Table-oriented programming (2002) - open-source-ux http://www.oocities.org/tablizer/top.htm <comment><AUTHOR> Voted this up out of pure nostalgia. I remember the "spirited" usenet discussions we had with topmind/tablizer on comp.object. He was a one-man army fighting proponents of OO. There were actually some decent ideas buried in his ramblings about table-oriented programming but he was so abrasive nobody could deal with him. I'd be curious what became of him...

<comment><USER2> When I saw the headline I immediately thought of [http://c2.com/cgi/wiki?TopMind](http://c2.com/cgi/wiki?TopMind)

<comment><USER3> Me too. I binged a lot of the C2 wiki last year and waded through a lot of his spew.

</comment></comment></comment><comment><USER4> I can't believe nobody has invoked Fred Brooks yet, so I'll do it:

"Show me your flowcharts and conceal your tables, and I shall continue to be mystified. Show me your tables, and I won't usually need your flowcharts; they'll be obvious."

 _The Mythical Man-Month_ (1975)

</comment><comment><USER5> Tables are a fine way to explore the testable state space of moderately complex functions where there's natural or explicit discrete points in each dimension / argument. It's easy to see which combination is or isn't tested when it's in a tabular form, vs almost any other approach.

For actually driving logic, it tends to be somewhat user unfriendly unless there's something intrinsically table-oriented in the domain. The best table- oriented program I ever worked with was a disassembler; naturally, machine code (particularly the x86 series) lends itself to tables since unused / reserved opcodes in one generation turn into prefixes in the next.

Tables do make explicit the entire state space, though, and if followed to the logical cross-product extreme, are agnostic to the hierarchy imposed by OOP. But the geometric space explosion of cross-products makes you want to create new abstractions to cover more ground, and you start to lose what tables gave you to begin with.

<comment><USER6> > But the geometric space explosion of cross-products makes you want to create > new abstractions to cover more ground, and you start to lose what tables > gave you to begin with.

What kind of abstractions are you thinking of? ORM?

There is an interesting comparison between tables and s-expression on c2.com that might interest you:

"The average for TOP is higher than es-exp's in my opinion, so they are the better general-purpose tool, especially if complexity of a project grows over time. I rarely see project complexity shrink over time, thus it seems more logical to emphasize the higher end when making a judgment rather than the lower end. If you see dark clouds on the horizon, you should pick the bigger umbrella even though the current rain may be light. -- top "

[http://c2.com/cgi/wiki?AreTablesGeneralPurposeStructures](http://c2.com/cgi/wiki?AreTablesGeneralPurposeStructures)

<comment><USER5> I'm thinking of functions with many arguments: every argument adds an extra dimension to the table. Even if you unwrap the dimensions (e.g. instead of a cube made of 1/2, a/b and x/y, you have a table of a1/b1/a2/b2 vs x/y) you still multiply the state space.

S-exprs are simply a representation for trees, and you can use trees for anything - not necessarily the most efficient way, but trees are very flexible. But trees encode policy: the choice of root and branch determines what's cheap and what's expensive. Tables are agnostic, but they pay for their agnosticism with their dimensionality.

</comment></comment></comment><comment><USER7> The RS/1 statistical system used a table-based approach; it was wonderful! If I ever spend time to design a language, it's going to have "table" as the main non-primitive type, with some "hints" to sallow super speed.

Cool features: tables could be much larger than memory; they were swapped out as needed. Temporary tables would just stay in memory until memory pressure grew too high; then they were automatically spilled to disk.

What in unix are weird-looking files (termcap, I'm looking at you!) were just tables of data.

Unlike SQL table, RS/1 simply let you change tables using a nice editor (or via SQL-like commands).

Also unlike SQL tables, RS/1 tables should be grouped into objects; an XY graph was simply a collection of tables (a data table, a table for options like line color, some ticks tables, and more). Normally you edit a graph using a nice editor, but you could also edit the (documented) underlying tables.

Overall, it was the single most productive programming and data manipulation environment (for it's time) that I've used.

</comment><comment><USER8> One of the rogue work projects I took on once that I'm still proud of was baking Excel tables into a memory-mapped block in a game engine, and having a very lightweight API for reading the table.

That makes it _super_ easy to author state machines using Excel with arbitrary data per state. Super useful and provided a great way for designers to do the game logic in Excel while I focused on the physics or whatever else.

It was also orders of magnitude faster than any other format the studio was using for data - XML was truly disasterously awful, but even decent formats would be doing parsing, translating, copying and memory allocation per node from whatever file format they were using. Compare that to a table that is ready to go in memory after a single fread().

I still wouldn't call it Table Oriented Programming, nor suggested that it is somehow opposed to Object Oriented Programming, but I do have experience to back up how some of the ideas in this article are good.

<comment><USER9> Can you provide more details on how do you baking Excel tables into a memory- mapped block? did you used memory mapped file as in linux? or you manually synchronize between excel and a memory block in game engine?

</comment></comment><comment><USER10> Is there a modern language built on these (or similar) principles? Just curious. I imagine a DSL would be adequate, but it seems we still use SQL and OOP most often, with the exception of array languages. (These days even my array programming is in an OOP language, Python)

Not to say that this is necessarily a better idea, but I find it interesting enough to wonder what analogous things are out there right now.

Aside: I find this a neat example of some hidden knowledge buried in the historical web that could easily have been lost if it weren't for brave internet archivists. Kudos to the internet archive et al!

<comment><USER11> The article claims that the following languages are table oriented in some respect:

"TOP languages do exist in various levels or incarnations of Table- orientedness. These include Xbase derivatives (dBASE, FoxPro, Clipper), PAL (Paradox), Power-Builder, Perl (for certain list types), Progress, Oracle's PL/SQL, and Clarion Developer."

A quick web search shows that all of these are apparently still actively developed and used. I don't think any one is modern in the particular sense I understand your question since, apart from Perl, they were all attempts to create the fourth generation languages that were supposed to take over from structured programming.

</comment></comment><comment><USER12> The one place this style has been handy (for me) was managing gui actions. Imagine some code to save a file. That code should be activated on a few different events, CTRL-S, File -> Save, perhaps a save icon on a toolbar. You want a 4 way associative set. A key event comes in, lookup the action for that event in the table, SELECT action FROM bindings WHERE key=CTRL_S; (or whatever). I didn't really use a database, but it gets the concept across.

This style makes it really easy to dynamically add buttons for actions, verify you've got shortcut keys for different actions, things are hooked up in menus, things like that.

IMHO, it's of limited value. On the other hand, any time you've got several maps that all need to stay in sync something more table like is really nice. A map and it's inverse, several maps all pointing at the same values, things like that.

</comment><comment><USER13> Efficient syntax for set operations and enabling and exposing relational algebra as simple constructs usually simplifies code (I do lot of data transforms at work). It does not require fancy constructs, just starting from the fact that a large category of programs can be expressed succintly with relational algebra and then implementing the clearest and most succint code to implement it.

</comment><comment><USER14> Couldn't you just call Lua "Table Oriented Programming?" Everything is a table, from which you can construct things like an object system.

<comment><USER15> Or even APL, where everything is an array (with an arbitrary number of dimensions). For example, adding two arrays together will add the corresponding elements.

</comment></comment><comment><USER16> Table-oriented programming needs more tables and less code. Think spreadsheets, and systems with functional boxes interconnected by lines. Examples are LabView and Blender game programming.

Incidentally, the box with all the knobs is an art piece by Miller Levy, not a functional device. Here's the original.[1]

[1] [http://www.millerlevy.com/](http://www.millerlevy.com/)

<comment><USER17> We need spreadsheet oriented programming. A _lot_ of people use Excel for all kinds of programming but it gets pretty complicated. Even something as simple as being able to name a column or a cell could go a long way towards improving these Excel programs.

<comment><USER18> Many people, including Microsoft, have tried and failed extrapolate on spreadsheeting towards a more general purpose programming environment, and it turns out to be very hard. A 2D grid of editable cells without a type system makes for a great scratchpad environment, but those features are also a barrier for abstraction.

<comment><USER19> > A 2D grid of editable cells without a type system

That sounds like a big improvement on the model we all use every day: a 1D grid of editable memory locations without a[n inherent] type system.

<comment><USER20> Who uses such a model? Unless you write assembly language?

</comment></comment></comment></comment></comment><comment><USER21> One of the projects that I worked on failed miserably because the leads drank so much OOP kool-aide that they just couldn't conceive of table-oriented techniques when needed.

Updated Requirements dictate that we need to add a field? Just spend a few days adding the same field to 20 different classes and converters!

UI team asks that our REST APIs allow them to filter fields? One of the lead's head exploded because he couldn't conceive how to do that without strongly- typed objects.

</comment><comment><USER22> There was one previous discussion in 2009: [https://news.ycombinator.com/item?id=892163](https://news.ycombinator.com/item?id=892163).

</comment><comment><USER23> I'm wondering why there's no table-based computer language, is there? We have string-based, functional, list-based, object-based. Why not one where conditionals, even arithmetic is a table lookup? Could execute terrifically fast if tables were small enough to fit into memory.

<comment><USER24> It's not quite table-based, but APL [0] uses multidimensional arrays as it's main datatype.

[0]: [https://en.wikipedia.org/wiki/APL_(programming_language)](https://en.wikipedia.org/wiki/APL_\(programming_language\))</comment></comment>


The world's top economists made the case for why we still need English majors - <AUTHOR> https://www.washingtonpost.com/business/2019/10/19/worlds-top-economists-just-made-case-why-we-still-need-english-majors/ <comment><USER2> Most writers aren't even making minimum wage as writers, but we need more storytellers? I'm obviously missing something here...</comment>


CamScanner, a malicious Android app with more than 100M downloads in Google Play - <AUTHOR> https://www.kaspersky.com/blog/camscanner-malicious-android-app/28156/ <comment><USER3> PlayProtect is not detecting and warning users about CamScanner even when it has been removed from the Playstore.

I've tested it via manual scan on PlayProtect as well, no dice. Isn't that what it is supposed to do?

Has anyone ever got any app flagged by PlayProtect? If it's useless, then rather I would disable it than to give it access to all my installed apps.

Google Engineers here, please ping your Google Play team reg PlayProtect.

Edit: More detail.

<comment><USER4> Do you have one of the affected versions installed? The versions since July 30th are not affected (according to [https://news.ycombinator.com/item?id=20826213](https://news.ycombinator.com/item?id=20826213)).

<comment><USER5> I have auto-update turned on, yet I just discovered CamScanner was apparently stuck on an unsafe version from July. Now CamScanner seems to be removed from the play store, yet I had to remove the app manually. Play Protect still thought everything was fine. I have a Google Pixel running stock firmware. I guess it's time for a factory reset.

</comment></comment></comment><comment><USER6> Guess what - this was caused by a third-party ad network: [https://twitter.com/CamScanner/status/1166733219841986561/ph...](https://twitter.com/CamScanner/status/1166733219841986561/photo/1)

<comment><USER7> That is and for many, always an issue. Adverts help pay for content, be that a game or website - people literally make a living that way that it has become a bit of a defacto approach.

But when you are tied to including some code that goes off to a site that you have no or very little control over, you are outsourcing part of your company (web or app) into the hands of another in which, if they mess up. You are the the one that takes all the PR flack.

After all, if somebody slips an exploit into an AD hosted on a 3rd party site and offered up by a reputable AD serving company. Whilst the blame and fault may clearly be with the AD serving company for not screening what they offer. You are the ones that from a consumer and as it also transpires - the media as the one to blame. As we all know, corrections and retractions are always less viewed and eyeballed than the initial drama article based upon a small picture view of the issue/drama, instead of the root cause. Even with the best most respected media sites in the World, such retractions/corrections never get the same attention as the initial article of drama and doom.

That is one problem that even today, still prevails - media does an article with the finger pointing at one direction and the truth, even when it comes out and updated, never tracks as well as the initial finger pointing and is very much the old saying of "if enough mud is slung, some will stick".

{EDIT spelling and below}

With that all said, ad-blocking by the likes of [https://pi- hole.net/](https://pi-hole.net/) is more than just avoiding AD's, it's about privacy and more and more so - security.

<comment><USER8> (sorry to be picky about an irrelevance but this one grates on me. "Ad" is an abbreviation not an acronym or initialisation - so no need to capitalize it as "AD". Same for "app" over "APP". Makes things hard to read for me as it sounds like someone shouting occasional words in an otherwise normal sentence!)

<comment><USER9> I normally wouldn't do this, but it's _initialism_ not initialisation

<comment><USER7> I'm loving such educational feedback - full stop.

</comment></comment></comment></comment></comment><comment><USER10> So what exactly did this malware do most of the time?

In the original kaspersky report it says "For example, an app with this malicious code may show intrusive ads and sign users up for paid subscriptions.".

So how/did it sign up users for paid subscriptions without user interaction? Does android allow something like that? Aren't all apps sandboxed?

In general how is the android sandboxing and permission system nowadays? I'm considering switching back to it from iOS, but reports like this are kinda discouraging.

<comment><USER11> I don't know this particular case, but "malware" seems to be used to describe "adware" these days by some blogs to generate more clicks.

Android is just as secure/unsecure as iOS. Some recent "malware" campaigns targeted both platforms but in general Apple silently removes them while Android gets scrutinized to death.

Edit: to answer your questions, these apps still operate within the limits of the sandbox. Which is maybe a reason the term "malware" should not be used.

<comment><USER12> This is clearly not the case. Not only is Android's permission system more permissive, most Android phones don't get updates as frequently and definitely not as far long as iOS.

<comment><USER11> In modern Android phones, the core system is updated one a month [if needed - which is often the case during the first year]. Android applications (including things like mail and browser) and a large part of the OS is updated immediately via the store.

The permission system is being updated and apps are being rejected for bad user of permissions (check Reddit for the SMS permission stories)

<comment><USER12> And as far as the parts of the OS that don't get updates?

</comment></comment></comment></comment></comment><comment><USER13> Ironically this is right next to "Google just deleted my nearly 10-year-old free and open-source Android app" on the front page. False negatives _and_ false positives.

<comment><USER14> At a sufficiently large scale, even rare events happen constantly.

<comment><USER15> Related news.yc discussion: [https://news.ycombinator.com/item?id=14038044](https://news.ycombinator.com/item?id=14038044)

</comment></comment></comment><comment><USER16> I've been using this app for years and also telling other people to use it, so this sucks.

If anyone else is looking for a replacement there's a Microsoft app called "Office Lens" that seems to do a really nice job and is as safe a bet as anything.

<comment><USER17> It's amazing to me that so few people are not aware of the excellent scanning apps from Google.

They work better, you're not expanding your privacy risk ... and they're free and integrated with Google docs etc.

* namely, Drive Scan and Photoscan

<comment><AUTHOR> Never heard of Google Drive Scan, but I can't find it in the Play Store either?

<comment><USER18> It's built into the Google Drive app, press + and scan. [https://support.google.com/drive/answer/3145835](https://support.google.com/drive/answer/3145835)

</comment></comment></comment></comment><comment><USER19> Just to clarify the headline: the app didn't have malware when most of the users installed it. A recent update added the malware.

<comment><USER20> in regard to iOS:

When tencent bought the iOS version, the "user contract" was grossly changed.

Just uninstall it and use the native iOS Notes app to scan your .pdf documents.

<comment><USER21> Wow, I never knew you can use the Notes app to scan documents.

<comment><USER22> If you add the Notes shortcut to your Control Center, you can hard-press on it and tap Scan Document to very quickly be able to scan a document. It does a really good job too!

</comment></comment></comment></comment><comment><AUTHOR> For the past few days I've been seen spam events in my calendar about "free iPhones" and "webcam girls" \- I couldn't figure out where they were coming from. I have CamScanner installed, so presumably that's the source...

Now, I can remove CamScanner (which is a shame, it's a really good app), but how can I ensure the trojan is also removed?

I tried the Avast AntiVirus app, but it didn't find anything.

What does everyone else do for AV on Android?

<comment><USER23> The calendar thing is probably this: [https://lifehacker.com/how-to-prevent- spammers-from-infiltra...](https://lifehacker.com/how-to-prevent-spammers- from-infiltrating-your-google-c-1837539886)

check your emails

<comment><USER24> I got hit by this exact one(free iphone X) recently, and couldn't find anything in my email.

Surely, that kind of email would just look like spam, so isn't the correct solution for google to just not auto-add calendar events if their source email is spam?

<comment><USER25> Yep, my wife got exactly the same thing. Apparently those entries will appear in your calendar even if the email was sent to spam. You have to configure gmail to not automatically add the entries.

<comment><USER26> This seems like a pretty big oversight on Gmail's part.

</comment></comment></comment></comment></comment><comment><USER27> Does anyone have information on affected and unaffected version numbers? I have a version of this installed, but it's an old one, and may not have updated to the malware one because I disabled automatic updates. (Specifically because I was afraid of this, in fact.)

<comment><USER28> May 22, 2019: 184.108.40.20690522 – safe

June 6, 2019: 220.127.116.1190611 – safe

June 14, 2019: 188.8.131.5290614 – safe

June 16, 2019: 126.96.36.19990616 – unsafe

June 24, 2019: 126.96.36.19990624 – unsafe

July 10, 2019: 18.104.22.16890710 – unsafe

July 23, 2019: 220.127.116.1190723 – unsafe

July 25, 2019: 22.214.171.12490725 – unsafe

July 30, 2019: 126.96.36.19990730 – safe

August 8, 2019: 126.96.36.19990809 – safe

August 14, 2019: 18.104.22.16890814 – safe

August 16, 2019: 18.104.22.16890816 – safe

August 20, 2019: 220.127.116.1190820 – safe

Source: [https://www.reddit.com/r/Android/comments/cwk0y4/camscanner_...](https://www.reddit.com/r/Android/comments/cwk0y4/camscanner_booted_from_play_store_after_discovery/eyc0vin)

<comment><USER29> Any speculation why they would only leave in the malicious code for about a month? Changed their mind? Done without full knowledge? Achieved some high value heist and rolled it back?

<comment><USER30> An update to an ad library is what caused the malicious code in the first place. Presumably either the infected library was updated again or the developers switched libraries.

The developers behind this app did not add any malicious code they wrote themselves. The attack either came from the ad library or the ad library was hacked.

<comment><USER29> If it's the case that it was accidental I feel bad that the app was pulled rather than only vulnerable versions forced off. Although I suppose it would be hard to find assurances that it won't happen again.

</comment></comment></comment></comment></comment><comment><USER31> Rather than disappear it from the Store entirely, it would be nice if Google could leave a placeholder with a warning; at least it would serve an educational purpose.

Also, does the Play Store app have a way to notify users of a banned app that is still installed? I decided to check my wife's phone proactively, but I don't think she would otherwise have had a clue of malware (but has been getting weird and annoying pop-up ads).

<comment><USER32> > Rather than disappear it from the Store entirely, it would be nice if Google > could leave a placeholder with a warning; at least it would serve an > educational purpose.

This would also make the Play Store look bad.

<comment><USER33> Which would also be fitting, wouldn't it? Google missed it and dropped the ball.

</comment></comment></comment><comment><USER34> > So a dropper might be used to install malware that steals banking > credentials or generates fake advertising clicks or signs up for fake > subscriptions.

This is basically wrong, you can't modify a browser or charge someone's card without breaking out of the sandbox.

Worst case they could burn your cellular data or encrypt your photos and such if you gave it permission.

Is there any evidence they maliciously used this or was it probably just in there so they could drop more creepy ad code?

<comment><USER35> > without breaking out of the sandbox.

Every Android Security Advisory I looked at contained at least one often multiple Elevation of Privilegues or straight Remote Code Execution holes - <USER2> Android One smartphone usally gets the updates 20-35 days _after_ the release of the Advisory - I'm the only one in my wider family that even got a smartphone that still receives monthly security updates at all. Most of them are stuck on an old Android version with years old patch-levels. So I doubt this is hard at all. I have no idea if there are public exploits for these issues but they probably exist.

</comment></comment><comment><USER36> So does the ad network just get away with this? Isn't it criminal to spread malware like this? Seems they were in a serious business relation with CamScanner, not some seedy underground place.

Do other apps run the same ad library, do they run the same risk?

</comment><comment><USER37> Maybe Google should pay more attention to their own ecosystem and less focus on embarrassing other vendors.

<comment><USER11> I too wish they should stop using their resources to find security problems Apple should have found themselves.

But I very much disagree this is about embarrassing Apple. In fact, Google is doing them a huge favor.

(The iMessage bug for example could have been turned into a worm and infected ALL iPhones on the planet in matter of minutes if it was found by blackhat hackers instead. Apple should be thankful)

<comment><USER22> Project Zero _is_ doing Apple a huge favor. Google isn't a single organism; Project Zero isn't taking away resources from the Android division. And it's not like Project Zero doesn't look for Android vulnerabilities, it's just that iOS is a much more interesting target from a security standpoint because it's widely considered to be actually secure (not to mention that people actually run the latest version of it).

I think Fuchsia can't come fast enough for an opportunity to break backwards compatibility and catch up with the rest of the world on security.

(I also think that Google needs to put some more humans in the Play Store review process, but as we all know Google despises using humans when they can automate a process.)

<comment><USER11> If we only consider security, Fuchsia is another horrible use of resources. How many Android issues are due to kernel bugs?? Of those, how many are due to Google using is own heavily modifed version of an outdated kernel?

Agreed on humans, Google needs more humans and fewer robots.

</comment></comment></comment></comment><comment><USER38> Can an "app with Malware" access my Google Authenticator credentials? Or read my screen while I am viewing them?

<comment><USER30> Google auth credentials: not without root (which malware might get if your device isn't up to dage ons security patches)

Read screen: not without permission, even then not on protected screens, unless the malware has gained root access

If the app doesn't get root, the Android sandbox should protect you sufficiently against attacks on the key store of Google Authenticator.

However, if you copy the code to the device clipboard, the malware might read the code from there.

</comment></comment><comment><USER11> > CamScanner was actually a legitimate app, with no malicious intensions > whatsoever, for quite some time. It used ads for monetization and even > allowed in-app purchases. However, at some point, that changed, and recent > versions of the app shipped with an advertising library containing a > malicious module.

IMO, this is more a legal matter than a technical one.

Google needs to sue this company, not engage in a whack-a-mole game with their AI algorithm and useless scanner.

<comment><AUTHOR> That's a little presumptuous - isn't it likely that CamScanner was somehow compromised? This could happen in the source code or in the build and release pipeline.

<comment><USER39> Then it is a police matter...

<comment><USER11> Yeah, we can't just remove the app and think that would fix the issue.

Otherwise this is bound to happen again.

</comment></comment></comment></comment><comment><USER40> Is this just a non issue on iOS? If so, why?

<comment><USER41> I had the CamScanner app on my iPhone for quite some time, then uninstalled when I launched it and saw (IIRC) Chinese text appear. I'm assuming that ownership changed around that time, and if the Android and iOS apps have the same owner, I wouldn't trust it either.

An iOS trojan would have slightly more limited impact, but if (for example) you gave the app "Access to your Photos" in order to save something, the app would still be able to read all of your photos and potentially send them back to home base as it chooses.

<comment><USER42> I guess its time to disclose transfers and sales of mobile apps and browser extensions to end users.

</comment></comment></comment><comment><USER43> Malicious code found in ad networks, but I still get downvoted every time I complain that a given website was unusable by me because after trying to enable some (hopefully safe) javascript domains it still wouldn't render in a usable form.

There is a problem here. Trying to protect yourself from third-party malware running on your machine breaks half the damn web because of our over-reliance on javascript frameworks and ad networks. We have to find a better way.

</comment><comment><USER44> I am not surprised that CamScanner included a malicious advertising SDK, considering Exodus Privacy shows it has 17-19 trackers: [https://reports.exodus- privacy.eu.org/en/reports/search/com....](https://reports.exodus- privacy.eu.org/en/reports/search/com.intsig.camscanner/)

</comment><comment><USER45> Anyone remembers when the android play store wasn't ranked by how much revenue google got out of it? Remember when even google employees put out their own apps free of ads like solitare etc. But all these free, ad-less apps mysteriously either disappeared from play store or got sent to the very bottom of every search query?

</comment><comment><USER46> So what do they do?

Revoke the app and developer account of that guy who wrote the free transit- mapping app for Montreal.

Google: hypocrisy on a colossal scale.

<comment><USER47> On the other hand, remember that guy whose complaint about Google termininating his developer account "for no reason" made the HN front page a couple of weeks back? [https://medium.com/@tokata/how-google-play-terminated- a-deve...](https://medium.com/@tokata/how-google-play-terminated-a-developer- for-no-reason-e4d760e9f472)

According to his blog post, his "anti-piracy system" used "custom techniques including dynamic bytecode loading from a local app resource", the exact same technique used by this malicious code to hide from detection.

</comment></comment><comment><USER48> "Scam Cancer", a friend once called it. I suppose he was right.

</comment><comment><USER49> Nice advert by Kaspersky in partnership with CamScanner

<comment><USER50> I seriously doubt that CamScanner wanted that kind of publicity. As for Kaspersky, they are like gun makers, selling you a false/real sense of security depending on who you ask.

</comment></comment><comment><USER51> Blogspam of [https://www.kaspersky.com/blog/camscanner-malicious- android-...](https://www.kaspersky.com/blog/camscanner-malicious-android- app/28156/)

(Forbes contributor posts are almost always blogspam)

<comment><USER12> As if Kaspersky itself isn't spamming.

 _To make sure you never find yourself in such trouble, use a reliable antivirus for Android app and scan your smartphone from time to time. (The paid version of Kaspersky Internet Security for Android scans automatically.)_

<comment><USER52> Inbound marketing is literally the opposite of spamming</comment></comment></comment>


Construction and Application of Learning Petri Net - <AUTHOR> https://www.intechopen.com/books/petri-nets-manufacturing-and-computer-science/construction-and-application-of-learning-petri-net <comment><AUTHOR> Free PDF download with better typography is available.</comment>


ADA Lawsuit spurs DOJ to kill Berkeley on-line courses on YouTube - <AUTHOR> http://www.forbes.com/sites/prestoncooper2/2016/09/21/department-of-justice-wages-war-on-free-education/ <comment><USER2> _sigh_ I think this is a bit of overreach in this particular case... In the end, it's not like Berkeley is keeping additional bits hidden... either they weren't created or weren't part of the original. I'm kind of saddened by this approach from the DOJ... it would be one thing to advise that _future_ content contain said changes, but to do so retroactively and impose potential fines is ridiculous.

</comment><comment><AUTHOR> analysis of [https://news.berkeley.edu/wp- content/uploads/2016/09/2016-08...](https://news.berkeley.edu/wp- content/uploads/2016/09/2016-08-30-UC-Berkeley-LOF.pdf) and [http://news.berkeley.edu/2016/09/13/a-statement-on-online- co...](http://news.berkeley.edu/2016/09/13/a-statement-on-online-course- content-and-accessibility/) builds on [http://www.cato.org/blog/adas-assault- web-turn-congress](http://www.cato.org/blog/adas-assault-web-turn-congress)</comment>


The factory saved by slime - <AUTHOR> http://www.bbc.co.uk/news/av/business-43344467/how-slime-turned-around-the-fate-of-a-glue-factory <comment><USER2> (video)</comment>


Kibana forked to support SQL and cross index joins in Elasticsearch - <AUTHOR> http://siren.solutions/kibi-a-kibana-fork-for-data-intelligence/ <comment><USER2> Kibi – Data Intelligence Browser is a really excellent fork of Kibana for Data Intelligence use cases. Check it out at [http://siren.solutions/kibi-a-kibana- fork-for-data-intellige...](http://siren.solutions/kibi-a-kibana-fork-for- data-intelligence/)

</comment><comment><USER3> Wish to stress this is a friendly fork, forced by the fact that the plugins APIs are not our yet. Looking forward to your feedback</comment>


SSH Commands / Tricks - <AUTHOR> http://blog.urfix.com/25-ssh-commands-tricks/

<comment><USER2> One of my favorites, from: [http://www.phrack.org/issues.html?issue=64&id=4&page...](http://www.phrack.org/issues.html?issue=64&id=4&page=2)

See: An almost invisible ssh connection

         ssh -T user@host /bin/bash -i

This connects you to a box with no TTY allocation. If someone types 'w', they will not see your connection.

<comment><USER3> Okay, you've done the trick, now what's the reveal? How do you readily detect someone who has started their shell without TTY allocation?

<comment><USER4> if you are running sshd on port 22 this will show you all connections going into it

        sudo lsof -i :22

you can then reverse what people are doing based on the pids lsof gives you.

[edit: using ps ax | grep sshd also works but you can't see where they are connecting from. [+1 daten]]

</comment></comment></comment><comment><USER5> Seems to be down.

Text only cache: [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://blog.urfix.com/25-ssh- commands-tricks/&hl=en&strip=1)

<comment><USER6> My cache got it also, and it's easier to read: [http://viewtext.org/article?url=http://blog.urfix.com/25-ssh...](http://viewtext.org/article?url=http://blog.urfix.com/25-ssh- commands-tricks/)

</comment></comment><comment><USER7> I know its a small difference, but I am happy this title doesn't imply I don't know these tricks yet, as some articles of this kind tend to do.

<comment><USER8> That's an excellent litmus test on whether there is likely to be anything actually valuable there. On the other hand, I wonder how much more traffic they might get from the people who visit just to affirm, "I do too know them..." :-)

</comment></comment><comment><USER9> This list is missing sshuttle: <https://github.com/apenwarr/sshuttle>

sshuttle is a transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin access. Works with Linux and MacOS.

Avery Pennarun is a Hero :)

<comment><USER10> Wow, this is fantastic, thanks! I was looking for something like this a while ago and the closest I could find was transocks, which is Linux-only, not overly stable, not actively maintained, and TCP-only.

<comment><USER9> sshuttle is currently TCP-only i remember seeing some people discussing about UDP, and DNS forwarding on top of sshuttle but it hasn't gotten very far.

</comment></comment></comment><comment><USER11> They may want to change their DB username and password ASAP.

<http://blog.urfix.com/wp-config.php>

I can see their config in plain text.

</comment><comment><USER12> Also, use

      ~.

to terminate a stalled session.

<comment><USER13> The tilde-escape offers significantly more than just termination, actually. Hit '~?' for the available escape sequences:

      Supported escape sequences:
        ~.  - terminate connection (and any multiplexed sessions)
        ~B  - send a BREAK to the remote system
        ~C  - open a command line
        ~R  - Request rekey (SSH protocol 2 only)
        ~^Z - suspend ssh
        ~#  - list forwarded connections
        ~&  - background ssh (when waiting for connections to terminate)
        ~?  - this message
        ~~  - send the escape character by typing it twice
      (Note that escapes are only recognized immediately after newline.)

If you open the command line (~C), another '?' shows its available commands:

      ssh> ?
      Commands:
            -L[bind_address:]port:host:hostport    Request local forward
            -R[bind_address:]port:host:hostport    Request remote forward
            -KR[bind_address:]port                 Cancel remote forward

</comment></comment><comment><USER14> The site is currently down. Why is it so hard for most blog software to do the most basic thing of the web: delivering static content?

<comment><USER15> Because the author made the same mistake so many Wordpress users do which is going absolutely crazy with add-ons. I managed to get the page to load after about 3 minutes and I can count at least 8-9 add-ons he is using that are sucking up tons of server resources. The owner of this blog would be extremely well served by removing unnecessary add-ons and installing something like WP Super Cache to serve content significantly faster and lower the server load.

For security he might want to relocate the admin login URL as well since he still has it set to /wp-admin/ .

<comment><USER16> What additional security does relocating the admin login buy?

<comment><USER17> Like running sshd on another port (to stay on topic), it doesn't make the service more secure against someone who knows it's there, but it makes it less visible to automated scripts probing the standard location for known bugs.

</comment></comment></comment></comment><comment><USER18> cool list, thank you!

Previous ssh fu posts:

<http://news.ycombinator.com/item?id=1536126>

<http://news.ycombinator.com/item?id=874666>

<http://news.ycombinator.com/item?id=1624010>

<comment><USER19> <http://news.ycombinator.com/item?id=1923170>

</comment></comment><comment><USER20> I have been looking for solutions to some of these things forever:

21) Have an ssh session open forever

autossh -M50000 -t server.example.com 'screen -raAd mysession'

Open a ssh session opened forever, great on laptops losing Internet connectivity when switching WIFI spots.

24) Transfer SSH public key to another machine in one step

ssh-keygen; ssh-copy-id user@host; ssh user@host

This command sequence allows simple setup of (gasp!) password-less SSH logins. Be careful, as if you already have an SSH keypair in your ~/.ssh directory on the local machine, there is a possibility ssh-keygen may overwrite them. ssh- copy-id copies the public key to the remote host and appends it to the remote account's ~/.ssh/authorized_keys file. When trying ssh, if you used no passphrase for your key, the remote shell appears soon after invoking ssh user@host.

25) Copy stdin to your X11 buffer

ssh user@host cat /path/to/some/file | xclip

<comment><USER21> 25a) Copy stdin to clipboard on Mac

ssh user@host cat /path/to/some/file | pbcopy

</comment></comment><comment><USER22> When I first got my netbook, I sometimes set up an ssh media server to stream music from my main computer to my netbook like this:

ssh user@host cat /path/to/music-collection | mplayer

</comment><comment><USER23> > i think that is the fastest and best way to migrate a DB to a new server!

Except that your mysql password is now in your history?

<comment><USER24> Just put a space before you execute the command, then it doesn't get saved in history. Alternatively, delete it from your history file as the other commenter suggests.

<comment><USER25> I don't have a box to test this on right now, but you might have to set HISTCONTROL=ignorespace for that to work.

<comment><USER24> At least under ZSH (on Ubuntu), I don't appear to have the HISTCONTROL environment variable set and yet it still ignores anything prepended with a space.

</comment></comment></comment></comment><comment><USER26> If you're on OS X, you can get ssh-copy-id through homebrew. (And if you're on OS X and not using homebrew, go install it now: <https://github.com/mxcl/homebrew> )

<comment><USER27> It's clunky. How is it better than compiling for yourself or using Apple- blessed MacPorts?

<comment><USER26> Compiling it yourself takes a lot more work than `brew install ssh-copy-id`.

Here's a pretty good expression of the main complaint I've heard about MacPorts:

> _The system [homebrew] is much better than MacPorts, the idea is that for > example, Mac OS X comes with python installed. Brew will try to use the > default python installation instead of trying to make it's own in > /usr/opt/whatever ... so, homebrew premise, is to respect the Mac OS X > installed packages and use them to it's favor + respecting the Mac OS X > structure ( don't re create a whole new structure like fink and mac ports )_

\- [http://stackoverflow.com/questions/189912/what-package- manag...](http://stackoverflow.com/questions/189912/what-package-manager-do- you-prefer-for-mac-os-x)

An added bonus is that things tend to install way faster because it's not compiling all of this stuff that OS X came with.

<comment><USER27> Last time I tried to use it I was burned when it came to removing packages. Sure, I can remove them by hand, but then what good is my _package management system_? The hairier installation is, the more configuration files it creates and modifies all over the system, the more urgent is the need for reliable management system. And there are packages that can't not write all over the system. SSH is one. Sage's another.

</comment></comment></comment></comment><comment><USER28> Useful post!

Does anyone know: Is it recommended to mount a directory via sshfs? My idea: Mount whole server filesystems into /mnt/servers/<server_ip> ... and then conveniently work with it using desktop tools.

Can it be done? What are the downsides to that?

<comment><USER29> The biggest thing to remember is that any command you run will be in a local context. For example, if you want to do things like updating a SVN repo that's located on the server you've mounted, you should SSH directly into the server and perform it. Otherwise, your _local_ SVN software will try to read in tons of files FROM the server to establish changes in the checkout before it can even try to commit. This can be very slow!

<comment><USER30> ^^Very good point.

On OSX with MacFuse and SSHFS, I've done plenty of remote work before on LAN servers and "internet" servers. It definitely works, but is slow. But for being able to open up a "local" file in Vim/text editor and then save it, the only time you are hitting the network is during the save and that can be slow.

Transmit 4 integrated this functionality into their FTP client, auto-mounting of SSH connections, but it definitely seems more crashy than MacFuse to me.

<comment><USER31> If remote editing vim is your _only_ requirement, it should be noted that up- to-date versions of vim will handle scp://, as in "vim scp://hostname/file_to_edit". (Emacs users have Fish) (you should already have ssh keys setup)

<comment><USER32> Thanks for that. You've just removed 90% of my use cases for opening an actual shell on the remote server.

I've been using vim for a decade or more. I guess it's a salutary lesson for experienced users. I should read the Changelog more carefully when upgrading.

</comment></comment></comment></comment></comment><comment><USER33> One cool application of ssh port forwarding missing from the list is <https://github.com/progrium/localtunnel>

It lets you temporarily give a behind-the-firewall web server a public, port 80 URL.

<comment><USER34> I use

      ssh -D9999 email@example.com

And now I have a local SOCKS proxy running. I just have to change the proxy configuration in my browser using SOCKS4a at localhost:9999 and I can surf as if I were on remotehost

<comment><USER35> This is really useful. And if you do

      ssh -ND 9999

it doesn't open a shell.

This may stop you from accidentally shutting down your tunnel thinking it's just another ssh session.

</comment></comment></comment><comment><USER14> There's a little typo in item 5:

"Will allow you to mount a folder _security_ over a network."

I guess the author meant instead:

"Will allow you to mount a folder _securely_ over a network."

</comment><comment><USER36> github does some impressive backend work with SSH - I was amazed when I read about their architecture <https://github.com/blog/530-how-we-made-github-fast>

</comment><comment><USER37> Interesting stuff, but can you clip the number from the title, please?

</comment><comment><USER38> > When ssh is the foundation of your security architecture, you know things > aren't working as they should.

Rob Pike

[http://interviews.slashdot.org/article.pl?sid=04/10/18/11532...](http://interviews.slashdot.org/article.pl?sid=04/10/18/1153211)

<comment><USER39> If you read the context, this isn't really a specific criticism of ssh, but rather a general criticism of Unix's network model (or lack of it). Maybe we should all be using Plan 9, but as we're not ssh helps a lot.

<comment><USER38> I know, I'm a long time plan9 user, I know what it _could_ be like.

</comment></comment></comment><comment><USER40> 26\. $ ~<Ctrl-Z> # suspend current SSH session

Very useful.</comment>


Ask HN: Could the back-end language influence the success of a Web startup? - <AUTHOR>

Let's assume we have two (or more) versions of a given Web application written in different programming languages--no bugs or difference as far as the user is concerned.<p>Would one version be more prone to success over another one? <comment><USER3> This is one of pg's theses about startups -- one that he bet heavily on when he became an investor. And the first essay that had a significant audience.

<http://www.paulgraham.com/avg.html>

I'm surprised that conventional wisdom has flipped at HN. Is C++ now considered just as good a language for web startups as Python or Ruby? Really?

This feels quite eerie. I've felt the "decline of HN" posts were a bit overblown but this really shows, at a minimum, how the community has little to do with its origins any more.

<comment><USER4> I don't think you can attribute it to a "decline in HN", I think it's better attributed to the rise of a whole stack of languages, frameworks and software heavily optimized for web development, and the decline in hosting costs for any platform.

Today you can spin up an EC2 box for pennies an hour, even with Windows, and push a new build live or publish a new site just minutes later - <USER2> different to 16 years ago.

</comment></comment><comment><USER5> If your assumption were true I'd guess it wouldn't make any difference. The problem with your question is the assumption that the two versions would be the same - unless one was a copy of the other or both were copies of a third. The original language or framework has a lot to do with how you look at a problem. A painting done with watercolors will look very different from done with oils, even if the artist and scene are the same. Someone might counter this argument by pointing out Heather Jansch's driftwood sculptures of horses, which are remarkably made of bronze - but most of the time the choice of tools and materials has a lot to do with the result.

</comment><comment><USER6> I'm a big fan of rapid prototyping in Perl - not because I think it's a more appropriate solution, but because it's the language _I'm_ most productive in while in "make it up as I go along" mode (and the language I enjoy random hacking in most). If I'm not going to write a spec before I start coding, I'll get to proof-of-concept stage very quickly using Perl. So long as you remember to _always_ throw the first one away and plan to rewrite it, getting something working _fast_ is a great advantage - even if only to allow you to fail fast - I'd rather give up on a weekends worth of Perl hacking that revealed no-one else cares about the problem I'm trying to solve, than a weeks worth of careful design spec and carefully considered system architecture and code structure.

So long as you admit to yourself when you've got a quick-n-dirty hacked together dog and pony show, I think the "best" _initial_ back-end language is the one that you can get a MVP up and running and generating customer feedback most quickly. Even if you _know_ you need a multi-cloud-auto-scaling no-sql- memory-cached auto-sharding super-service to support your 10,000 simultaneous users, you don't need to build all of that until you've got demonstratable traction... You _certainly_ will be better off with a single-threaded-maxed- out-at-8-users prototype, and getting real customer feedback early.

Once you've proved the problem is worth solving, _then_ do your massive-scale system architecture, and choose the ongoing backend based on that.

</comment><comment><USER7> Stackoverflow's answer: [http://stackoverflow.com/questions/341993/is-django- developm...](http://stackoverflow.com/questions/341993/is-django-development- faster-than-asp-net-for-small-medium-size-apps) A technical manager's comparison: [http://kurtgrandis.com/blog/2010/02/24/python-django-vs-c- as...](http://kurtgrandis.com/blog/2010/02/24/python-django-vs-c-asp-net- productivity-showdown/)

Python/Django wins! I've also heard anecdotal evidence of a .Net killing a person's startups because of the difficulty of development.

I was trained in Python/Django and am now working in ASP.NET/C#. I've opened my mind to it, and can get stuff done, but I always feel like it would be faster & more elegant to do it in django.

</comment><comment><USER4> The one more prone to success is the one that has a better person or team leading it to success, regardless of what it's built on. I can't even imagine a scenario where users actually _care_ about the underlying stack, especially in any significant quantity.

With web apps the languages are all doing much the same thing anyway - they're taking data from a database and shoveling it on to pages. They're all going to suck and hurt at massive scale, they're all going to be worse at _something_ than some other language, it's going to be hard to find _awesome_ people for anything, and harder still to find awesome people who have previous experience solving the problems you face, most of which probably won't even be platform/technology related.

</comment><comment><USER8> If every other aspect of the applications (including the teams behind them) are identical, then the language/framework which is the most suited to developing new ideas and features is the one that will be most successful. For example, if you were using (to pick an extreme case) Lisp and COBOL, the Lisp version would have the advantage because new features could be implemented in a DSL suited specifically to the task, while the COBOL application would take a lot of work to extend.

In real life, of course, the differences aren't this large and are usually overshadowed by some other differences (eg, competence of the team, overall architecture of the application, marketing.. etc) and the language difference advantage may be negligible in comparison.

</comment><comment><USER9> That is like asking if the brand of spark plugs will effect the sales figures of an automobile. There are so many other factors more important than the backend programming language that it doesn't bear measuring. To name a few: marketing, financing, leadership, team...

</comment><comment><USER10> The major thing that will influence the success of your Web startup is if you have fun making it.

So you need to choose a language that is fun using, that will let you prototype things quickly and that you feel comfortable with. This language for me is JavaScript and so far all the other alternatives have been just a pain to deal with. Node.js is just fun and simple as it should.

So if at the end you have a code-base that is not fun to work with, it will probably be hard for you to fix bugs and add features.

Stick with a language you love and it will influence the success of your startup.

<comment><USER11> A little off-topic: Doesn't it bother you that with Node.js, a lot of the basic functionality needs to be coded (even with a framework like Express), while a framework like Django basically offers almost everything that you need? I really love the simplicity of Nodejs, but sometimes I just want to get things done instead of reading source code and trying to figure out how something works.

</comment></comment><comment><USER12> I dont think languages differ most in prospects for success _after_ you've reached functionally-complete-and-relatively-bug-free stage. The biggest difference is how do you get to this stage.

For a medium-to-big sized web application it would take you years to implement it in asm ;)

A language with a good web 'community' and great framework can be quite a big boost in getting your 1st version out to the users.

Also, many times, the choice is not so much between the tech but rather between the teams (i.e. when looking for outside help with development) in which case the tech matters less the people's ability to predictably hit the target on time and budget (talk to prior customers).

When doing internal development, if your team knows any web language well then thats what they should be using. On the other hand if the one they know is something like cold fusion I'd say - switch ;)

If you do switch, keep to the open source stack, linux, apache/nginx, mysql. Again, there are quite a few people advising postgre over mysql, but I'd say it depends on how your team knows them both. if you are new to db, then you might as well start with postgre, but if you already know mysql, stay with what you know.

Bottom line, stay with what you know unless what you know reeeally suck for web dev, in which case switch. I'd recommend Ruby on Rails, or if you allergic to Ruby - Djungo ;)

</comment><comment><USER13> Which version took longer to write? Which version has fewer SLOC (I'm using SLOC here as a proxy for code complexity)? Weigh those two factors, then choose the winning language accordingly.

I'm oversimplifying, but I believe the point is an extremely important one. We've all heard the startup lore that David-sized startups beat industry Goliaths by being much more nimble than the lumbering giants they're competing against. If you're a software startup, your engineering tools are your sling and stone: if your tools are good and you can wield them with expert precision, you'll be able to iterate more quickly, make your users happier, and outpace the competition sooner.

Yishan Wong has written an excellent essay about the importance of tools:

[http://www.algeri-wong.com/yishan/engineering-management- too...](http://www.algeri-wong.com/yishan/engineering-management-tools-are- top-priority.html)

</comment><comment><USER14> The short answer is no. The only exception I can even think of in extremely rare cases where you program something in a language some company would not want to use and may potentially not acquire you for (which for most web languages it's not an issue), it should not dictate how successful your application is in terms of users, revenues, growth, and/or overall outcome of the company itself. You may run into scaling issues, maintenance problems, ease of training and transitioning new employees to code base or language as need, etc... but for most things, it wouldn't make much of a difference.

On the other hand, if you're asking flow of code, nuances of particular languages, available libraries, ease of hiring people, etc... to help grow what you're building, then it goes back to the age old language war debate.

<comment><AUTHOR> What if you hire developers to maintain the code? Doesn't the more readable syntax affect the developers' performance?

(Honest question, not trying to start a programming language flame war.)

<comment><USER14> There are good coders, great coders, and just a bunch of awful ones. There's a difference in being able to code something that works, and something that works brilliantly, and even better at scale. That said, readability and good commenting in coding and documentation should apply in any language.

In Python for example, there's kind of a (mostly) default way of doing it. In other languages, not so much. But that doesn't mean the company culture can't push for something like this (a standard, at least to the extent in which a language permits doing so). Developers performance is more base on how they like working in a language (better to find _true_ language agnostic developers), culture fit, personality, etc...

If you're outsourcing, that's a totally different set of traits and number of things to look for than if you're hiring in house (which I would recommend for the core team and in general anyway; hiring in house that is).

</comment></comment></comment><comment><USER15> The one that was not written in BrainFuck would be significantly easier to add features to.

</comment><comment><USER16> I think it influences success, but predicting that influence... is not easy

<comment><AUTHOR> Right. Let's imagine that Facebook was written in Perl, YouTube in Ruby, and Twitter in PHP, do you think they would still be successful?

<comment><USER16> Facebook and YouTube yes. I am unsure about twitter.

<comment><USER17> Could you please explain?

<comment><USER16> For facebook, considering how often stuff is broken.. I Think perl or php would've done a fine job.

For youtube, I think the pull is uploading / watching videos online, and it just doesn't have anything to do with the language they picked.

For Twitter, I'm not sure how it's successful in the first place, but I do feel like there was a lot of enthusiasm in the ruby community, simply because they were based on ruby. So if they picked say php, would they have had that early cache of users? I don't think so.

</comment></comment></comment></comment></comment><comment><USER18> I would argue this has more to do with the developers familiarity of the language which would dictate speed of the initial build and speed of iterations.

</comment><comment><USER19> A ideal language for startups requires three attributes:

Rapid application development

Open source distribution

Performance/scalability

</comment><comment><USER20> Probably not, but one scenario which might make a difference is if the language used is disclosed to users. Fans of that language might hold up that site as an example of "See what this language can do?!", which might attract other fans of the language to the site who might otherwise not visit. See Twitter in the early days as an example (both good and bad) of Ruby/Rails, which brought a technical crowd to the site, who are great early adopters.

</comment><comment><USER21> It depends on scalability, easiness to modify and adjust to changing web.</comment>


Ask HN: Coding Mistakes = Bad Coder? - <AUTHOR>

Hi,
I want to know whether other HNers have experienced something I experience on quite a regular basis - as I am coding I will very often overlook something obvious and make a very silly mistake. These are almost always resolved immediately, usually with a thought similar to 'how could I be so stupid?!'. What makes this worse is that it happens with stuff I knew really well as well as stuff I'm not so familiar with.
What I worry about is that this might indicate a lack of skill, or perhaps even more fundamental than that, a lack of talent.
I feel I have talent in programming because it seems to come easily to me, I  have flashes of insight on occasion, and my brain seems to work well in the 'gear' of programming, but this possibility is just totally eating away at me, especially since I want to one day work somewhere I'd be happy, or found a startup myself - if these 'top tier' roles require me to be talented, what if I'm not?
I wonder whether it might be indicative of tiredness, or just not being in the right 'head space' for coding at the time, but I seem to experience it even when I'm 'on the ball'.
Another possible explanation is that I am so focused on a particular part of a problem that my brain remains in auto-pilot at effectively the wrong level when I go to perform some other task.
Okay, so perhaps this is a little vague, so to summarise - do you guys ever experience making silly mistakes when coding then quickly recovering? If not, why do you think I do, and do you think it is an indictment on my ability as a coder?
Thanks! <comment><USER2> _do you guys ever experience making silly mistakes when coding then quickly recovering?_

Yes.

A good coder isn't one who doesn't make any mistakes -- everybody makes mistakes. A good coder is one who writes code in such a way that mistakes will be detected before the code ships (via compiler warnings/errors, static analysis, assertions, tests, et cetera).

</comment><comment><USER3> This is absolutely normal. A significant amount of what everyone does is done wrong the first time, no matter how careful you are. "Just get it right" is not sustainable, no matter what effort you put out. I think that the usual estimate is about 10%. As in about one line in 10 initially contains some typo, syntax error, thinko, etc.

The key is to set things up such that these mistakes are caught and fixed before they hurt anyone. If you want to learn a lot about how to do this, I highly recommend reading _Code Complete_. Yes, I'm aware that it is a tome. However it is a worthwhile tome that is worth reading and re-reading until you've incorporated it as practice.

<comment><AUTHOR> I've got a copy and will definitely read through it. I've already gained a great deal of pleasure despite having only read a small part of it so far.

</comment></comment><comment><USER4> Absolutely. The best programmers I know make mistakes constantly, but have developed ways of working that ensure they get found early.

For some people that means using TDD, for others (like me) it means semi- formally deriving code and running checks during writing.

So no, making mistakes while writing is not a measure of programmer quality.

<comment><USER5> > The best programmers I know make mistakes constantly, but have developed > ways of working that ensure they get found early.

That's what I do. You don't make the same mistake twice in the same section of code: sometimes the code is wrong, sometimes tests are wrong, never both.

</comment></comment><comment><USER6> >> 'how could I be so stupid?!'

This reaction, or something similar, is very telling. I'd hazard a guess that having that response is indicative that you in fact do have the right mindset to be a programmer. I'd be more worried about someone who just shrugged it off with a 'programming is hard' or had no self-doubt.

Or perhaps I'm just convincing myself, because I make spleling and syntax mistakes constantly while programming and 'stupid' is always the first word that comes to mind once they're caught.

</comment><comment><USER7> What matters isn't so much how often we make mistakes, but how we react to them - which includes making prompt fixes just as much as admitting to the team that we actually made a mistake.

Especially if it's a "silly" mistake.

In a development context, I'll often find that a problem that seems to just generate pure static in my mind for the first 5-10 min that I think about it will often "solve itself" in the course of the next coffee break, subway ride, or (if the company I'm working for has enough common sense about human nature to allow for it), mid-day nap.

By contrast, it's those alpha-geek types who basically seem to be -never- able to readily admit a mistake of their own (yet continually grate on others for their, like as not far lesser mistakes) that I find far more intractable to work with that those who are just a bit inexperienced, or absent-minded.

</comment><comment><USER8> The only coder who does not make any mistake, is one that doesn't code anything.

Since - as you say - you recover quickly, that's a good trait, and a good sign, and an important ability for a coder.

</comment><comment><USER9> The true mistake is the one you do not correct.

Testing and code review should give you the opportunity to do so, among others. Also, there's always a trade off between bullet proof and time to market.

</comment><comment><USER10> My version is write less code. It doesn't always work, but it is usually a misunderstanding of the domain ( which is a function of no specs).

</comment><comment><AUTHOR> thanks all, I can't tell you how much these comments provide relief on this subject!! :)</comment>


Red Hat wins Texas showdown - <AUTHOR> http://www.newsobserver.com/2010/05/01/462093/red-hat-wins-texas-showdown.html <comment><AUTHOR> This is especially sweet for me, not more than a few days ago I mentioned this very company trying to shake down TrueTech about 10 years ago :)

Props to RedHat, at least some companies are standing up to this bullshit in stead of paying them off so they have a bigger warchest to go after the next target.

</comment><comment><USER2> Ugh. The least we could do is prevent companies who don't produce software from litigating on software patents. This "IP Innovation" place is just a patent troll.

<comment><USER3> Nice idea in theory, but easy for the trolls to work round by producing some trivial piece of software, I'd have thought.

</comment></comment><comment><USER4> "Both companies sell the Linux computer operating software, a cheaper competitor to Microsoft's Windows."

Most large organizations pay about the same in support for their Linux servers as they do in Windows.

<comment><USER5> You know, I don't believe that is true. Why? Because I work in a mixed Windows and RHEL world. Licensing from MS is steeper than RHEL.

<comment><USER4> Shrug. We own a few thousand licenses for each, but if you're experiences are different, that's cool. Either way, the point I'm making is that most business who use Linux use it because it's a great server OS.

<comment><USER5> It is a great server OS.

</comment></comment></comment></comment><comment><USER6> This is nice to read and all, but I'd be curious to know exactly what patents they were litigating over.

<comment><USER7> Groklaw has the story here, <http://www.groklaw.net/article.php?story=20100430223358785> , with plenty of back-story links, including search for prior art. One of them says: _The patent is for "user interface with multiple workspaces for sharing display system objects"_</comment></comment>


Build your portfolio by working on interesting projects with mentors - <AUTHOR> http://www.zyring.com

<comment><USER2> How much does it cost? Everything on the website seems very vague. The premise is interesting though.

<comment><AUTHOR> We haven't locked down the pricing structure yet but we will be offering a discounted membership for early adopters.

The idea is that everyone needs a lot of practice to get good at a technology.

While courses usually give you the theoretical and conceptual knowledge, you usually don't have ways to put those learnings into practice through real world projects.

We envision Zyring to be more like lab than a classroom such that you will build relevant products and technologies that will help you grow your skills or transition to a new career.

So here is the step by step of how it works:

1- Get matched with a mentor. 2- Introductory meetings with your mentor to determine your knowledge gap and how you will develop the projects in your track. 3- Review collection of curated material from experts in the field. 4- You work with your mentor to create a real world project. You will meet regularly with your mentor to get feedback, help, and direction. 5- You release and demo your work and put it on your portfolio. 6- If you choose so, companies from that track will be invited to view your portfolio and offer you job opportunities.

</comment></comment><comment><USER3> Are you open for online learning ?

<comment><USER4> Yes, Zyring will be primarily online, unless you choose to meet with your mentors in person.

Our primary focus is on hands-on projects, not so much teaching you how to actually do the basics. So our collection of resources will be curated from the web as we believe there is an abundance of premium level education material already online for free.

Does that answer your question?

<comment><USER3> Thanks, that sounds good. I subscribed, let's see how it goes</comment></comment></comment>


Resurrecting the CDC 6500 Supercomputer [pdf] - <AUTHOR> http://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=7912160 <comment><USER2> I found this part of the article interesting in its "spareness":

> Final assembly was quite challenging because you have to put all of the > resistors and diodes in one side and then try to slide them across and into > the right hole on the other side. It's a rather tedious process, but it > works.

That description seemed to echo "cordwood construction" for those modules, but I wanted to know if this was actually the case. The best I could find was this image of a CDC 6600 logic module:

[https://upload.wikimedia.org/wikipedia/en/thumb/6/64/CDCcord...](https://upload.wikimedia.org/wikipedia/en/thumb/6/64/CDCcordwood1.jpg/300px- CDCcordwood1.jpg)

...cordwood construction.

From what I understand, such modules allowed for greater part densities (and probably better airflow for cooling), but at the cost of repairability: Since they were made with thru-hole components, soldered on one side, if a component in the middle of the board failed, it was a very time consuming task to unsoldered all the parts on one side to be able to separate the halves to repair the module.

<comment><USER3> Gah I used to absolutely hate to disassemble those for parts. But they were very cheap because everybody else hated them too and at the local flea market there was a guy selling those 5 for 2 Guilders, hard to resist.

Also, the remaining legs would be super short, on the order of 2-3 mm if you were lucky.

</comment></comment><comment><USER4> _It's challenging to keep the memory modules running. They consist of a woven mat of core memory with fine wires running through the cores to read and write the data bit that was stored in each core. It's difficult to repair the core memory because everything is so small:

Each thing that looks like it might be a core is actually four cores on edge. Each core has five wires going through it and they're all suspended by the mat of wires that go through the cores._

It's funny to see "everything is so small" \-- these are giant compared to lithographically formed semiconductor memory. But it's not exactly wrong either. The parts are small enough to challenge the human sensorium and motor control, yet still large enough to tempt interaction using your own eyes and fingers.

<comment><USER5> I purchased a... sheet? Block? of 1024 bits of core memory that came from a Soviet computer, and it was hand-woven. I have a hard time picturing people hand-weaving this core memory, and I'm guessing his core memory is smaller than the stuff I've got. Absolutely amazing.

<comment><USER6> The story was that CDC had the densest cores (5 mil?) made at what was termed the Hong Kong core house.

</comment></comment></comment><comment><USER7> I'm using this machine remotely sometimes, when it works. I'm incredibly grateful that they provide this service for interested individuals.

What was most fascinating to me was seeing how BASIC was one of the languages available. What was even more interesting was how similar this implementation is to those available on the micros of the 80's like the Commodore 64. I could pretty much just start typing away and it just worked.

In contrast, I still haven't gotten any Fortran code to run.

</comment><comment><USER8> I'm really pleased that there are people doing this kind of stuff. It's awesome to see.

> The pins were manufactured by AMP, which was still in business. They had > taper pins in gold or tin, but not in the silver that was required for the > CDC 6500. With a bit of convincing, negotiating, and LCM+L's promise to > purchase 50,000 pins, AMP agreed to produce a limited run of silver pins:

Can anyone say why silver pins are needed?

Silver seems to me to be the worst material for a connector.

<comment><USER9> Silver-plated contacts are fairly widespread in use, e.g. better XLR connectors, some Fastons, Hartings etc. use them. They are unproblematic with contact designs that scrape the natural oxide layer off. Mixing platings may prevent this mechanism from working properly, resulting in bad contact.

<comment><USER10> Yea I think because of the softness you couldn't switch to gold only partially or it'd wear exceedingly fast. It sure about other metals though.

</comment></comment></comment><comment><USER11> I highly recommend a visit to the Living Computer Museum if you find the time. I had a few hours to spare on a Seattle visit last summer and Bruce was happy to show me the CDC 6500 and his other work.

</comment><comment><USER12> As a CS student at Michigan State in the late 70s I have fond memories of FORTRAN, COBOL, and assembler programming on the 6500.

It was interesting to see many of the design principles from that mid-60s system show up in RISC designs in the 80s and beyond.

<comment><USER13> My first exposure to a machine bigger than a 6502-based home computer was a Cyber at the University of Lowell (MA). Not sure the model number, ?600. In 1984 the freshman CS classes were in Pascal, on print terminals. I think my year was the last to use that machine; the following year it was replaced by a VAX 11/780 running VMS.

</comment></comment><comment><USER14> FYI: link opens a pdf</comment>


Ask HN: Submit via /submit, or via bookmarklet? - <AUTHOR>

Just curious how people submit article.  Other than an "Ask HN:" type of post (like this one), everything I submit is done via the bookmarklet.<p>The backthought to my question is that if bookmarklet use is predominant, a way to cut down on spam/junk submissions would be to not allow submissions with links to be posted any other way. <comment><USER2> The spammers would switch to submitting via the bookmarklet, surely? (If they don't already.)

<comment><AUTHOR> My guess is that they wouldn't. Too difficult to automate easily, as it requires actually reading something on the site, grabbing the bookmarklet, etc.

In my experience a lot of these types of submissions are highly automated. Break the automation even slightly and the junk submissions drop significantly.</comment></comment>


'Citizenfour' Reveals Existence of Second NSA Whistleblower - <AUTHOR> http://www.hollywoodreporter.com/news/nyff-edward-snowden-doc-citizenfour-740060 <comment><USER2> What is really needed are _politicians_ having the courage to stand up. If the material of the Snowden revelations alone are not enough, then nothing will be.

<comment><USER3> The problem seems to be that the politicians are so used to lying themselves, they don't mind when they're lied to. In Washington, lies are currency.

</comment></comment><comment><USER4> This article seems to make a huge deal out of everything and I feel like it may be exaggerating a little. That said I don't know the details very well, could anyone provide more insight or link to a more reliable source of additional information?

<comment><USER5> Bruce Schneier mentioned his notion that there is a second whistleblower back in July:

[https://www.schneier.com/blog/archives/2014/07/nsa_targets_p...](https://www.schneier.com/blog/archives/2014/07/nsa_targets_pri.html)

<comment><USER6> The film confirms that explicitly; it shows Greenwald giving the name of the second leaker to Snowden (whose jaw drops).

<comment><USER7> Have you seen the film, or have you read somewhere, and then, where?

<comment><USER6> Confirmed in numerous reviews, including the one linked to right up top.

</comment></comment></comment></comment></comment><comment><USER8> NSA has had whistleblowers before Snowdwen so this is not surprising.

<comment><USER9> it had exactly two, and neither leaked classified documents

</comment></comment><comment><USER9> this has been known for a few months if you've been paying very close attention: [http://deep- state.tumblr.com/post/91320197853/confirmation-t...](http://deep- state.tumblr.com/post/91320197853/confirmation-that-a-second-non-snowden- leaker-is)

this is a subject i study nearly obsessively, though

<comment><USER10> Why does it seem like such a remote possibility that Laura Poitras would be letting Jacob Appelbaum have access to the Snowden documents when the two of them have worked together on post-Snowden NSA reporting?

An example: [http://www.spiegel.de/international/world/the-nsa-uses- power...](http://www.spiegel.de/international/world/the-nsa-uses-powerful- toolbox-in-effort-to-spy-on-global-networks-a-940969-3.html)</comment></comment>


What it's like to be a statistical super minority in tech - <AUTHOR> https://swizec.com/blog/statistical-minority-tech/swizec/7794 <comment><USER2> > Imagine doing that to a black person. "Dude whaaat you're black!? I know > this other black person! Do you know them? Let me go get them, you two can > talk about being black"

First of all, white people in America do actually do this, and (I'd imagine) it's as annoying and awful as it sounds. Second of all, it's not a great idea for white people in America to compare their "suffering" to that of blacks. African-Americans were enslaved for centuries here, brutalized in every way you can think of, basically treated as total subhumans until roughly 50 years ago and sometimes they still are.

So, yes, it's very stupid that people think you know everyone else from Slovenia. But maybe there is a better way to frame that.

<comment><USER3> I think his point is that people in the "progressive world' and tech scene are routinely being taught (rightly so) to NOT to treat minorities like this. But annoyingly, the same attitude doesn't exist towards people from Slovenia.

Comparing suffering in general is a terrible practice, as it literally looks at people as unequal.

<comment><AUTHOR> I can only speak for my experience, but I'm sure it happens to all micro minorities. People don't have those same reservations because their excitement at your uniqueness overrides their training about minorities.</comment></comment></comment>


Show HN: EMU – A JavaScript WYSIWYG Wiki - <AUTHOR> http://apelab.com/emu/ <comment><AUTHOR> Runs on the latest Internet Explorer, Safari, Mozilla or Chrome. iPhone is not fully supported.

This version stores user data in the browser's local storage. The final version will have a server component so you can share data across multiple devices.</comment>


Tesla on Autopilot Slams into Stalled Car on Highway, Expect More of This - <AUTHOR> https://www.forbes.com/sites/lanceeliot/2019/05/26/tesla-on-autopilot-rams-into-stalled-car-on-highway-expect-more-of-this/#7e2c1acf4fe5 <comment><USER2> Of course I expect more of this with more actual distance driven - but still, the end result is impressive (driver "walked away with minor bruises").

The more I drive nowadays, the more I think the driving conundrum is unsolvable, autonomous or not: the proclaimed low risk appetite is in contrast to actual high risk appetite.

</comment><comment><USER3> It's difficult to evaluate these systems by looking at individual failure cases. Yes, manufacturers must learn from these and improve the systems; however, it's not clear what would have happened with no assistance system in use. Ideally we substantially reduce the total number of incidents. It's difficult to see incidents humans could have easily prevented happen (and these get a lot of press) but is it a greater good or greater harm? I think these systems are inevitable and will continue to improve safety for everyone on the road (not just Tesla, but all the driver assist options). Humans are poorly suited to drive vehicles--they don't have a sensor suite well suited for that or sufficient situational awareness. [https://en.wikipedia.org/wiki/Motor_vehicle_fatality_rate_in...](https://en.wikipedia.org/wiki/Motor_vehicle_fatality_rate_in_U.S._by_year#/media/File:US_traffic_deaths_per_VMT,_VMT,_per_capita,_and_total_annual_deaths.png)</comment>


Robert Elder Software Linux Operating System - <AUTHOR> http://blog.robertelder.org/robert-elder-software-linux-operating-system/ <comment><USER2> Linux from Scratch is amazing. In 2002, I built an LFS system and used it for a semester and a half. I got tired of saving all my ./configure flags and switch to Fedora for a bit. I truly learned to appreciate package management afterwards. :-P

Today I'm a Gentoo/Funtoo users, which is sorta like LFS with package management. I've had to do a lot of work with embedded systems and Linux servers in my career, and I feel like using LFS for nearly a full school year in University really helped me understand Linux fundamentals.

</comment><comment><USER3> Hm. I wonder if the bash patching is actually necessary - a syntax failing command like '|foo' still goes into the history, so you could pick it up from there, maybe via a prompt command. [https://github.com/nvbn/thefuck](https://github.com/nvbn/thefuck) seems like kinda-sorta prior art for this.

(and if I'm wrong and/or the bash patch just makes things lots easier, then I'd love to see it posted somewhere people who know the bash source well can see if they can help turn it into a real feature, because custom error handlers seem as awesome as custom completion handlers)

<comment><AUTHOR> I tried very hard to create the feature I was looking for without changing the source, but it just wasn't possible. I went through 3 or 4 prototypes, and eventually decided to just change bash itself (which was a good call in hindsight). I've had to make a few more change since too.

The source patch is located at

~/.fop/patched-executables/bash-4.3.30-post-patch-call-python-hook.patch

is has been applied after the LFS bash patch.

This patch is extremely sloppy and breaks certain things, but it does what I need for now. The way it works for bash commands is before handing a line of input off to be processed, it calls an external python hook which decides whether that line of input should be ignored or not, gives the hook a change to perform it's own custom behaviour (such as print an error message).

<comment><USER3> Ah, I was thinking about "let it fail with the normal error message, and then print an explanation" \- that way people learn to recognise the real error too for when they take the training wheels off.

(I checked, even malformed lines like '|foo' go into the history)

<comment><AUTHOR> Yeah, there are a few situations where it's a difficult call between getting them used to the 'real' environment vs holding their hand and telling them "bash: syntax error near unexpected token `|'". If I end up modifying it too much, then they start learning an alternate thing that isn't portable knowledge, but in this case I think it should be OK. I would make sense to possibly have a graduated progression where you expose them more and more to the real horrors of using the command line. I guess I'll see how it evolves.

Another couple reasons I patched bash: Being able to detect when users use tab completion and using the up key to check history. Those are 2 massive productivity enhancements, and I wanted to created modules where I can verify that they used these.

</comment></comment></comment></comment><comment><USER4> A patched up system to provide a learning environment for newbies? I may not need it, but I'm a fan.

</comment><comment><USER5> Robert Elder is such an interesting guy. If you haven't seen his "one-page CPU", definitely check it out. [http://recc.robertelder.org/](http://recc.robertelder.org/)

</comment><comment><USER6> There is also levinux: [http://mikelev.in/ux/](http://mikelev.in/ux/)

</comment><comment><USER7> td;lr

Has patched versions of bash and nano to fit in with the author's intention to provide a learning tool. Designed to run under virtualbox, not as a traditional install. The .ova image includes training material.

</comment><comment><USER8> also check slitaz.org

</comment><comment><USER9> I can't see any valid argument for going through the hoops of an LFS in the authors article.

For educational purposes it's acceptable but still less effective than simply creating an educational environment on an existing distro.

Acceptable only because you won't have as much exposure and therefore security maintenance won't need as much of your time as it would in a distro used for servers or clients.

Still though, my point is that there are very little valid reasons to build your own distro these days. To distribute a certain set of tools and defaults you have the option to base your distro off of Debian or Ubuntu for example. Fedora has great options for making "spins" of their distro.

And the things the author mentions as custom bash and custom nano for example, those things could just as easy be in a virtual environment using aliases, cgroups or a number of other features available in any Linux distro or shell.

Let's call it what it is, three dead trolls had the right of it; "setting it up is half the fun". That's exactly what this project was for the author. A fun but largely pointless exercise in setting up a Linux distro.

New distros should bring something more unique to the market than just a toolset. A properly made package manager, albeit a major change, should easily be deployed on any distro.

Most distros even have well developed support for custom kernels, as long as you package according to their guidelines.

<comment><USER10> "A fun but largely pointless exercise in setting up a Linux distro."

When it comes to using C keep in mind a lot of developers are interested in lower-level interactions--perhaps at the hardware level. There is probably value in creating simplified, isolated environments that can test certain features in a VM.

"For educational purposes it's acceptable but still less effective than simply creating an educational environment on an existing distro."

How is it less effective? If anything the author now knows more about setting up a full environment and can tailor make a minimal setup to showcase some specific features. These minimal setups can then be hosted in a VM preconfigured for students.

Just some thoughts. I've never done LFS or taught C programming. Though I do use C often and enjoy the language, warts and all :)

<comment><USER9> Sorry but I don't see it.

>How is it less effective?

It's simply overkill and insecure to not use an established distros patch and package management.

The most effective thing is to create packages, or if you want some larger modifications a "spin" in fedora language.

I can't see any reason why you'd be restricted by packages. You can deploy your own compilers, your own shells, your own init system if you want. You can deploy patched kernels as long as you follow packaging guidelines.

It's smarter to spend time on packaging guidelines and internal yum repos than to build everything from scratch.

</comment></comment></comment><comment><USER11> This may be a useful learning tool for the author. For a "newbie" ubuntu/fedora or any mainstream distro is a better choice because of the abundance of the support information. With the customized basic tools this even hurts beginners as they get used to things not part at standard environments.

Overall this is a project born dead if its true intention is to be a useful tool for the beginners.</comment>


Ask HN: How do you define a good engineer? - <AUTHOR> I was wondering why companies judge candidates mostly based on the ability to solve whiteboard CS questions within a short timeframe and under pressure? Why don't we judge good engineers purely based on what they've built in the past? Or their ability to build great things, not to crack meaningless whiteboard problems? Isn't it the main goal why a company would want to hire engineers? To build great stuff? Then why don't we judge them based on what I just said? <comment><USER2> The whiteboard CS questions are probably favored as they require very little effort on the part of the interviewer and off-load the responsibility of making a hire decision to the stated problem rather than the interviewer's professional judgment.

The trend now seems to be to judge people based on whether they use the same tech stack as the hiring organization.

<comment><AUTHOR> Which defeats the purpose of hiring good folks who have the ability to build amazing things. Why do we have a hiring process in the first place if the current evaluation techniques aren't meant to solve the actual need? Companies hire engineers just to have more employees?

</comment></comment><comment><USER3> An engineer by definition is somebody who has completed a university course in engineering in a specific discipline. As a practising engineer they demonstrate their skills by having a solid grasp of all applicable principles in their field and being able to apply them to the design of solutions to specific needs and problems.

A computer science education does not make one a software engineer. Just like mathematics and physics knowledge is only the foundations for engineering knowledge. Knowing how and when to apply that knowledge and being familiar with the body of pre-existing practices and standards is the key to being a competent engineer.

</comment><comment><USER4> In an ideal world, whiteboard CS question are usually a good way to discuss implementation strategies, possible issues with suggested solutions, or where the initial text of the problem might have some scoping issues. It would also help to understand how you would integrate in the team by considering hints and discussing pro/cons. Most of the time it does not work, because it is very hard to find a short problem where the solution is open to discussion, constraints are unrealistics.

Willingness to learn and use new/old tools, engineering teams usually already have custom tools in place for historical purpose, most of them could and should be improved, but first it is primordial to know why they are in place in the first place.

This is usually quite hard to gauge, but can be discovered through conversation.

As software engineer it is very hard to trust a candidate based on what is said by the candidate, keyboard is easy to get a grasp of, stack overflow is only a click away. It is very easy to be a code monkey, it is slightly harder to be a good software engineer.

When looking for an answer for your code issue on stack overflow, do you pick up the most praised answer directly ? You should analyze its cost of integrating it in your code, do you understand it enough to debug it ? maybe the solution requires a library, and said library could become a liability for your application.

A lot of people can pretend to be a developer, integrating a new member in the team is quite costly ( HR process, hardware procurement, software procurement, training, political cost ), hiring someone for her/his trial period is not quite that simple.

From my point of view, a great recruiting process should ( disclaimer: never tried such process from on end or the other ):

\- First phone contact, description of responsibilities, discussion about experience. \- Online test should require around 20 min of coding of something that would look like an (n-queen problem, sudoku solver, boggle, chess game file verifier ... ) \- On site interview to discuss implementation of online test \- use of dummy code for review, how such code could be improved. \- Discussion one of the past issue that the engineering team has encountered, how the candidate would solve such issue, bouncing back the constraints and impact on other part of the product that the team is maintaining.</comment>