'm guessing this might be the entertainment system or something and nothing critical).

<comment><USER7> You are thinking too conventionally. There are numerous ways to attack USB devices that don't involve the OS. [https://www.bleepingcomputer.com/news/security/heres-a- list-...](https://www.bleepingcomputer.com/news/security/heres-a-list- of-29-different-types-of-usb-attacks/)

<comment><USER6> I guess that a regular app would not have the necessary low level access (that I assume is required) to do anything like that.

So that (another guess) means that the android phone needs to be under complete control of the malware.

Is that common or are my guesses/assumptions wrong?

</comment></comment></comment><comment><USER8> I know this is not going to be a popular opinion, but using Windows for critical systems, even air-gapped and everything is simply irresponsible. Windows seems to be too hard to secure, and these problem keep happening again and again.

It's not that Linux or some RTOS would necessarily be immune to a targeted attack like Stuxnet, but they would be immune from the random crap malware that exists in the Windows world.

<comment><USER9> I've been thinking about that on and off for quite some time. These kind of embedded systems are actually a really hard problem, because updates are hard up to impossible. So eventually there will be 10 years of known bugs in that system.

Digesting from a lot of defcon / blackhat talks, it seems that the best way to minimize this amount of bugs is to deploy less code. And I think that's where a BSD or a linux has a strong option to be more secure: you could strip down the kernel and the system as much as possible. Don't deploy any USB related code, potentially remove the entire network stack if you can.

That's the theory anyway. The IoS displays how badly managed linux can be equally open.

<comment><USER10> My experience of redundant embedded controller systems is that whilst they may not be WindowsTM software, they are usually based on an RTOS such as vxWorks, QNX etc.

I don't suppose they are any harder to "hack" than Windows. In fact, it is possible that they may be easier depending on the security mentality of the manufacturer, and given the number of eyeballs on WindowsTM.

I can only imagine this will get worse as these controllers become more and more sophisticated.

The only way, in my opinion, to safeguard against this, is have a fully disconnected system, with no USB access. However USB is easy.

<comment><USER9> > I can only imagine this will get worse as these controllers become more and > more sophisticated.

That is exactly the thing though.

If you could reduce a digital control unit to a small program and run that on a write-once memory in a dead simple controller, you'd avoid spectre, meltdown, you'd avoid the vulnerability of overwriting the program post- deployment and you'd simplify ensuring correctness of the control program. Verification might actually be possible there.

<comment><USER10> Hi, yes but they wont do that. Normally, there is no write once memory. Most eg. oil rig control systems are not hammered down to that level. Heck - <USER2> aviation flight control systems are not like that. In fact, I was, in my early career responsible for writing a windows C# communications driver for the entire oil rig. Its still working :)

</comment></comment></comment></comment></comment><comment> GuB-42 It doesn't seem to affect the nuclear operation part in any way.

Nuclear power plants also have windows PCs running MS Office. There are people there who plan budgets, write reports, send e-mails, etc... The boring stuff found in every company.

Nuclear plant operation, at least for the critical part is still surprisingly low tech. There are panel full of gauges, lights, switches and levers. And there are people with paper sheets following procedures like "if pressure X exceed Y, push button Z". I don't expect a virus to have much influence on that part. It is bad for the economic operation, but not really a safety issue.

I don't know enough to know if a well targeted attack, stuxnet style can be a safety issue. I guess not, but that could probably cause a shutdown.

</comment><comment><USER11> In the UK they did not update the control rooms for the nuclear plants so, last time I checked (which was about a decade ago), they still looked like 1960's vintage hardware. So I was sceptical about how a computer virus could possibly affect things.

Looking for a picture of a 'modern' control room from a British nuclear plant (with not so much as a Windows XP machine in sight) I came across this story of how a decommissioned nuclear plant is now a school:

[https://www.businesswest.co.uk/blog/site-berkeley-nuclear- po...](https://www.businesswest.co.uk/blog/site-berkeley-nuclear-power- station-begins-new-chapter)

Girls and boys can go there to learn about STEM things, including our friend the atom. Clearly that talk about how toxic nuclear power plants were going to be for future generations was idle speculation and fear-mongering.

<comment><USER12> _Clearly that talk about how toxic nuclear power plants were going to be for future generations was idle speculation and fear-mongering._

We are spending a lot of money decommisioning legacy nuclear power stations.

</comment></comment><comment><USER13> People are quick to forget that the human mind is a firewall in computing environments. A car that can be remotely turned off by satellite signal is not a car with which I would want to share the road. Process automation will probably create the Runaway Train effect in due time.

<comment><USER14> A lot of modern cars with OnStar have this.

</comment></comment><comment><USER15> > infections of critical infrastructure were surprisingly common, but that > they were generally not dangerous unless the plant had been targeted > specifically.

Stuxnet

</comment><comment><USER16> It's an article from 2016. What's the point of sharing this?

</comment><comment><USER17> 2016

</comment><comment><USER18> This article is from 2016.</comment>