Went to update payment info, showed me some random person's credit card info - <AUTHOR> https://reddit.com/r/ios/comments/d7u91h/went_to_update_payment_info_showed_me_some_random/ <comment><USER2> I saw something very similar to this happen once in a system (many moons ago, before my current role). Hopelessly incompetent software developers put the session cookie in a static field of one of the Java classes responsible for the login process, and if two users logged in at the exact same moment (and their requests happened to be served by the same node of the app server cluster), one of them would be given the other's session cookie. So A and B would both log in at the same time, and there was a chance that B would get logged into A's account details instead of their own.

Somehow, all through QA testing, nobody noticed it (or if they did, they didn't report it). At just about the last possible minute before go-live, somebody observed it happen. Then there was a mad rush to patch the bug in the middle of the go-live weekend so the go-live stayed on schedule.

</comment><comment><USER3> Yikes.

This is part of the reason why I prefer to never let any services/apps/etc. save my bank/card details. If there's not an option to save the card details that I can uncheck, 9x out of 10, I reconsider the transaction.

The assumption here though is that the services/apps/etc. that do provide the option actually respect it; in other words, unless you use fake/virtual card details (not entirely reliable, in my experience), you can't be 100% sure that you're safe either way, which sucks.

</comment><comment><USER4> Cross wiring user data is always a bad bug. Especially when it has to deal with payments and credit card data. I hope this is a very rare thing and they find the cause quickly. Could be in user authentication, the payment card tokens, or one of any numbers of things. My bet would be on Auth.

</comment><comment><USER5> Credit cards are never secure by default. It is best to assume that the number will be stolen eventually.

<comment><USER6> I really wish they had multi-factor authentication like bank transfers have. The only credit-cards that I use are prepaid ones, for the reason you just mentioned.

<comment><USER7> Confirming online debit and credit card payments with a one-time password has become a standard practice in the EU. These solutions are also available in the US, are they not being adopted by banks there?

[https://usa.visa.com/pay-with-visa/featured- technologies/ver...](https://usa.visa.com/pay-with-visa/featured- technologies/verified-by-visa.html)

[https://www.mastercard.us/en-us/consumers/payment- technologi...](https://www.mastercard.us/en-us/consumers/payment- technologies/securecode.html)

<comment><USER8> It's not just in Europe, even here in West Africa OTPs (and hardware tokens) have been standard practice for years. I always feel weirdly unsafe interacting with US-based companies/payment processors.

</comment></comment></comment></comment><comment><USER9> Should not this incident involve PCI in some way?

<comment><USER10> PCI requires a forensic investigation after a breach occurs. (Further requirements may exist, I am not an auditor etc.)</comment></comment>


Conn. MBA grads start social site "shizzlr.com"  - <AUTHOR> http://www.bloomberg.com/news/2011-02-12/conn-mba-grads-start-social-site-shizzlr-com-.html

<comment><USER2> How does a site like "shizzlr.com" go about getting a syndicated AP news article?</comment>


You should learn to type (properly) - <AUTHOR> http://skilldrick.co.uk/2011/06/you-should-learn-to-type-properly/ <comment><USER2> I originally learned to touchtype in elementary school.

These days I just a Dvorak layout and don't worry too much about whether or not I use the proper form. I also don't concern myself with typing speed too much - if the speed at which your can write is your bottleneck, you are either much too clever to be in normal software development or you should stop using COBOL.

</comment><comment><AUTHOR> It's probably worth clarifying here that touch-typing is different to typing- without-looking-at-the-keyboard-(much). As knowtheory said, many presume that they're the former, when they're actually the latter.

</comment><comment><USER3> What an arrogant posting (presumably by a web developer). Go write some mathematical software or anything serious at all and you'll find soon enough that typing is not even remotely the bottleneck.

<comment><AUTHOR> What an arrogant comment. If you'd read the post, you would have seen that I said it's often not the bottleneck, but there are times when you need to get stuff out of your head as quickly as possible.

This "typing is not the bottleneck" is such a cliché - I nearly wrote about it in the article. It presupposes that programming is some kind of pipes-and- filters activity where we're thinking and then typing and then compiling. I don't know about you, but when I'm programming I work in different states. Sometimes it actually is about getting the code into the computer as fast as possible. Not all the time, but sometimes.

</comment></comment><comment> misuse-permit Blehg, GNU Typist recommends putting two spaces after period. Someone needs a lesson from a typographer.

</comment><comment> X-Istence I don't necessarily touch type since I almost never use my pinky other than to hold down the shift button. I don't really see the need to learn how to hold my hands on homerow to type better, I can type about 98 - 110 wpm without any issues without looking at my keyboard.

The way I got better at typing and typing fast was to be on very busy IRC channels where getting a word in edgewise without missing any of the conversation required a lot of fast typing.

I understand that most of this was meant for the people that are hunt and peck type. I don't think it is at all necessary for people that are able to type at a rapid rate using their own style to relearn how to type.

</comment><comment><USER4> I never learned to touch type. But if I use some amount of concentration I can type without looking at the keyboard. It's a bit like playing the guitar. I can see a mental picture of the keyboard and I can hit them with fairly high accuracy. I use most of my fingers but the pinkies are often regulated to hitting modifiers. Strangely I cannot picture many of the punctuation keys very well. Nor digits; top row or keypad.

I remember having to hunt and peck. But kids now use the keyboard from a younger age, I think the need for formal typing skills is not going to be necessary.

<comment><USER5> _"But if I use some amount of concentration I can type without looking at the keyboard."_

A competent touch typist should be able to type with his eyes closed, and without needing to concentrate at all. Typing becomes a reflex action, and you can concentrate on finding the right words, or on your code/problem itself.

</comment></comment><comment> jarek-foksa I have recently created a simple touch typing trainer app for Chrome. It's heavily inspired by "typefortune" mode from gtypist: [https://chrome.google.com/webstore/detail/okboeogmnhjpgbeaok...](https://chrome.google.com/webstore/detail/okboeogmnhjpgbeaokfogelclpblaemo)

<comment><USER6> I keep managing to navigate backwards to an empty tab without wanting to.

I tried to write a Chrome extension for typing text on websites recently. But I never got it to select the correct text blocks, especially on sites with table layouts like HN.

</comment></comment><comment><USER7> I'm a coder and I only learned to touch-type recently (within the last year) in QWERTY, it felt better but QWERTY itself just didn't feel right to me.

I've since moved over to Colemak layout and I've never looked back (combined with a TypeMatrix keyboard).

</comment><comment><USER8> If you're on a mac you can install homebrew[1] and then do the following:

      brew install gnu-typist
      gtypist

[1] <http://mxcl.github.com/homebrew/>

<comment><AUTHOR> Thanks. I'm on Ubuntu and did

        sudo apt-get install gtypist

</comment></comment><comment><USER9> Does using an azerty keyboard slow you down when using Vim? I'm assuming it was developed with qwerty keyboards in mind.

<comment><USER7> I use Vim religiously with the Colemak layout. hjkl are a bit messed up, but that's nothing.

</comment></comment><comment><USER10> How many developers don't know how to touch type? Is this really a problem? EDIT: Even if you pass the hiring process I think you would get fired pretty immediately.

<comment><USER11> As a colleague said "Wow, you can type really fast... for someone who only uses two fingers".

Now he's exaggerating a bit, but I am a slow typer that predominately uses index, middle and thumb. Now, I get stuff done, I'm a pretty smart coder but typing speed, to me, feels like a huge bottleneck. By far the most important area I need to improve on.

Unlearning bad habits is hard, any advice?

<comment><USER12> Switch layout to Dvorak maybe? It will give you a fresh start and allow you to type fast with less finger travel and less pain, not necessarily any faster though.

Also will infuriate your co-workers and family members when they come to borrow your machine!

<comment><USER13> If you want to forcibly learn to touch-type, learning Dvorak is a very potent solution. The reason why you don't touch-type on QWERTY is generally that, frankly, there isn't a very compelling reason to. QWERTY doesn't reward you for it. You keep your fingers on the home row, and you get, what, the J? The K? F? The _semi-colon_? WTF? Why _would_ you touch type? I'm not actually sure failing to touch type with QWERTY is actually a problem. It may actually be the most rational reaction.

Or you can switch to a sensible keyboard layout, of which Dvorak is the easiest to get support for (though not the only, and, abstractly, not necessarily the best, but mostly good enough). Now you get AOEU under your left hand and HTNS under your right, and guess what, you don't have to _try_ to keep your fingers on the home row, because they're just there anyhow. It's difficult to imagine what a "non-touch-typing Dvorak user" would even _be_ , at least once you've really internalized it.

Given how painful learning to QWERTY touch type can be, it's probably easier just to switch to Dvorak, learn the layout, then just naturally learn touch typing in the next couple of months without "trying". The total effort might be lower, even if the switch isn't free.

(This is all assuming we just take as a given that touch typing is desirable. I'm not sure about that, but I also think we lack the data to be sure either way, especially when it comes to long term effects.)

</comment></comment></comment></comment><comment><USER14> The home-row (touch) typists I know are without exception, all the non-tech people I know. I can't even think of a single tech person in my entire career that typed like this.

When I was in High School we were required to take a typing class. I sat next to two of my nerd friends. When the teacher had little tests or races, we always came in 1st 2nd and 3rd in the class in terms of speed an accuracy, and between the 3 of us we probably used 8 fingers combined.</comment>


Why Riak and Node.js Make a Great Pair - <AUTHOR> http://liamkaufman.com/blog/2012/03/01/why-riak-and-nodejs-make-a-great-pair/

<comment><AUTHOR> (Author here) The picture I paint of Riak and Node.js are pretty rosy, has anyone had any negative experiences with the two?</comment>


The EARN IT Act: how to ban end-to-end encryption without banning it - <AUTHOR> https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encryption-without-actually-banning-it <comment><USER2> So in short:

* EARN IT creates a committee that is set out to define "best practices" for preventing child sex abuse.

* Companies that don't adhere to these best practices lose liability protections for user-generated content.

* The attorney general can unilaterally edit these best practices as he sees fit.

* The current attorney general has repeatedly made statements that he wishes to eliminate the ability for companies to offer end-to-end encryption - he wants all communications to be vulnerable to wiretapping.

This effectively gives the attorney general the power to compel tech companies to do whatever he wants (so long as he can argue that it's preventing sex abuse) by threatening to revoke section 230 protections, and it's likely that this would be used to revoke protections from companies that offer end to end encryption.

<comment><USER3> This is a perfect case against centralized messaging: no company = no liability.

Sorry, moxie; there's going to be no way to have a beautiful e2e encrypted IM еxperience under wise oversight of a single company; only ugly p2p hodgepodge without a legal SPOF has a chance to pull it off.

<comment><USER4> We still need to replace the ultimate centralized industry: internet service providers. The telecommunications industry has always cooperated with the government and they can be ordered to block the "dangerous" messaging services. We need to somehow replace ISPs with a world-wide mesh network that can't be censored no matter how much governments want to.

<comment><USER5> I agree that ISPs are a problem, but it's possible to build a reasonably blockproof service with a doze of p2p darknet and reliance on common transport protocol (read: https). They would, essentially, have to find every node on the network and block them. Or perform very expensive traffic analysis, which can be defended against by designing normal protocol traffic to look very much like normal web traffic.

As always, adoption is going to be poor because even among geeks it's rare for one to deeply care about privacy & anonymity let alone lift a pinky for it.

Unfortunately, the worst threat is a legal one: just offer punishment for anyone who is found guilty of participating in such a network.

</comment></comment></comment></comment><comment><USER6> I do find it interesting that Lindsay Graham is one of the main sponsors of this legislation. From the linked article,

>The idea is to make providers "earn" Section 230 immunity for CSAM claims, by complying with a set of guidelines that would be developed by an unelected commission and could be modified unilaterally by the Attorney General, but which are not actually binding law or rules set through any legislative or agency rulemaking process.

The structure and powers of this agency sound kind of like the Consumer Financial Protection Bureau setup by the Obama administration. The CFPB was an unelected commission that could create rules financial institutions had to abide by, and dole out punishment in terms of fines, without going through a legislative or rule making process. What were Lindsay Graham's thoughts on the CFPB?

>Graham, however, called the agency the "most out-of-control, unaccountable federal agency" in Washington.

>"Really no oversight at all," he said. "They can get into everybody's business. I don't think they added much at all to the consumer protection. They sure add a lot to increasing costs for midsize banks throughout the country that had nothing to do with the financial collapse."

[https://www.politico.com/story/2017/11/26/graham-durbin- cons...](https://www.politico.com/story/2017/11/26/graham-durbin-consumer- protection-agency-259969?tab=most-read)

<comment><USER7> Pedantic but for clarity: CFPB is directed by a single person who serves for five years and cannot be terminated by the President except for cause, which is one of the reasons unaccountability is brought up. Folks often indicate they want a "commission" (similar to SEC or FDIC) instead of an agency with a single director.

All that said, yes, this panel of people making "recommendations" that are not laws but have the effect of law seems like a great recipe for selective enforcement based how large or small a company is and what they do, which is not going to do much to solve the bigger issue. Congress is not going to move at the speed of the internet / technology. I'm not sure if that's a named "rule" yet, but it should be.

Illegal communities will move. And similarly, conditional "safe harbor" to operate a website should not be a thing. These regs are easily avoided by operating in other countries which will just make the US even less involved and competitive in this space.

<comment><USER6> I just think it's interesting that you can make almost exactly the same argument against this new commission that Graham made against the CFPB with a couple of words swapped out:

"They can get into everybody's business. I don't think they added much at all to child protection. They sure add a lot to decreasing privacy for people in the country that had nothing to do with the exploitation of children."

<comment><USER8> You can make that sort of argument against anything: the FAA, FEC, FCC, National Wetland Agency, etc.

What's euphemistically called "the real world" simply moves too fast for _any_ legislative body to keep up, let alone the current US Senat. So to some degree, the specific implementation of regulation will always be delegated to agencies.

</comment></comment></comment></comment><comment><USER9> This sums it up: "This bill takes popular rage at social media companies' immunity under Section 230 for _public speech_ on their platforms, and twists it into a backhanded way of punishing messaging service providers' use of encryption for _private conversations_." (emphasis original)

<comment><USER10> Does a service that only provides private conversations need 230 protections?

<comment><USER11> Seems so.

</comment></comment></comment><comment><USER12> What a great write up. The bill is rather dangerous, and I'm immediately suspicious of anything claiming to help children in the context of legislation.

FOSTA/SESTA is a horrible law and it has done a lot of damage.

<comment><USER13> Maybe I'm missing something, but I can see how this would apply to a platform providing end-to-end encryption and how restricting that is a bad thing. What's to stop someone from using, e.g. PGP in an email? Isn't that outside the scope of this?

<comment><USER14> There aren't PGP plugins for mobile apps and people wouldn't use them if there were.

<comment><USER15> K9mail has at least two

</comment></comment></comment></comment><comment><USER16> I love the hitchhiker's reference.

The post was well written and covered what I think are the important points.

There's only one thing I think deserves more attention than she gave it: The economics. The US' place in the tech world is largely a result of limited barriers to innovation in tech.

The kinds of "duties" proposed by this bill would be bad for big tech (a huge part of the economy) but worse than that they would be prohibitive for new innovators.

New social media services which attempt to serve the increasing demographic of people disillusioned with big tech aren't even going to try to get into a market with draconian requirements amd potential legal obligations like those proposed (or those that logically follow from the proposals).

Which means those services will be built elsewhere or not at all.

And of course there are the innovations we haven't imagined yet which won't be allowed to happen.

</comment><comment><USER3> * E2E encryption is incompatible with eavesdropping.

* Forbidding content, like child porn, hate speech, etc in _private_ communication requires eavesdropping.

* Courts are used to communication channels that are easy to eavesdrop, like paper or analog phone, and keep requiring disclosure from communication providers using court orders.

* Same as with guns, law enforcement wants to ban e2e encryption so that criminals could not use it, but criminals break the law anyway, so effectively the ban is for law-abiding citizens first and foremost.

Unless you can compel general public that having communication services with unbreakable encryption is more important than law enforcement, e2e encryption will stay effectively banned for non-technical users. That is, for almost all, including most criminals, too.

</comment><comment><USER17> How many people here think of encryption as a second amendment right?

If you find yourself arguing that it is - what happens when you are largely, if not wholly, dependent on a third party to be able to exercise that right?

We've decided that corporations get first amendment rights independent of their members - do they also get second amendment rights?

Are these just silly arguments? It's late Friday afternoon...

<comment><USER18> Encrypted data is more like speech than a weapon. The analogy to guns just doesn't work.

<comment><USER19> The US Govt considers encryption a form of weapons tech so that it falls under Munitions Exports Controls (see [https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...](https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States)). But the proposed law doesn't outlaw private use of encryption, only potentially outlawing corporations from offering it, so I don't know the 2nd Amendment would really apply.

<comment><USER20> The US courts seem to agree that encryption software are protected under the 1st amendment. See [https://en.wikipedia.org/wiki/Bernstein_v._United_States](https://en.wikipedia.org/wiki/Bernstein_v._United_States)

</comment></comment></comment></comment><comment><USER21> Don't fall for the trap that this is about "big tech".

It isn't.

It is about your freedom of speech and ability to protect yourself.

<comment><USER22> It is about big tech: WhatsApp doesn't need section 230 immunity if it isn't part of Facebook.

<comment><USER23> Can you explain how? The article lists WhatsApp as an example of an interactive computer service that is covered by section 230 immunity. Is it because WhatsApp is purely a messaging service without curation or moderation and so the law wouldn't consider WhatsApp to be a publisher anyway?

<comment><USER24> I don't use WhatsApp, but my understanding is that they are in the business of providing private communication between parties.

Section 230 protects the likes of Facebook, where people can post things for all the world to see, including things that are slanderous or illegal.

[https://en.wikipedia.org/wiki/Section_230_of_the_Communicati...](https://en.wikipedia.org/wiki/Section_230_of_the_Communications_Decency_Act)

<comment><USER25> Yes, section 230 protects Facebook for public conversations. But as far as I'm aware it _also_ protects providers of private communication, because as a user of the provider you could potentially receive illegal content from them. The provider, should they choose to moderate content by e.g. having report buttons and moderation teams, could still be treated as a publisher.

</comment></comment></comment></comment></comment><comment><USER26> Are there any stats available for child sex abuse using end to end encryption? It is used widely, along with "terrorism!" as a reason to ban e2eE, so I'd like to see some stats that show that it's actually an issue. Does regular mail post have this problem, or random websites? Not sure that e2eE is exploited more for this than those other platforms ...

</comment><comment><USER27> Other people have mentioned this already, but in light of bills like this I am starting to get a little annoyed at people like Moxie and at people more broadly who seem to be purely interested in punching down on efforts to build sustainable, censorship-resistant encrypted platforms. People who want to argue that decentralized systems are pointless need to start offering feasible, multi-country legislative solutions alongside their criticism, or else I do not care about what they have to say.

Everything going on right now indicates to me that the UX problem is easier to solve than the legal problem. No, decentralized systems aren't perfect, they have significant challenges. But they are a way more promising field than anything Moxie is proposing, specifically because of bills like this. We have been fighting this battle for so long, and we have barely managed to stay on the winning side. But these bills are not going to go away, and in light of that I just do not believe that centralized Open platforms are sustainable.

There is no world where governments give up trying to gain control over a centralized communication platform.

So we just have to suck it up and figure out how to build good decentralized systems that ordinary people can use. We don't have an alternative. Yes, that's a very difficult challenge. But deal with it -- unless you have a better way to build an uncensorable Internet.

</comment><comment><USER28> I think we need age limits. And lower term limits. We cannot have people stuck in an era 3 decades old deciding the fate of our country as it goes into the future. They are simply not equipped to deal with today's problems, let alone tomorrow's.

At 60 years[1], the median age of the Senate is 20 years more than the median age of the US population[2] - if this isn't an example of how broken and entrenched our power structures are, I don't know what is.

These issues are also also an artifact of a societal structure in which we use the winners of a rigged popularity contest to decide the future of our country rather than that of independent academics on a per-issue basis.

Through the lens of E2EE legislation, we are seeing our democracy crumbling because we failed to enforce that our representatives _actually knowing what they are talking about_.

[1]: [https://www.senate.gov/CRSpubs/b8f6293e-c235-40fd-b895-6474d...](https://www.senate.gov/CRSpubs/b8f6293e-c235-40fd-b895-6474d0f8e809.pdf)

[2]: [https://www.worldometers.info/demographics/us- demographics/](https://www.worldometers.info/demographics/us-demographics/)

<comment><USER29> _We cannot have people stuck in an era 3 decades old deciding the fate of our country as it goes into the future._

While I agree that the age skew in politics is curious, and perhaps incorrect, the other side of this is, "We cannot let people with 30 years less experience, knowledge, and history decide the fate of our country as it goes into the future."

Automatically associating youth with intelligence and "progress" and stereotyping people with years of accrued wisdom to being "old fogies" is textbook ageism.

It's something most of the rest of society grows out of by the time they hit college, but also a thing that persists within the SV bubble and what is now called "bro" culture. Fortunately, it's also illegal in many arenas.

<comment><USER30> But when I look at the decisions today's politicians do wrt. IT, I would argue that many 30year old ex-IT students have _far_ more experience wrt. IT topics than our current politicans.

The problem is that the tech landscape moved to fast and all the wisdom and experience often just doesn't apply anymore but, to make it worse, sometimes it seems that you can bend technology to make it apply but that a very dangerous fallacy. One I have seen politicans step into frequently.

<comment><USER31> How many ex-IT students become politicians?

Old politicians with no IT experience are being replaced with young politicians with no IT experience. Age limits don't improve anything here.

<comment><USER32> I'm also not sure that having IT-savvy politicians will change policy. The government has certain safety goals (eg trafficking) that it will still have to deal with. These might be a driver regardless of tech savvy-ness. There's an assumption that if only they knew enough -- but perhaps it's not them who don't know enough.

<comment><USER33> I've been watching Louis Rossman advocating for right to repair recently.[0] Louis tells a story about how opposition lobbyists have made outrageous claims and politicians bought it, because nobody actually showed up to disagree with the claims. While it's possible that politicians would vote the same way regardless, I think they they likely do miss out on a lot of information.

[0] video, watch 1 minute from here: [https://www.youtube.com/watch?v=cHQYyYSZdvQ&t=1m57s](https://www.youtube.com/watch?v=cHQYyYSZdvQ&t=1m57s)

</comment></comment></comment></comment></comment></comment><comment><USER34> How does this work for services in other countries? Do they also have to get liscenced in the US for handling user generated content? If so that's pretty crappy, I'm reasonably sure a worldwide legal monoculture will hurt the poorest people of the world including children.

</comment><comment><USER35> This is exactly analogous to DMCA in its structure--except that instead of the procedures being part of the law, the will be subject to constant change by the executive branch of government.

</comment><comment><USER36> Write Congress to say that if something like this is passed, it must be actual legislation, and not this "whatever the regulator approves" nonsense.

<comment><USER37> Sadly that horse has long left the barn, fled thousands of miles, died and been eaten by vuktures. Its grandchildren are feral and flee at the sight or scent of humans.

I suspect there are only two ways to fix that issue both unlikely. Game theory and sloth favor buck passing to agencies let alone the logistical scale involved with a mytgical ideal Congress of honest actors.

The first is an amendment limiting the delegation abilities of congression to departments and agencies to be essentially programatically explicit or else be unconstitutionally vague.

The second is a precedent and jurisprudence shift as judges strike down such delegation as unconstitutional.

<comment><USER36> Well, the way you put it, we should be taking up arms right now. If we're not there yet, then there's politics to do.

</comment></comment></comment><comment><USER38> Who am I to say that these two senators don't understand big politics, but here's my theory why the other 98 senators won't support the idea. Laws is a barrier between those who rule and those who obey. When the latter complain, the laws barrier diffuses their anger. The two senators find it too difficult to play this game and want to break this wall to rule the internet directly.

</comment><comment><USER39> So if the encryption moved into the mobile is layer instead. Lets say for images and blogs of text...

Note: I don't think technology can actually beat a government that doesn't feel bound by the constitution or above the law.

</comment><comment><USER40> Sexual abuse is terrible but I am so tired of it being used as the handle of the billyclub used to beat technology down

<comment><USER41> Look into some of the people who have set up fake CP sites on the dark web or who have posed as young girls on public social media. It's incredibly easy to create a honey pot to ensnare sexual predators. There are many articles on such experiments and they are highly effective.

They don't need back doors or hacker hanky panky to catch sex pests, just creative but conventional police work.

This is an issue that gets dragged out to scare the public but the authorities really don't care much about it. Reports of sex abuse from real victims are often ignored and sexual predators get shorter sentences than people convicted of minor drug possession or other stupid crap.

<comment><USER42> Exactly, they need to actually do their jobs instead of trying to cheat by taking away everyone's privacy and other rights.

</comment></comment></comment><comment><USER43> This may be an unpopular opinion, but this is a great idea. Huge tech companies now worth trillions facilitate criminal activity at scale and wash their hands of any responsibility. E2EE at scale is problematic for maintaining sanctity in society, as people are terrible. Giving common folks easily accessible tools to engage in global secure comms has been a recipe for disaster. LE's job has been made more difficult, and the tech companies should bear responsibility for policing their pipes.

<comment><USER44> Law enforcement has more tools for mass surveillance than ever before. The Stazi could only dream of what we have built. But it's not the job of tech companies to make policing easy, and it's not in the best interest of a free people to give their government too much power. Please look at the history of the FBI for examples.

<comment><USER43> Sorry for delay in responding. The issue is that there's a huge proliferation of inaccessible comms which creates a growing sea of unchecked globally enabled online activity. This isn't the same as allowing people to congregate in person and in private. The abstraction of privacy expanding on a virtual global scale presents unique challenges to law enforcement. This is independent from the proliferation of surveillance mechanisms at hand, and isn't a valid counterbalance.

The tech companies assume power and disclaim responsibility. It is their job to police their pipes, so respectfully and urgently I disagree.

Concerns about historical corruption within three letter agencies is best addressed by working towards technical solutions that enable proper checks and balances amongst involved players: governments, tech oligarchies, and commoners. The current trend is towards a growing sea of entropy without checks and balances, and this is unacceptable to governments motivated to maintain/increase order and reduce suffering. Resistance via deployment of technical libertarian mechanisms at scale isn't a solid long term solution.

The federal government isn't aiming to ban math, encryption, pgp, one time pads, steanography, etc. Instead the goal is to prevent the proliferation of unbreakable encryption at scale, as that growing void enables criminal activity at scale, despite the growing surveillance apparatus.

</comment></comment></comment><comment><USER45> This is great. We can all run private Kubernetes pods and share over Wireguard.

This will only ever apply to corporations right?

</comment><comment><USER46> > Without the immunity provided by Section 230, there might very well be no > Twitter, or Facebook, or dating apps, or basically any website with a > comments section.

Going on that description, a bit of me wishes for Section 230 to be repealed.

Of course there would be no GitHub either, which wouldn't be so great.

<comment><USER2> I don't think you fully understand the scope of what section 230 protects against. Even running an email server could put people at risk of being held liable for crimes, if users were to use that server to coordinate criminal acts. Revoking section 230 essentially mandates total surveillance of user activity.

<comment><USER46> So you would have to run your own email server or be given access to one by someone who trusts you, which would be a better situation in some ways than the Gmail monoculture we have today. Google likely has your mail on one end or the other; you're already under surveillance; Section 230 hasn't saved you.

<comment><USER47> And that email server has to be in a datacenter you own, because AWS doesn't exist. (What is AWS if not hosting user-generated content?)

And if you run a tor node, then you're liable for anything someone does with tor.

And if you host a blockchain mirror.

And...

<comment><USER48> There's already child pornography in the Bitcoin blockchain, right?

<comment><USER47> Yep!</comment></comment></comment></comment></comment></comment>


BBC inside GCHQ: Cracking the Code [2010] [audio] - <AUTHOR> http://www.bbc.co.uk/programmes/b00rmssw

<comment><AUTHOR> I've listened to this several times over the years. It shows more of the human side of GCHQ, since the BBC could never broadcast operational specifics.

My favourite bits are: 17 minutes in, an interview with an active GCHQ cryptanalyst. She's actually remarkably forthcoming.

And ~20 minutes in, a tour of the massive warehouse of computers under GCHQ, which they promise us is definitely _not_ being used to scoop up all our communications. Sure guys. Whatever you say.

Of course, it's all propaganda of the purest form, so take it with a fist full of salt.</comment>


H.P. Lovecraft's Philosophy of Horror (2014) - <AUTHOR> https://newrepublic.com/article/119996/hp-lovecrafts-philosophy-horror <comment><USER2> Article focuses too much on Cthulhu, not enough on Lovecraft's other interests -- his early and enduring fascination with poetics (he seems to have been a bit of a 19th century hipster, permanently disgruntled about being born a century too late to be Edgar Allen Poe) and with astronomy (during his lifetime the scale of the cosmos expanded shockingly with the use of photographic plates for astronomical observations, the development of spectrophotometry, and the discovery of other galaxies and then the red shift and the Hubble constant) -- indeed, the universe increased during his life in both volume, contents, and age by about the same extent that Moore's Law has impacted computing performance over the past 40 years.

Still a hugely influential writer in SF/horror, despite his highly regrettable (read: bigoted) and misanthropic outlook. I attribute his enduring relevance to his fiction providing the opposite of a science fictional sense of wonder: he brought a sense of cosmic dread at our insignificance in the face of an uncaring universe front and center, and in the post-nuclear age this resonates loudly.

<comment><USER3> > permanently disgruntled about being born a century too late

In fact Lovecraft wrote a whole short story, "A Reminiscence of Dr. Samuel Johnson", mocking himself about this.

</comment></comment><comment><USER4> It's interesting to witness Lovecraft's work rise from being considered obscure, poorly written schlock to mainstream greatness. Much the same happened with Philip K Dick. It took many decades, but their work is now part of the canon. It always makes me wonder what other great, underappreciated writers are out there right now, who we might not learn about for another fifty years.

<comment><USER5> I'm no literary or intellectual property expert, but I have attributed Lovecraft's rise with the fact[0] that the Cthulhu mythos is a) entertaining and well-written, and b) effectively exists in the public domain, and c) is one of the last unique narratives that legally exist in the public domain, allowing anyone to legally help grow the corpus.

In other words, writers don't have to pay licenses or royalties for use of the universe, and their stories can enjoy the benefit of being framed by the previously-written canon without being pigeonholed. I would think this can help grease the wordsmith's skids.

[0] I don't know if any of this is true or factual, I'm very open to corrections and other interpretations!

<comment><USER6> A good point, antipope actually covered it awhile back.

[http://www.antipope.org/charlie/blog-static/2015/06/they- too...](http://www.antipope.org/charlie/blog-static/2015/06/they-took-our- myths.html)

<comment><USER5> Ah! Thank you very much! I almost certainly internalized the sentiments of this essay when it was posted, and unintentionally forgot the source. I really appreciate the link!

</comment></comment></comment></comment><comment><USER7> Lovecraft is as anthropocentric as any author because he is writing for a human audience, and his characters are all human. His concern was less about an unrelenting materialism and more about _the human reaction to unrelenting materialism_. Otherwise he would have written essays about it rather than stories.

Interesting read, though. I had no idea Lovecraft wasn't well-known in his time. Certainly he'd have been pleased, I think, to have known of his future fame.</comment>


The problematic culture of "Worse is Better" - <AUTHOR> http://pchiusano.github.io/2014-10-13/worseisworse.html <comment><USER4> > "Worse is Better", in other words, asks us to accept a false dichotomy: > either we write software that is ugly and full of hacks, or we are childish > idealists who try to create software artifacts of beauty and elegance.

I think this criticism is slightly misattributed. _Ideologues_ ask us to accept a false dichotomy. Ideologues exist on both sides of an issue usually. For example, there are most definitely ideologues who believe this same dichotomy exists, but believe that the only option is to choose beauty and elegance, even at the expense of practicality. These are the people who (for example) wish Lisp machines had won and that we lived in a monoculture of _only_ Lisp.

I like C++ because I think it's useful, but I'm not a Worse is Better Ideologue. For example, I like Rust as a potential "better is better" replacement for a lot of C++'s use cases. I like Rust particularly because it seriously addresses nearly all of the practical advantages of C++. Many "Better is Better" ideologues would rather just hand-wave away the negatives of the compromises required to achieve their vision (like mandatory GC).

Rust proves that "better is better" design can address real-world practical challenges, while also providing an escape hatch back into a more primitive "Worse is Better" kind of world (unsafe blocks). It will be interesting to see if this approach gains the traction that I hope it will.

<comment><USER5> Great point, just a nit: Rust does _not_ have mandatory GC.

<comment><USER6> It doesn't even have optional GC.

<comment><USER7> Arguably, it has mandatory _manual_ GC.

</comment></comment></comment></comment><comment><USER8> "Other professions, like medicine, the law, and engineering, have values and a professional ethic, where certain things are valued for their own sake."

[citation needed]

I can't parse what exactly this is supposed to refer to. Doctors treat the patients they get - and frequently wind up with no choice but to use treatments that are only barely worse than the disease (see the history of chemotherapy drugs, for instance). Outside of legal academia, the legal profession is always working with imperfect information, imperfect systems, imperfect people making the calls (ffs, I feel a Law and Order episode breaking out)...

To me, the giant disconnect is that we've still got two threads of thought still mixed together under "Computer Science": the actual science-y bit, and the "shovel bits from A to B" software construction part. It's as if materials science, structural engineering, and construction management were all lumped together. Putting a new sidewalk in does not require the development of an entirely new method for making concrete.

<comment><USER9> How long did it take these three different fields to fully separate and have their own concentrations in universities? That may give us a timeline on how long it could be in the computer science, software engineering/architecture (does such a concentration exist involving architecture?), and software development methodology (project management... which is almost no existent in academia) fields.

<comment><USER10> Computer science used to be quite separate from application development and the nearest it would come to actual software was low level OS componentry. Any conglomeration is more recent.

</comment></comment></comment><comment><USER11> Discussing the meme "worse is better" is difficult because there are different interpretations and usages of that phrase. It's description vs prescription. The blog author chose the prescription interpretation. I can't tell if the author unknowingly did this because he did not see a separate evolution of that meme.

First interpretation is the descriptive usage. We could explicitly prefix the meme and qualify it as RGWIB (Richard-Gabriel-Worse-is-Better). The original label was the observation that "simpler" software was more successful than more full-featured software with ambitious goals. Richard's thesis wasn't about "hacks" but about small and simple things that satisfy users and builds momentum.

Second interpretation is the prescriptive (or self-justifying) stance which I might call HOBWIB (Hacks-Ok-Because-Worse-is-Better.) This appears to be what the blogger is complaining about.

However, HOBWIB isn't Richard Gabriel's thesis. That "worse is better" has taken on a life of its own and _repurposed_ by others who are unaware of RG's original meaning is just a circumstance of adopting snappy soundbites. Whatever behavior the author is complaining about would exist whether the exact phrase "worse is better" existed or not.

>"Worse is Better", in other words, asks us to accept a false dichotomy: either we write software that is ugly and full of hacks, or we are childish idealists who try to create software artifacts of beauty and elegance.

That label does not have that power over us. For example, we have a label for certain human behavior and call it "passive aggressive." The existence of that phrase _did not force us to choose_ whether to be passive aggressive or not. Likewise, thinking that the existence of 3 words "worse is better" is forcing us into a dichotomy of bad vs good design is flawed analysis.

<comment><USER12> Totally.

RPG's WIB said _nothing_ about bad design. C didn't do better than lisp because it was a hack. It was an incredibly clean design, as clean as the original lisp. RPG was comparing two clean designs, and trying to describe the evolutionary properties of one that made it more fit in its environment (ie us) than the other. The biggest such property is simplicity of implementation. (Later C compilers have gotten more complex and ++, but a modern compiler wouldn't have been as competitive in an earlier world where C wasn't already adopted: [http://www.ribbonfarm.com/2011/09/23/the-milo- criterion](http://www.ribbonfarm.com/2011/09/23/the-milo-criterion))

</comment></comment><comment><USER13> I can argue with many points made in this article, but there's one assumption at the very core that I think is false: _that we know how to do it better_.

There have been many ideas in software development floating around in the last couple of decades, from pure functional programming to interactive programming and programming by example. All of these approaches -- and the many others I haven't mentioned -- have explored interesting and possibly promising future directions, but all are yet to demonstrate _consistently superior results_ , across various domains, to the "broken" system we have today.

We are still exploring, and maybe some of the ideas people play with today will serve as the seeds of future, revolutionary development procedures. But it's not like we _know_ today how to do it significantly better even if we wanted to do away with the "old" ways right noe.

<comment><USER14> Yep, in my experience with my own software, today's "revolutionary, way better designed approach" is tomorrow's "hacky awfulness that needs a revolutionary, way better _re_ design", ad infinitum. It's much cheaper to accept and incrementally improve an imperfect solution. But I recognize the possibility that this is purely a personal experience and better developers than I really do know "how to do it better".

<comment><USER15> _> better developers than I really do know "how to do it better"._

They don't. They're just selling something. Not to say some approaches aren't better than others, it's just the only way to know which approach is really better is to implement the same problem space in both and compare. Anybody telling you that X is better than Y at Z without personally using both X and Y to do Z is just trying to sell you something. Beware.

It's also why the best test when deciding on a programming language or framework is to look at what others have actually created with it.

<comment><USER7> _" It's also why the best test when deciding on a programming language or framework is to look at what others have actually created with it."_

To a point. If everyone followed that rule, no one would ever build anything in anything new. At which point, looking at what others have actually created with it would merely be a test of the longevity of the programming language or framework.

</comment></comment></comment></comment><comment><AUTHOR> Calling people out as #worseisworse is almost certainly going to be ineffective - attacking people just makes them defensive and argumentative. Instead, can we find useful principles to steer us away from the two bogeymen (hack-it-till-it-works vs useless-ivory-tower-wankery)? Some ideas:

 _The real world exists._ Successful solutions usually come from actually understanding the problem and all it's constraints. Solutions that are dismissed as overly academic tend to fall afoul of solving just the immediate problem and ignoring eg compatibility, switching costs, accessibility to beginners. Similarly, the linux community spent a long time burying it's head in the sane w.r.t. usability and appearance. Sure, people _shouldn 't_ care how pretty your UI is. But they do and you can't change that by burying your head in the sand.

 _Everything has a cost._ The benefits of your new solution and the switching cost have to outweigh the pain of the old solution by a large margin. The original 'worse is better' was really an observation that simple solutions that do half the job are often cheaper than a hugely complicated solution that can do everything. If you spend every day coming up with better ways to make widgets, it's easy to believe that everyone wants to have as much widget- customising power as possible and is willing to invest time in learning to get that power. If you actually talk to your users you might find that only having three kinds of widget isn't annoying enough to make them spend time learning something better.

<comment><USER16> I agree with this except possibly one thing.

Saying "Sure, people shouldn't care how pretty your UI is." mischaracterizes user interface design as being about prettiness rather than interaction. But that might in fact be your very point and you might actually talking about the mischaracterization of others.

<comment><AUTHOR> I was thinking of the fact that beautiful software is perceived as more usable, all else being equal ([http://www.ergonomicsclass.com/wp- content/uploads/2011/11/Tr...](http://www.ergonomicsclass.com/wp- content/uploads/2011/11/Tractinsky_2000.pdf)). This is irrational but not controllable. Unfortunately many good solutions lose out in the market because their developers make the mistake of expecting users to be rational econs, rather than accepting reality and working around it.

</comment></comment></comment><comment><USER17> What this man calls "worse" actually means "something that in better in ways I fail to understand in my simplistic reduction of the complex world".

I love Lisp. I used it a lot for creating code that elegantly modifies itself.

But my entire software company succeeded because of languages like C/C++ and python, not because of Lisp or any "functional programming language of the week".

C gives you raw power that nobody else does. The fact that we could use c on c++ did become very useful so many times.

Some people believe that forcing other people not to use things like pointers is a good thing, it is "better".

For me it is the same as forcing people not to use sharpen edges on knifes for their own good.

Yes, it is better in the sense that people wont cut themselves with knifes. But it is worse on other areas too.

And if you let people choose, they will choose to continue using their knifes until something genuinely better appears.

This is exactly what people like this man can't stand, people choosing on their own to use something they don't like so they want to force their "better" way(my way or the highway).

If you have something better, well, show us the code, instead of ranting, and you will discover the fact that making anything that people actually want to use is way harder than ranting in a blog.

<comment><USER7> _" For me it is the same as forcing people not to use sharpen edges on knifes for their own good. Yes, it is better in the sense that people wont cut themselves with knifes."_

People cut themselves far worse trying to use a knife that's too dull for their task than a knife that's too sharp. Sharp knives are only safer when you're not using the knife (more likely to be cut by a sharp knife in a drawer than a dull knife in a drawer, &c).

</comment></comment><comment><USER18> The viewpoint the author seems to expound reeks of second system syndrome. That is, he seems to argue that incremental evolution is broken, since the state at any given point is suboptimal given what someone building from scratch would build, having all the lessons of hindsight with them.

Of course it is. Yet computer science history is full of overly ambitious projects (Plan9, Vista, Lisp) falling by the wayside as inferior solutions which were more incremental continued to chug along. The author didn't stop to consider why those failed, only to blame a myopic community; as if Lisp being better would have proven itself if only more people gave it a chance.

Incremental changes are how we progress. We take the lessons we have learned from what we're doing now, and then try something a little bit different. We can't try and redesign everything at once, so we pick a few things, and other compromises get left in. Compromise is an essential requirement to getting anything big done.

<comment><USER19> _he seems to argue that incremental evolution is broken_

I think he argues that this sort of absolutism is broken.

The author isn't proposing that we discard incremental change, just the uncritical assumption that incremental is the only reasonable change.

See his analogy with portfolio theory: he's not even challenging incrementalism as the default, any more than he'd suggest putting 90% of your money into emerging markets.

<comment><USER14> It seems more like a historical observation than an uncritical assumption, that incremental change has shown itself to be more successful. The author's claim seems to be that incremental change has been more successful historically because it has more mindshare. I think that causality is backward.

</comment></comment></comment><comment><USER20> The one-line summary: "Basically, no one seems to grasp that when stuff that's fundamental is broken, what you get is a combinatorial explosion of bullshit."

Exactly. A few examples.

\- C's "the language has no idea how big an array is" problem. Result: decades of buffer overflows, and a whole industry finding them, patching them, and exploiting them.

\- Delayed ACKs in TCP. OK idea, but the fixed timer was based on human typing speed, copied from X.25 accumulation timers. Result: elaborate workarounds, network stalls.

\- C's "#include" textual approach to definition inclusion. Result: huge, slow builds, hacks like "precompiled headers".

\- HTML float/clear as a layout mechanism. Result: Javascript libraries for layout on top of the browser's layout engine. Absolute positioning errors. Text on top of text or offscreen.

\- The UNIX protection model, where the finest-grain entity is the user. Any program can do anything the user can do, and hostile programs do. Result: the virus and anti-virus industries.

\- Makefiles. Using dependency relationships was a good idea. Having them be independent of the actual dependencies in the program wasn't. Result: "make depend", "./configure", and other painful hacks.

\- Peripheral-side control of DMA. Before PCs, IBM mainframes had "channels", which effectively had an MMU between device and memory, so that devices couldn't blither all over memory. Channels also provided a uniform interface for all devices. IBM PCs, like many minicomputers, originally had memory and devices on the same bus. This reduced transistor count back when it mattered. But it meant that devices could write all over memory, and devices and drivers had be trusted. Three decades later, when transistor counts don't matter, we still have that basic architecture. Result: drivers still crashing operating systems, many drivers still in kernel, devices able to inject malware into systems.

\- Poor interprocess communication in operating systems. What's usually needed is a subroutine call. What the OS usually gives you is an I/O operation. QNX gets this right. IPC was a retrofit in the UNIX/Linux world, and still isn't very good. Fast IPC requires very tight coordination between scheduling and IPC, or each IPC operation puts somebody at the end of the line for CPU time. Result: elaborate, slow IPC systems built on top of sockets, pipes, channels, shared memory, etc. Programs too monolithic.

\- Related to this, poor support for "big objects". A "big object" is something which can be called and provides various functions, but has an arms- length relationship with the caller and needs some protection from it. Examples are databases, network stacks, and other services. We don't even have a standard term for this. Special-purpose approaches include talking to the big object over a socket (databases), putting the big object in the kernel (network stacks), and trying to use DLL/shared object mechanisms in the same or partially shared address space. General purpose approaches include CORBA, OLE, Google protocol buffers and, perhaps, REST/JSON. Result: ad-hoc hacks for each shared object.

<comment><USER21> Blaming UNIX for the virus industry is a stretch. A per-user protection model is better than none at all.

<comment><USER22> The anti-virus industry is a result of DOS and Windows _not_ having a unix permission model. Running as the user with highest privileges was the norm.

Now that a unix permission model is the norm, viruses are comparatively gone and replaced by malware that simply tricks the user into installing it. No permission model will help you against this. As a partial result, now we see things like iOS where we remove control from the user, or OS X where we try to make it inconvenient to be duped into giving access.

There are certainly still exploits that don't require duping the user, but the anti-virus industry certainly wasn't established based on these.

<comment><USER7> _" No permission model will help you against this."_

That's not really true. No permission model will be 100% effective, but a more fine-grained permission model might lead to more users saying "Um, no, mysteriously executable pornography, I _don 't_ want to give you my bank records and the ability to email my friends."

<comment><USER23> Like how (non-tech) people pay attention to the permissions required by Android and iOS apps they want to install?

<comment><USER24> Let's imagine that I have privilege grouping sub-users, something like name.banking, name.work, etc. Now my work files can't see my banking unless a window pops up going "Would you like Experimental Thing for Work to have access to name.banking?"

I think being able to explain to the computer how my data is grouped, and access patterns in it, is more natural for users than most of the security models we have today.

It's also much easier to have two copies of the browser load, depending on if I'm invoking it through name.banking or name.general. And much easier to explain to grandma you do banking when you use name.banking and you look at cat photos in general.

Grandma isn't stupid, she doesn't understand how technology work. Making permissions based around how she categorizes her information and how she divvies up tasks is more natural for her than insisting security only work if she understand how computers work.

</comment></comment></comment></comment></comment></comment><comment><USER25> I was heavily critical of the author's original rant about CSS, and my citation of worse-is-better probably at least partially inspired him to write this post ([http://pchiusano.github.io/2014-07-02/css-is- unnecessary#com...](http://pchiusano.github.io/2014-07-02/css-is- unnecessary#comment-1468335855)).

However he completely misunderstood my point to suggest that worst-is-better is a conscious design quality. In no way did I mean that, and I don't believe Richard Gabriel meant that either. Worse-is-better is about the reason certain solutions win in the market; it's about an evolutionary trait, not a design philosophy.

Look at it this way. If there are 100 possible technical solutions to a given computing problem, the ones that solve the problem more comprehensively are naturally going to tend to be more complex, this complexity comes with an adoption cost, and that cost works against the likelihood of adoption. Furthermore, when you are talking about something that solves the scope of problems which CSS solves, there is no way you can just sit down and design a better system, it will need to go through many iterations to solve all the things that CSS solves (which no single human being is comprehensively aware of btw). In order to see that kind of investment a system needs buy-in from downstream users over long a period of time.

So the strawman that the author sets up is the idea that someone is out there selling a worse solution on purpose because of this meme which is simply an observation of how technical adoption markets play out. Of course such foolish people may be out there, but no intelligent developer sets out to create something that is deliberately worse. Rather, each tradeoff is considered in its specific contemporary context of the imperfect information available. Whether a solution gains traction and wins in the marketplace is has nothing to do with the subjective qualities of "worse" or "better", but rather is a confluence of the state of the market at various points in time: how well it solves immediate problems, how well it works with existing tech, how easy to adopt, and of course some amount of hype loosely related to the aforementioned.

What doesn't play a huge role is how ugly the evolution of this tech is going to look 20 years down the line when the entire landscape has evolved.

It's a little tiresome when a young idealist comes into a 25-year-old field (I'm guessing the author is not much older than that himself), pisses on the hard work of thousands of people pushing web tech forward bit by bit over decades, and says it should be replaced wholesale because it's just rubbish, and then when someone tells them that you're welcome to try but you'll never get any traction in that Sisyphean task, he responds that people aren't engaging in a rational discussion.

<comment> grey-area _Furthermore, when you are talking about something that solves the scope of problems which CSS solves, there is no way you can just sit down and design a better system_

CSS has proved an awful system for layout, design and practically every domain it attempts to address over the last couple of decades. Having worked with both for a long time, here's the fundamental difference between HTML and CSS, as I think it's a useful comparison and highlights when worse is truly better, and when it is just worse:

HTML was limited and simple by design, and has gradually improved (the original worse is better ethos)

CSS was broken by design, and hasn't much improved (maybe in a few years with flexbox and grids, maybe).

I don't find it at all surprising that someone thinks CSS could and should be replaced, and I'm skeptical that if the best minds of our generation took another look at it, they couldn't find some far better ways to lay out content than an inconsistent and confusing box model with concepts like floats tacked on to it and lots of module proposals to try to glom on additional layout modes. I can't think of many problems CSS solves well, apart from separation of style/layout and content, even there at present we have div soup for grids instead of table soup - hardly a huge improvement on what went before. Some of the problems it attempts to solve are not even real-world problems and are of its own devise (for example the Cascading Style priorities in its name - <USER2> a bizarre focus for a layout language).

Perhaps the answer is a turing-complete layout language (personally I doubt it), or perhaps it's another more informed declarative one, but I'm quite sure we can improve on it, and the comparison to HTML is apposite, because that has stood the test of time rather well compared to its companion technologies.

 _It 's a little tiresome when a young idealist comes into a 25-year-old field_

We don't live in the best of all possible worlds, and to make it better, we sometimes have to take a step back from a local maximum and look at the bigger picture; that involves listening to 25-year-olds coming up with something better - most of the time they won't, but sometimes they will. If you find yourself not even listening, and more concerned with sunk costs, work already done, and expertise already gained, that's not healthy and not a convincing riposte.

<comment><USER26> "that involves listening to 25-year-olds coming up with something better"

That doesn't involve listening to them, it involves them putting in the work to develop something as a proof of concept, and that proof of concept evolving through feedback and collaboration into something people want to use.

To put it more crassly, people don't stop using something because others say it's shit, they stop using something when there's a better option on the table, and that better option needs to be more than just architecturally improved, it needs to be genuinely useful, and this is what people who twist "worse is better" fail to understand... legacy code sticks around when it's genuinely useful.

And to address the original author... yes, the idea with writing software is to get the job done, but if you want to work on tooling to improve that process be my guest.

<comment> grey-area _That doesn 't involve listening to them, it involves them putting in the work to develop something as a proof of concept, and that proof of concept evolving through feedback and collaboration into something people want to use._

Well I think it's always useful to listen - even if you disagree or think your interlocutor mistaken. Of course as you say ideas are worth a lot less than implementation, but the one point I fully agree with the original author on is this:

CSS is not best of breed, existing for 20 years does not make it good in any sense, and it is a terrible example of worse is better in the original sense. However arguing over "worse is better" is just going to end in arguing about what that vague phrase means, so I won't enter that particular rabbit-hole - <USER3> agree the original author misunderstood or has not encountered the original meaning.

In the case of CSS, what holds back adoption of alternatives is almost entirely browser-vendor inertia and the institutional barriers to producing a better solution, not some technical superiority of CSS, so what I object to in the parent comment is the implication that CSS won because it is technically superior to other layout methods and is complex because it deals with lots of complex domain problems which a 25 year old couldn't possibly fathom. It introduces needless complexity, doesn't even properly address the domain problems (design, layout, grids etc), was badly designed from the start and has become even more complex with age, and I'd argue it has succeeded mostly by riding on the coat tails of HTML.

</comment></comment></comment></comment><comment><USER27> I'm just gonna go full Poindexter and say that Richard Gabriel did try to distance himself from worse is better, at first, but then he veered wildly in the following years between the two positions.

And, the fundamental idea of Worse is Better is so incredibly older than UNIX, even in the field of computer science; John Von Neumann said himself that the Von Neumann machine was a temporary workaround and that a better architecture would quickly replace it.

I live in a near constant fight in the rebel factions of Better and so far, I have to reckon we get constantly massacred by the Empire of Worse.

</comment><comment><USER28> I'm a big advocate of "worse is better" \- in fact I put it in my bio even at the risk of scaring off potential colleagues or employers. The real meaning of "worse is better" is of course subjective and complicated. And as has been pointed out in these comments, "worse is better" is not about creating "worse" software and then marketing it as "better". It is something much more philosophical.

In my eyes "worse is better" is about the mindset of approaching a task. It is about diving right in and learning through production - without being paralysed by the idea of introducing hacks or ugly design. It is the idea that, for the moment, there isn't a need to be worried about covering every edge case or possible failure option. It persuades you to focus on something simple and easy to explain, with a single purpose or intent. It is better to produce something (anything) and see where it takes you.

It also says how important it is to embrace contribution and collaboration. How important it is to, after some threshold, release yourself from feelings of ownership.

But if I had to nail down exactly why I believe "worse" is so successful ("better") it is because those that create "worse" software don't focus on the software - they focus on the idea. From that the software is painfully drawn. The software might suck, but I believe ideas are better. They are more persistant, easily explored, dynamic, and shareable than software. Ideas that are good, simple, and easily taught are far more important than well designed software. That is why they survive.

There are lots of programmers and hackers who don't believe in "worse is better". Sometimes you seen them on HN with a fantastic new programming language (or something) they have designed and built in isolation - perfect in every aspect (at least to them). Nothing quite hurts like their confusion when interest dwindles and their software is forgotten. All they had seen on HN were "worse" links every day, and after years they had provided "better" \- to them it is criminal that it hasn't been picked and gained momentum.

Worse is better is not going away, and I think you can either engage yourself in it as a philosophy, or struggle.

<comment><USER29> "Sometimes you seen them on HN with a fantastic new programming language (or something) they have designed and built in isolation - perfect in every aspect (at least to them). Nothing quite hurts like their confusion when interest dwindles and their software is forgotten."

I suspect you've described Rich Hickey to a tee here. /s

</comment></comment><comment><USER30> The author's Closing Remarks give rather short-shrift to the nuanced thinking Dick Gabriel has contributed to this idea. Gabriel's "Worse is Better" page [https://www.dreamsongs.com/WorseIsBetter.html](https://www.dreamsongs.com/WorseIsBetter.html) concludes with:

"You might think that by the year 2000 I would have settled what I think of worse is better - after over a decade of thinking and speaking about it, through periods of clarity and periods of muck, and through periods of multi- mindedness on the issues. But, at OOPSLA 2000, I was scheduled to be on a panel entitled "Back to the Future: Is Worse (Still) Better?" And in preparation for this panel, the organizer, Martine Devos, asked me to write a position paper, which I did, called "Back to the Future: Is Worse (Still) Better?" In this short paper, I came out against worse is better. But a month or so later, I wrote a second one, called "Back to the Future: Worse (Still) is Better!" which was in favor of it. I still can't decide. Martine combined the two papers into the single position paper for the panel, and during the panel itself, run as a fishbowl, participants routinely shifted from the pro- worse-is-better side of the table to the anti-side. I sat in the audience, having lost my voice giving my Mob Software talk that morning, during which I said, "risk-taking and a willingness to open one's eyes to new possibilities and a rejection of worse-is-better make an environment where excellence is possible. Xenia invites the duende, which is battled daily because there is the possibility of failure in an aesthetic rather than merely a technical sense."

Decide for yourselves."

</comment><comment><USER31> Honestly, I think it's deeper than this. Even today, we have people who intentionally seek out ugly, imperfect designs because they think they work better. We have a cultural idea (at least, I can speak for the United States, hopefully some others will chime in) that "real" work is ugly, gross, and messy. Heck, I even had a friend who chided people who played a particular version of CounterStrike because it was "Too polished". We're measuring in one dimension something that's two dimensional: Work vs. Not work and Beauty vs. Uglyness. We steep in this cultural broth of the idea that "real work is ugly", and then wonder why the tools we decide to do "work" in are "ugly".

</comment><comment><USER32> For the record I think that writing software commercially should only consider the bottom line. What you do in your own time is your business; that's why open source is good for innovation through revolution. Ethics for legal and medical professions is a broken analogy because all of their ethical considerations focus on outcomes for clients/patients, not the details of how their services are executed.

</comment><comment><USER33> "Perfect is the enemy of better"

</comment><comment><USER34> "This 'Worse is Better' notion that only incremental change is possible, desirable, or even on the table for discussion is not only impractical, it makes no sense."

It makes all kinds of sense. Consider for a second the sort-of parable of Chesterton's fence. As G.K. Chesterton wrote:

"In the matter of reforming things, as distinct from deforming them, there is one plain and simple principle; a principle which will probably be called a paradox. There exists in such a case a certain institution or law; let us say, for the sake of simplicity, a fence or gate erected across a road. The more modern type of reformer goes gaily up to it and says, 'I don't see the use of this; let us clear it away.' To which the more intelligent type of reformer will do well to answer: 'If you don't see the use of it, I certainly won't let you clear it away. Go away and think. Then, when you can come back and tell me that you do see the use of it, I may allow you to destroy it.'"

It's basically that whole Spolsky think about why you shouldn't rewrite code from scratch[1]:

"Back to that two page function. Yes, I know, it's just a simple function to display a window, but it has grown little hairs and stuff on it and nobody knows why. Well, I'll tell you why: those are bug fixes. One of them fixes that bug that Nancy had when she tried to install the thing on a computer that didn't have Internet Explorer. Another one fixes that bug that occurs in low memory conditions. Another one fixes that bug that occurred when the file is on a floppy disk and the user yanks out the disk in the middle. That LoadLibrary call is ugly but it makes the code work on old versions of Windows 95.

Each of these bugs took weeks of real-world usage before they were found. The programmer might have spent a couple of days reproducing the bug in the lab and fixing it. If it's like a lot of bugs, the fix might be one line of code, or it might even be a couple of characters, but a lot of work and time went into those two characters.

When you throw away code and start from scratch, you are throwing away all that knowledge. All those collected bug fixes. Years of programming work."

Broadly speaking: you, for ANY definition of you, are unable to design a perfect system at the first go. You will not account for all use cases, there will be edge cases you don't consider, so on and so forth. But it goes further than that: if you want to design something better than C++, you need to understand why so many people use C++. If you want to replace CSS, you need to understand why CSS is popular. If your thinking on the matter hasn't evolved much past "CSS is unnecessary" and blaming a single catchy essay for every decision you disagree with, then instead of writing essays about how everyone else is doing it wrong, maybe you should spend more time trying to understand what everyone is trying to do, why they're trying to do it and what resources they have to do it with. And THEN maybe I'll let you tear that fence down.

1) [http://www.joelonsoftware.com/articles/fog0000000069.html](http://www.joelonsoftware.com/articles/fog0000000069.html)

<comment><USER29> "If you want to design something better than C++, you need to understand why so many people use C++."

No, you don't. You just need to design something better than C++.

"If you want to replace CSS, you need to understand why CSS is popular."

No, you don't. You just need to replace CSS.

Now, having people _adopt_ better-than-C++ and better-than-CSS might take a little bit of the psychoanalysis (marketing?) you propose. But understanding _why_ someone uses C++ is not really relevant at all in order to design a superior replacement.

I assure you, the designers of Java did not really care _why_ people used COBOL for so much banking code, and yet here we are, with Java having supplanted COBOL for much of that work.

Every time someone trots out Chesterton's fence, I trump it with Sturgeon's law.

Edit: heck, an even better example is JavaScript app frameworks. Do you think their designers understand _why_ people programmed in Smalltalk or Swing or VB.NET or Delphi? No. Judging from their approach and idiom, obviously not. And yet here we are.

<comment><USER35> ""If you want to design something better than C++, you need to understand why so many people use C++." No, you don't. You just need to design something better than C++."

And how do you define "better than C++"? C++ didn't get to be as popular as it is for nothing. It got to be as popular as it is because it is a very good tool for solving certain classes of problems. If you don't understand why people still choose C++ for new projects, you're going to have a tough time building something that will change those decisions. And if you think people only choose C++ for new projects because they're idiots, frankly, you're the idiot.

"Everybody is an idiot" is a much less likely hypothesis than "I'm missing something". Before you throw out a popular tool whose appeal you don't understand, you would be well advised to spend some time comprehensively falsifying "I'm missing something". Hence, "If you want to replace X, you need to understand why X is popular."

<comment><USER29> It wasn't my example. But there is no a priori reason why "something better than C++" must be designed by someone with a deep understanding of C++. This holds for anything you might put in place of C++:

\- must someone who designs a car understand why people ride horses?

\- must someone who designs a phone understand why people use smoke signals?

\- must someone who designs a gun understand why people use swords?

</comment></comment></comment></comment><comment><USER36> Isn't twitter also an example of worse is better. Why send the people willing to engage with your argument to twitter then?

</comment><comment><USER10> I always associated worse is better with VHS vs Betamax rather than incrementalism i.e. utility realised > potential utility

</comment><comment><USER27> But seriously, it takes some nerve to write a blogpost _against_ Worse is Better that's on every aspect worse than the paper that originally codified Worse is Better.

Oh wait, no, is this lack of quality justifiable because this content-free 2 minutes read is more efficient and easier to write than a serious exploration of the consequences of whatever the author was ranting about?

<comment><USER37> I'll probably get shadow banned for agreeing with this, but who cares anyway.

The article ignores LEAKY ABSTRACTION. that's all there is to say. Now lets have some marketers tell us why that's a good thing and we can get back on this irony loop, this irony loop, this irony loop.

</comment></comment><comment><USER38> "Worse Is Better" has evolved into a monster.

Originally, it looked like this:

* MIT philosophy: never compromise on correctness, even in bizarre corner cases. Aim for conceptual beauty _to a programmer_.

* New Jersey (Bell Labs) philosophy: comprise on correctness for simplicity or performance.

In 1985, six years before "Worse Is Better" was originally written, the "New Jersey" attitude was probably more useful. Most people, if they wanted to write acceptably performant software, had to do it in assembly. C was less of a leap, conceptually and in terms of average-case performance, than Lisp was. People who'd been writing assembly programs for years could learn how to write performant C. Writing _performant_ Lisp would be much harder. A contemporary Common Lisp executable is at least 40 MB (obviously, that wasn't the case in the 1980s); at that time, 1 MB was a powerful machine. "Worse is better" _worked_ in the 1970s and '80s. If every piece of computing work had to be perfect before it could be shipped, we'd be far behind where we are.

Also, quite a number of the original Unix programs were for natural-language processing (at a level that'd be primitive today) and paper formatting. With the resources of the time, it would've been impossible to get much of that stuff perfectly right anyway.

Bell Labs wasn't full of the anti-intellectual idiots who invoke worse-is- better, lean-startup tripe today. They knew what they were doing. They knew the compromises they were working under. They bet on Unix and C rather than Lisp machines, and they were right. In 2014, thanks to our ability to stand on the shoulders of giants that were built using C, we have machines that can efficiently run code in pretty much any language, so the C programmers _and_ the Lispers have won. At least, on that front.

However, the "worse is better" lesson doesn't apply nearly as well in 2014. We can do about 500,000 times as much computation per dollar as we could in 1991. That's 500,000 times (at least!) as many opportunities for things to go wrong. A bug that happens once per 100 billion operations used to be negligible and now it's often not.

Unfortunately, we have an industry beset by mediocrity, in which commodity developers are managed by commodity business executives to work on boring problems, and low software quality is simply tolerated as something we'll always have to deal with. Instead of the knowing compromise of Bell Labs, "worse is better" has evolved into the slipshod fatalism of business people who just assume that software will be buggy, ugly, hard to use, and usually discarded after about 5 years. Yet we're now in a time where, for most problems, we _can_ affordably do them correctly and, because things happen so much faster now, we often put ourselves and our businesses at serious risk if we don't.

<comment><USER39> It is about economics. The just-good-enough wins against excellence, because it is cheaper. When excellence finally pays of the good-enough competition already was profitable for years and solved five more problems.

What was good enough in the 80s is not good enough in 2014. Our views about good enough changed. For example, security requirements are much higher today.

The question is not if Better or Worse is better. The question is what is good enough?

<comment><USER40> > The just-good-enough wins against excellence, because it is cheaper.

Its not clear to me that this is the case anymore. The whole startup thesis is that a small, excellent team can outperform vastly larger teams of average people. This is the opposite of how it was in the 80s.

</comment></comment></comment><comment><USER41> The font used on this page is difficult to read. I'm running current Chrome on Win7.

[http://i.imgur.com/QB8RJwl.png](http://i.imgur.com/QB8RJwl.png)

note: I checked that screenshot on another machine and it didn't seem so bad.... so maybe this is also something strange with the monitor / res I'm using... still thought I'd mention it.

<comment> rkuykendall-com The same website on Chrome, OS X, Retina:

[http://i.imgur.com/KdvPoEB.png](http://i.imgur.com/KdvPoEB.png)

<comment><USER41> Thanks for taking the time to take a screenie and share it. Looks like I need to investigate why some sites fonts look so bad on this machine.

<comment><USER42> Firefox, Windows 7 - I don't like the text either [http://i.imgur.com/s3V1dwf.jpg](http://i.imgur.com/s3V1dwf.jpg)

</comment></comment></comment></comment><comment><USER43> I agree with the points in 100%</comment>


Microsoft is 2000 times less effective than Google; Yahoo Board seems to be insane - <AUTHOR> http://blogs.law.harvard.edu/philg/2008/02/09/microsoft-is-2000-times-less-effective-than-google-yahoo-board-seems-to-be-insane/

<comment><USER2> I would hardly call Google's interface designers "tasteful."

It seems more likely that they knew they were bad designers so they just went with the simplest possible design.

Yahoo doesn't get enough credit. They are doing some pretty awesome and forward-looking stuff. The reason they're falling behind, I think, is because the "yahoo" brand is so large and complex that it's hard to find anything by going to their site. It probably doesn't help that AOL.com ripped off the design almost to the pixel (I'm extremely surprised there has not been a lawsuit there).

<comment><USER3> I've switched my search from Google to Yahoo, but Yahoo mail still sucks too much to use over GMail.

Also, there doesn't seem to be a Yahoo documents.

If Microsoft want to beat Google, they need to start pushing out on-line document editing, Excel, etc., under the MS brand but through Yahoo infrastructure and internet know-how.

<comment><USER4> I think no matter how hard Microsoft tries to beat Google at their game, it's not going to happen. Google has held the upper hand since day one. It's obvious they know the pressure points to their own company and they sure know what to do when someone thinks about beating them at their own game.

Microsoft is making the mistake of trying to beat giants in one market when they are already a giant in their own. I'm not sure how Microsoft wants to play, but I am certain this isn't going to turn out like a David vs. Goliath.

<comment><USER3> Yeah, I posted the above, but I don't believe that current management at MS has a prayer on executing successfully on anything different or new. I sure that there are factions within MS that viewed the obvious lock-in of Sharepoint as the great white hope that would roll back the internet threat and safely lock the 'intranetwork' to MS. Well, they can forget that, except for a few of the 'large client' sheep.

It seems like any new interesting project is always 'Skunkworks'ed, thinking of XBox, Zune, MS Research - "The Project formerly known as 'Half the World's Smartest Researchers (Being Paid not to work ((At Google)))"', LOL.

I really mean 'why', just why are they bothering with Yahoo? I mean, they will just run it into the ground. The "Next Great Idea" (tm), the next Facebook, the next You Tube, the next Slashdot is probably swiftly exiting Yahoo as we speak.

<comment><USER5> MS Research is completely separate from the product teams. Researchers seem disdainful of product team folks, and vice-versa.

One time over lunch I asked a technical manager about the role of theory in our work. His response: "Remember that time we had a guy with a phD in our group? We wasted so much time on theory and did nothing practical". Everyone laughed, and promptly changed the topic.

Another time I had an interview with their search engine team. I ended up in a fairly heated argument with the interviewer about where innovation comes from. Her contention was that Research should do all the innovating, and throw the innovations over the wall to product teams, and product teams obediently implement. Which I said was... less than ideal. "No hire" =)

Seems to me in Google, product people and theory people are tight, or even the same people. MS's schism approach will never touch that.

</comment></comment></comment></comment></comment><comment><USER6> _The interesting question is why a company that claims to know how to program would pay anything for Yahoo, much less a P/E ratio of more than 60._

Huh? Sounds like someone needs to cut back on the sauce.

 _We can infer from this offer that Microsoft expects its own programmers to be only 1/2000th as effective, dollar for dollar, as Google's._

We _can_ infer that, if we're near the bottom of a Chivas bottle.

 _The chance of a Yahoo shareholder ever getting more than $31/share, adjusted for inflation and risk, seems remote_

Hey, I know a place where you can put money down on such predictions. Good luck!

 _Microsoft is to Yahoo as Time Warner is to (correct answer) AOL._

Except...the purchase was in the opposite direction.

 _despite the fact that the $31/share bid was higher than Yahoo has typically traded since mid-2006_

Here's the thing...if Ballmer logged into his Ameritrade account and started buying YHOO at 10000 shares per second every second until it was all bought up, the share prices would probably hit about 50000 dollars. When Microsoft makes an offer, it's understood that that is equivilent to skyrocketing demand.

<comment><USER7> Likewise, if Ballmer steadily sold Microsoft shares then they'd be worth almost nothing by the time he finished.

1 million * $1 share != $1 million

</comment></comment><comment><USER8> More Greenspun hyperbole:

"Google unseated Yahoo at a cost of about $20 million in financing"

That completely ignores major things such as, oh I don't know, _the Google Pagerank patent_. It isn't like Google just won on simple UI; if their search hadn't worked way better than anything else, they never would have taken off.

</comment><comment><USER9> Microsoft has decided to buy another Microsoft instead of making a Google.</comment>


From Minimally Viable To Maximally Buyable Product - <AUTHOR> http://onstartups.com/tabid/3339/bid/12999/From-Minimally-Viable-To-Maximally-Buyable-Product.aspx <comment><USER2> Yes yes yes!

As companies get big, you'd be surprised at how they e.g. simply make it difficult for their customers to buy stuff from them (Sun for any thing between what you could put on a credit card and "enterprise" sized sales) or burden their salespeople with so much red tape and friction they can't do their job (almost killed Xerox recently and fixing this was one of Mark Hurd's highest priorities when he got the reins of HP).

Make sure you keep doing a good job of this basic blocking and tackling and do everything else you can to make it easy for your would be customers to become real customers.</comment>


Disney's streaming service: all the news and updates on Netflix rival - sahin-boydas https://www.theverge.com/2018/8/5/17649060/disney-streaming-service-updates-marvel-star-wars-shows <comment><AUTHOR> Erm, isn't it already released?

It is being very very heavily advertised on Amazon and its called Disney Life. It offers what appears to be the entire back-catalogue of Disney - from Frozen right through to Steam Boat Willy and everything in between that we could think of. [https://disneylife.com](https://disneylife.com)

Its ok - not great, only ok:

\- Streaming is touchy. It will buffer or just hang from time to time and you have to seek back 1-second then replay to get it to start again.

\- Fast forward and reverse only go up to 5x, and the time on the time-bar does not update, so you have to guess/count-seconds to work out how far you are.

\- App will randomly hang or crash taking you back to the home screen.

Apart from that, its good. One thing I really like is that it has the "behind the scenes" extras that are usually on DVDs but are missing from netflix et al. That is a great addition and value-add in my opinion.

<comment><USER2> The link from the website to the iOS App Store doesn't work and I couldn't find it on the App Store. It also doesn't seem to be available on Roku or the AppleTV. If I had young kids, I would be interested.

</comment></comment><comment><USER3> Disney may be huge, but even with Marvel, Starwars, and Muppets i don't think they are well equipped to compete with Netflix and Hulu. I don't have children, but maybe they'll fill the gap of children's shows that the other services don't provide as well. This could make a successful underdog service in that demographic, a kids streaming service. If that's not their intention, it won't succeed.

</comment><comment><USER4> There's literally no information here.

<comment><USER5> I agree. Disney owns Movies Anywhere and even that little bit of information would be insightful in the context of the article.

</comment></comment><comment><USER6> Wouldn't it make more sense for them to just take over Hulu? They are going to have 60% equity quite soon anyway

<comment><USER2> The "Disney brand" is about content that is at most PG and family friendly. Hulu would be for there less kid friendly content.</comment></comment>