An update on attempted man-in-the-middle attacks - <AUTHOR> http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html

<comment><USER2> IE is killing it too, and, as this post points out, so is Mozilla.

Sign a Google Mail certificate for Iran? Fuck you. You're done.

In the medium term, I think a lot of HN people should also take a hard look at CONVERGENCE.IO. For now, though, it's heartening to see the real power behind Internet trust (hint: it's not Verisign and it's not the IETF) taking this seriously.

<comment><USER3> It's heartening but it's also not. Surely there have been many other cases of invalid certs being granted for lower profile sites, perhaps by this very same CA, without any of us ever hearing about it. And surely the granter of one of those is still considered valid within many browser/OS configurations. But because this was an invalid Google cert the CA gets shut down.

It kind of highlights the difficult problem of when to decide to blacklist a CA in the current model.

And for clarity, who/what do you think is the real power behind Internet trust? I've been thinking about it for five minutes and can't come up with a good answer.

<comment><USER4> Browser vendors, perhaps?

<comment><USER5> And OS vendors. And whoever configures the computer. You buy a computer that was made in China, and it has root certs already in there (thanks to either Microsoft or Apple, or the shop who sold it, or the guys who assembled it - who knows?). Chome / Safari uses the system certs. All good, right?

</comment></comment></comment></comment><comment><USER6> DigiNotar's mother company Vasco finally released a press statement.

[http://www.vasco.com/company/press_room/news_archive/2011/ne...](http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx)

Just incredible: They were hacked and they knew it, then forgot to clean up a certificate the hackers generated.

      On July 19th 2011, DigiNotar detected an intrusion into
      its Certificate Authority (CA) infrastructure, which
      resulted in the fraudulent issuance of public key
      certificate requests for a number of domains, including
      Google.com.

      Once it detected the intrusion, DigiNotar has acted in
      accordance with all relevant rules and procedures.

      At that time, an external security audit concluded that
      all fraudulently issued certificates were revoked.

      Recently, it was discovered that at least one fraudulent
      certificate had not been revoked at the time.  After
      being notified by Dutch government organization Govcert,
      DigiNotar took immediate action and revoked the
      fraudulent certificate.

      The attack was targeted solely at DigiNotar's Certificate
      Authority infrastructure for issuing SSL and EVSSL
      certificates. No other certificate types were issued or
      compromised. DigiNotar stresses the fact that the vast
      majority of its business, including his Dutch government
      business (PKIOverheid) was completely unaffected by the
      attack.

Maybe directly, certainly not indirectly.

<comment><USER7> FF nightly builds also block the PKIOverheid CA which signs the certificates for key Dutch government websites and services (DigiD). Mozilla is going to have a fun time with Dutch users/Dutch Government/DigiNotar

<comment><USER8> My understanding is that what Mozilla is going to ship will not block PKIOverheid. See <https://bugzilla.mozilla.org/show_bug.cgi?id=682956#c17>

</comment></comment></comment><comment><USER9> Do we really need all those Certificate Authorities that are trusted by the browser? I remember 10 years ago Verisign would spend time verifying a business digging through legal documents, addresses, company officers, notarized docs, etc. Nowadays I'm supposed to trust a bunch of fly-by-night operations issuing certificates for a dollar and a song.

<comment><USER10> There are two sides to that, right?

You're building a new startup in (whatever) Bulgaria. Funds are low, but you want to protect your users by using TLS/SSL. That's easy today, but your 'Think of the good old days' line is kind of killing that option. I know that in my early 'put something on the net' days I didn't pay for a certificate because it was just too expensive.

Nevermind that the process you seem to expect doesn't scale internationally and that I seriously dislike the US centric bias anyway (too much power in one country, without the privacy laws I consider basic standard).

</comment></comment><comment><USER11> What we need, I think, is for browsers to display the CA as well as the URL. As in, 'DigiNotar certifies that you are connected to gmail'. This won't wholly solve the problem, but it will a) broaden the knowledge that CA's actually exist, and thus the problem of trusting them and b) provide some reputational disincentive to being a bad CA.

Unfortunately chrome seems to be headed in the opposite direction, removing the URL bar.

<comment><USER12> Click on the padlock, and it tells you all of that.

eg "The identity of this website has been verified by Thawte SGC CA."

<comment><USER11> Thanks. However since it didn't even occur to me to do that, it doesn't seem likely that many less technical people will do it.

<comment><USER13> Less technical people will _never_ understand, much less care, what a CA is. It's hard anything explaining the concept of a URL!

<comment><USER11> There are lots of people between 'a HN reader' and 'your grandmother'. There will always be people who don't understand what a CA is; but the more people who do, the more pressure there will be for them to do their job correctly.

Also, they don't need to understand the technical details. If every time they go to their bank it says 'connection to your bank certified by verisign', and then one day it says 'certified by <someone else>', then a cautious person will be suspicious, even if they are completely nontechnical.

<comment><USER14> There are much better ways to notify users than trying to convince them of the value of monitoring their bank's CA. The browser could simply keep track of the cert and notify the user if it changes unexpectedly. This doesn't require the user to understand anything new, and it still works in the case that the fraudulent cert is signed by Verisign.

</comment></comment></comment></comment></comment></comment><comment><USER15> It's a shame that the only real protection against rogue (or compromised) CAs is still to have a whitelist directly in the browser.

For Google, this was easy as they control both their domains and their browser, but for everybody else who isn't maintaining a browser, they'd have to fall back to solutions like STS which, don't work if the first connection a user sees is already man-in-the-middle'd

</comment><comment><USER16> If you want to verify that you no longer support Diginotar CA, this should give you a warning: <https://www.diginotar.nl/>

<comment><USER17> I get redirected to a non-ssl page ( <http://www.diginotar.nl/Default.aspx> ) instead, no warning? (Chrome)

<comment><USER18> I got a warning on Firefox, but Opera redirected to <http://>.

<comment><USER19> Safari 5.1 warns.

</comment></comment></comment></comment><comment><USER20> Wow, the security features Chrome used to nullify the attack were just implemented in June. I wonder if that was a reaction to another incident like this, or if it was just good foresight?

<comment><USER2> They ship one of the Big 4 browsers and run the Internet's most popular mail server (and thus biggest TLS target). They're uniquely poised to do things like this.

<comment><USER21> _the Internet's most popular mail server_

It is my understanding that gmail is dwarfed by both Hotmail and Yahoo! Mail.

</comment></comment></comment><comment><USER22> The amazing thing is that:

1) it doesn't happen more often

2) that anyone noticed

Its clearly early days. If they had impersonated a download server, they could have got users to download a spiked copy of the browser itself

<comment><USER23> There's also the possibility that it does happen often and no one notices, of course.

<comment><USER24> Makes me wonder how you'd approach the "how do I find bad certs" problem.

You'd think that an entity which, say, scrapes a large portion of the Web on a regular basis ... might be able to detect such things.

Meanwhile, there's CertWatch <http://certwatch.simos.info/> and The Convergence Project <http://convergence.io/>

</comment></comment></comment><comment><USER25> The (partial) solution to this problem is very well known and is already implemented by SSH and several other packages that rely on public cryptography: 1) When user visits a _new_ site, the certificate is presented to the user for inspection. 2) On subsequent visits, the site's certificate is compared to the one stored in the browser cache. If they are the same, then the connection is made silently. If there is difference, then the new cert is presented to the user for inspection.

The only problem is that this would kill user experience for 99% of the users who don't care about security in the first place. Thus, browsers need to do some clever UI tricks (e.g. color the thingy in url bar in a different color, etc.) to indicate potential problem to the user yet make it less intrusive.

The bottom line is that the fault is not on the SSL/x509. This infrastructure is not perfect but there is nothing better even in the design. The fault is on the browser developers who are not trying to protect users.

<comment><USER3> See tptacek's comments from this thread on the earlier post to see why this may not be a great idea:

<http://news.ycombinator.com/item?id=2938870>

</comment></comment><comment><USER26> Question: This I believe is a serious issue, but what is the best way to 'reach' out to majority of users in a country?

Should/would google display this blog link on top of every google service to alert users in Iran, regardless of browser?

My thought is this blog may not even reach out to majority of users, till they get affected by it unless it is 'broadcasted'.

</comment><comment><USER27> Anyone know a way to remove DigiNotar as a system root CA in OS X? I spent a few minutes struggling with Keychain to no avail, and couldn't Google my way to useful help.

<comment><USER28> Keychain -> System Roots -> Search for DigiNotar -> Right click delete.

Assert it has been removed by navigating to <https://www.diginotar.nl/>

<comment><USER29> Did you try that and it really removed the CA?

Or is it supposed to remove the trust only but keep the entry?

<comment><USER28> It removed the entry completely from the Keychain, I am on Lion for reference.

Sanity testing by loading the homepage over HTTPS results in a certificate warning on all browsers (Firefox redirected to HTTP).

<comment><USER27> Right-click delete is not an option on Snow Leopard, for some reason.

</comment></comment></comment></comment></comment><comment><USER30> This seems like a very expensive, targeted, specific attack. The perpetrators will likely succeed (or have already succeeded) at breaking into their intended target.

Someone high-profile in Iran is probably going to get screwed as a result.

<comment><USER31> That does not necessarily need to be the case.

I don't know how the CA in question works, but for many CAs it's sufficient to be able to receive mails at the postmaster address of the domain in order to receive a certificate.

So basically you only need to find a single CA that uses this techniques and which uses a DNS server vulnerable to cache poisoning. Probing all of the CAs may be a little bit of an effort, but it's something even a single individual could manage. I would not find it suprising if this was the technique applied in that case.

</comment></comment><comment><USER32> I really wish Chrome would warn me when a site jumps to a new CA or even a new certificate. Last I checked, details on the current certificate wasn't made available to plugins, so I can't easily write it myself.

</comment><comment><USER33> Any word on whether Iranians are still getting this attack? I would love to see some traceroutes to google.com from affected individuals' machines.

</comment><comment><USER34> Nice anti-IE subtext, google.

<comment><USER35> Yeah, I lol'd.

</comment></comment><comment><USER36> Ouch, DigiNotar is revoked in Chrome? They didn't do anything wrong, someone else pretended to be them.

<comment><USER15> For somebody else to pretend to be then, in this case, they need their private key. As a CA, you can't have your private key leaked and then still be trusted by a browser.

Or they issued the *.google.com certificate by accident, but if you accidentally issue a certificate as a CA, you can't be trusted by a browser either.

IMHO, this was entirely justified.</comment></comment>


Falsehoods Programmers Believe About Names - <AUTHOR> http://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/

<comment><USER2> This is an interesting piece of trivia but there is rarely a reason to cover most of these cases.

</comment><comment><USER3> Oh no, not again!</comment>


Where can I find a feed of interesting videos on startups? - <AUTHOR>

Interesting = Interviews with people like Jeff Bezos, Max Levchin and so on. Office tours. Roundtables in any conferences currently happening and so on. <comment><USER2> You might want to consider Stanford's Entrepreneurial Thought Leaders lecture series:

<http://ecorner.stanford.edu/podcasts.html>

<comment><AUTHOR> They have Cuil there :)

</comment></comment><comment><USER3> I am a big fan of <http://omnisio.com/startupschool08> (Jeff Bezos, David Heinemeier Hansson, Mike Arrington, Paul Graham...) I also enjoyed the movie "startup.com". Hope that gives you a place to start :)

<comment><USER4> Just saw Startup.com last week, was great. I felt like it had a lot of holes in it, despite the leadership that seemed to be really good, they just mysteriously disappeared as a company.

<comment><USER5> Was this on TV, or VHS? I've been waiting for Netflix to get this on DVD, but it hasn't shown up yet...

<comment><USER6> Its out on DVD.

<comment><USER5> Yeah, I found it on Amazon, but Netflix doesn't have it for some reason (at least in my area).

</comment></comment></comment></comment></comment><comment><USER7> <http://intruders.tv> is the best source of recent videos of startups on the web.

It's broken down into countries: UK, US etc.

Front page of US (<http://us.intruders.tv>) has interviews with Mark Zuckerberg, Reid Hoffman, Evan Williams amongst other big names.

</comment><comment><USER8> I second the stanford podcasts,

<http://webcast.berkeley.edu/> <http://videolectures.net/> www.ted.com <http://omnisio.com/startupschool08> <http://blog.mixergy.com/> <http://events.carsonified.com/fowa/2008/london/content>

all have interesting videos. id advise just going to www.google.com/videos and searching for those particular people if your interested in them.

</comment><comment><USER9> More relevant for software developers that have already _started_ up but interesting input nevertheless: <http://videolectures.net/kdd07_kohavi_pctce/>

</comment><comment><USER10> <http://www.TalkingHeadTV.com> frequently interviews start-ups. They have a YouTube channel and an iTunes podcast video feed.

</comment><comment><USER11> THere was a whole series on Hulu that followed EarthClassMail for about a year or more. It was called StartUp Mojo, best I recall. Was very enjoyable!

</comment><comment><USER12> Stanford/MIT Venture Lab: <http://www.vlab.org/article.html?aid=170>

</comment><comment><USER13> try <http://viddler.com></comment>


Object-Oriented Programming: A Disaster Story - <AUTHOR> https://medium.com/@brianwill/object-oriented-programming-a-personal-disaster-1b044c2383ab#.rneb9gtzc <comment><USER2> Erlang's creator, Joe Armstrong, said "Erlang might be the only object oriented language because the 3 tenets of object oriented programming are that it's based on message passing, that you have isolation between objects and have polymorphism." (Third point at [http://www.infoq.com/interviews/johnson- armstrong-oop](http://www.infoq.com/interviews/johnson-armstrong-oop))

So maybe OO is not that bad, it's the so called OO languages that didn't go all the way to implement it properly. Still they've been very successful so far. It means that many people liked what they had to offer. This might be about to change even quickly but I won't be so harsh agaist what we have under our fingerprints now. Not perfect but not a disaster.

<comment><USER3> What about Smalltalk? Possibly the only _other_ Object-Oriented language?

<comment><USER2> That interview is about both Erlang and Smalltalk. Ralph Johnson, not one of Smalltalk's designers but close to what we'd call an evangelist nowadays, speaks about Smalltalk. Unfortunately I can't find one sentence that captures his view about Smalltalk's OO. I quote Johnson about Erlang, and in a way about Smalltalk itself:

"The thing about Erlang is that it's in some sense 2 languages, at least you program it 2 levels because one is the functional language that you use to write a single process and then there is what you think about all these processes and how do they interact, one process is sending messages to the other. At a higher level, that Erlang is object oriented, at the lowest level it's a pure functional language and that's how it got advertised for a long time."

[...]

"The only way in Smalltalk to interact with an object is send it a message, but the issue is what message do you have. It's the same thing in Erlang"

So it seems to me that he's saying that Erlang's processes are close to Smalltalk's objects.

I recommend reading all the transcript (much quicker than watching the video).

<comment><USER3> Ah yes, thanks for clarifying.. I didn't _quite_ get as far as watching or reading the article due to work distractions. :/

</comment></comment></comment></comment><comment><USER4> After reading enough of these articles, one comes to a disturbing conclusion: a lot of software engineering practices and a lot of "common sense" knowledge are based on anecdotes, blog posts, famous engineers' declarations or arguments on the internet.

It shouldn't be very difficult to prove that a particular programming paradigm is better along some axis than another. I think it's great that Brian is happy and more productive, but that has no meaning to me if I want to make an informed decision about FP.

<comment><USER5> > It shouldn't be very difficult to prove that a particular programming > paradigm is better along some axis than another

I think it would be one of the hardest things to ever prove scientifically actually. Basically the only valid method I'd accept is having a large group of people who are non-developers, then train half of them in one paradigm and the other in another. Then have both groups solve the same set of problems.

The problem with this experiment is that in order to get useful results is that you need a good group of people that are representative of programmers (i.e. people that don't know programming, but can and are willing/able to learn). Say you can find 1000 mechanical engineering students for example. Great. Next they need to be trained. How long does that take? A year or two? Finally they need to solve the problems, which should be _large_ problems. Next the solutions to the problems should be carefully evaluated. I'd say the experiment if done in academia would be ridiculoulsy expensive and time- consuiming.

Numerous studies such as on static vs dynamic typing have used tiny programming experiments done by a small groups of students doing trivial exercises over the course of a day. I'd say they give little or no insight in how experienced developers handle large problems.

It's very hard to do it as a natural experiment too. A large company could try giving the same task to a team of OO developers, as it does to a team of FP developers. This has happened and the result is usually that the FP developers do it in half the time with half the bugs and twice the enthusiasm. However -- can we know that the people who ended up being FP developers weren't just better developers than the OO devs? I'd wager that "enthusiasts" are more commonly drawn to FP today, so the base of FP developers is a group that is on average "better" than the OO devs. So while I don't doubt that FP is "better" in most scenarios, I also belive the FP group would have done a better job with the OO language as well.

<comment><USER6> > Basically the only valid method I'd accept is having a large group of people > who are non-developers, then train half of them in one paradigm and the > other in another. Then have both groups solve the same set of problems.

I'd settle for two competitors working in the same domain producing similar products using different paradigms, reporting significantly different costs throughout the project's lifetime (including maintenance). Or even a single company reporting a vast decline in costs after switching paradigms, provided that the project is big enough and lasts long enough (five years at a minimum, a decade is preferable). Of course, the more domains and more cases per domain the better. This isn't theoretical. We had numerous case studies of this sort in the late '90s-early '00s showing a very big cost reduction when moving from C/C++ to Java, in projects ranging from enterprise software to defense.

<comment><USER5> The problem with two competitors is that you still can't be sure that the firm that used FP either had "better" developers who would have done the project better at the other firm too. I have met almost no bad developers who do and enjoy FP, and I have met tons of bad OO developers. Actually, even OO developers that just _know_ of the concept of FP are way in my experience way better OO devs than those who don't.

A company switching paradigms is a better test, since the same developers are involved, and presumably they would be less experienced in the new paradigm than the old. If they _still_ produce better software that is a good indication that it was a good switch. Still, there may be a number of companies that did this and failed because they couldn't reach profitability with a new code base, or couldn't fill vacancies and so on. Like I said, it's very hard.

<comment><USER6> > The problem with two competitors is that you still can't be sure that the > firm that used FP either had "better" developers who would have done the > project better at the other firm too.

Yes, but over enough such cases, you can average this out. Also, better developers are more expensive, so that is factored into the cost.

</comment></comment></comment></comment></comment><comment><USER5> The problem with OOP is that doing it _at all_ is so easy. Its abstractions makes a lot of sense to beginners and experts alike. Its biggest flaw is that doing it _well_ is so fantastically hard. It requires a level of discipline and experience that most developers simply never attain, because they don't do it long enough. I don't think 1% of the worlds OO developers have it (I sure don't after more than 10 years of full time OOP).

The trick to sane OOP is doing _as little of it as possible_. When you maximize the number of pure methods, minimize mutable state, minimize inheritance and so on, you are doing OOP well.

<comment><USER7> _When you maximize the number of pure methods, minimize mutable state, minimize inheritance and so on, you are doing OOP well._

But when you write that style of OOP, what's the advantage over a non-OOP language that is immutable by default, uses just functions, and provides constructor (in the FP sense) hiding to maintain invariants?

To me, it seems that it only has disadvantages: team members can still write mutable, reference/pointer leaking horrors.

<comment><USER8> * Ad-hoc polymorphism is valuable, and objects represent a clear way to express it

* Thin wrappers that slightly change functionality are often a business requirement, and "extends" inheritance provides an easy way to express them

* Having data associated directly with the corresponding state can make exploratory programming easier (e.g. suppose I have a library for accessing the Facebook API, so I fetch my user info. In OO style it's immediately clear what I can do with my user info, because it's all methods on the object; in functional style it's less clear)

<comment><USER5> > Thin wrappers that slightly change functionality are often a business > requirement

I doubt that a business requirement stipulates how something is implemented, but thin extensions are often an apparently convenient way of quickly getting the slightly different behavior of the business requirement. Whether or not it's a good idea just because it is quick and convenient I think isn't clear. From a business perspective this is one of the _false_ benefits -- if the problem is apparently solved quickly, but the maintenance is harder afterwards, it may not be the best idea. I'd bet sum types + common pure functionality accomplishes the same thing with lower maintenance cost.

> Having data associated directly with the corresponding state can make > exploratory programming easier

I agree that many functional languages have definite drawbacks in terms of exploratory and self documenting programming. "Methods" on types are to me a definite requirement also for an FP language because of autocomplete/documentation/ergonomics. To , me writing v2 = Vector.normalize(v1) is vastly inferior to v2 = v1.normalize(). This is syntactic sugar of course, but important sugar. Neither is "OO" though: associating methods as postfix can be done regardless.

<comment><USER8> > I'd bet sum types + common pure functionality accomplishes the same thing > with lower maintenance cost.

Not my experience - most functional languages make it much harder than it should be to say "this is exactly an X except that it prints differently".

> I agree that many functional languages have definite drawbacks in terms of > exploratory and self documenting programming. "Methods" on types are to me a > definite requirement also for an FP language because of > autocomplete/documentation/ergonomics. To , me writing v2 = > Vector.normalize(v1) is vastly inferior to v2 = v1.normalize(). This is > syntactic sugar of course, but important sugar. Neither is "OO" though: > associating methods as postfix can be done regardless.

Well, if a feature is present in all mainstream "OO" languages and not in any mainstream "functional" languages then I'll call it "OO". I'd be very interested to see a functional language with good support for this kind of thing though.

<comment><USER9> > Not my experience - most functional languages make it much harder than it > should be to say "this is exactly an X except that it prints differently"

That's because this is the wrong thing to say in the first place - it dilutes the very meaning of "type". You should factor out the common parts, and only then say X prints this way, Y prints that other way.

<comment><USER8> The overhead of adding another type is nontrivial (which maybe is a problem in itself; nevertheless, here we are). For business-critical distinctions it's worthwhile. For differences that only matter in one or two places, or for less-critical functionality (e.g. GUI tweaks) it may not be.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I am so tired of hearing "xxx is bad". It's always the same story:

\- It starts out as a good and useful idea for certain problems.

\- Then some people elevate it to the solve-it-all method and if you do anything else you are a bad person. Almost like a religion

\- After a while nobody remembers why this thing has been invented and people just do it because they have to without any understanding why

I have seen this happen to:

\- OOP (works great for a lot use cases if used in moderation but not all)

\- Flat design

\- Scrum/agile

\- MVC

\- Javascript

\- Goto

\- Loops (everything has to be a closure)

Right now functional programming is cool. Just wait until the people who have messed up OOP get onto the FP bandwagon. Clueless people will start doing FP and things will go to hell.

In the end you need to know what you are doing and why. There is no magic methodology that will save you from that.

</comment><comment><USER11> Interesting, I reached more or less the same conclusions about 10 years ago, after about 20 years programming in C++.

I think with C++ I had also reached the point where I realized it was not just difficult to scale (I had worked on ginormous codebases) it was also difficult to 'control'... Adding new people on the project could sometime mean disasters that would go unseen for a while before exploding in your face...

Newbie programmer decides it's a cool idea to go and 'tweak' the String class - or any other base class- or other equivalent 'good idea' that sometime lead to huge amount of effort to understand the weird ripple effects afterward, and then 'fix' so it's done 'properly'.

There was also the 'design for design' problem where a 1/2 page feature that was ever going to be used ONCE was designed with an imbroglio of 5 or 6 classes just to match some person's idea of a 'design pattern'.

I've now 'reverted' to mostly 'procedural' C; however, quite a lot of the 'good' concepts of C++ for encapsulation can be done in C without all the faffing around, and it's a LOT harder to fsck up and create ripple effects; you can 'layer' modules instead of 'inheriting' with the equivalent compartmentalization you'd want from C++, without the 'dangers' of inheritance.

Sure, it lacks syntaxic sugar, and sure, there's still stuff I miss; but it does scale pretty well, and the footprint difference is fantastic.

<comment><USER4> I think you need to take a step back, because you are analysing your problems at the wrong abstraction level. It sounds like you had an engineering problem, not a programming language one.

Changing the programming language won't prevent newbie programmers from wreaking havoc in your code base, nor improve the software design skills of your colleagues.

On the other hand, I do agree that programming languages have a "culture" which defines the idioms that are accepted, patterns, attitudes towards various practices. My feeling is that hyper-oop programmers have long moved on to Java and .NET.

C has a culture of keeping things simple, because of its long history and limited abstraction possibilities. It's also the favorite refuge of people that hate OOP, so no surprise you won't see over-engineered OOP hierarchies.

<comment><USER12> Unrelated (sorta): love the appropriateness of your username

</comment></comment></comment><comment><USER13> I think there's a fundamental misconception at the heart of how people think about OOP, and it revolves around "what is an object". In all likelihood OOP perhaps became hyped because it _seemed_ to provide a paradigm whereby one could develop programs as simulations that resembled the real-world systems they were modelling. This is somewhat similar to the way COBOL took off because it was intended to facilitate verbose readable code that would be verifiable by analysts.

I think this may have been the original intention of real OOP languages (OO theory itself developed as a way of modelling knowledge from _human_ perspective [1]) such as Smalltalk but as the author says it just isn't feasible to do this "all the way down". In my experience OOP of this style is best used as a high level abstraction but beneath that for the sake of pragmatism and performance you usual need to get a bit more imperative.

The other perspective on OOP is that one models your solution space rather than your problem domain. One models data such as `CarHoodDrawingAlgorithm` rather than `CarHood` - and it's this reasoning that can lead us towards functional programming, which may be described as "OO for functions".

OO is still useful, because objects are something we naturally understand and can discuss. _" Oh I got an exception when I called 'draw' on CarHoodDrawingAlgorithm / Oh really, that's a subclass of CanvasDrawer which I wouldn't have expected to throw that type of exception"_

I think it breaks down where you have a mismatch between what different parties understand what an object to be, and how pervasive the paradigm needs to be. Quite rightly advanced programming topics are moving towards FP which more specifically answers the concerns in the solution space, which isn't I believe what OO was meant for.

[1] [https://en.wikibooks.org/wiki/Cognitive_Psychology_and_Cogni...](https://en.wikibooks.org/wiki/Cognitive_Psychology_and_Cognitive_Neuroscience/Knowledge_Representation_and_Hemispheric_Specialisation#Hierarchical_Organisation_of_Categories)

</comment><comment><USER6> Anyone who works on a large system written in _any_ paradigm can see the same "disaster" \-- at least so far[1]. What so far differentiates paradigms that claim they are immune to those problems (or other problems with similar severity, some of them perhaps unknown as of yet) is that they have never been put to the test on projects of the same magnitude (i.e., same codebase size, same team size, same project lifespan[2]), let alone in enough problem domains, so they haven't had a chance to encounter "disaster inducing scenarios", and therefore haven't reported disasters yet. What we have now is paradigms that we know to be problematic -- but also effective to some degree (large or small, depending on your perspective) -- and paradigms that we don't know enough about: they could turn out to be more effective, just as effective or even less effective (or they could be any of the three depending on the problem domain).

How can we know if we should switch to a different paradigm? Empirical data. So please, academic community and the software industry: go out and collect that data! Theoretical (let along religious) arguments are perhaps a valid starting point, but they are ultimately unhelpful in making a decision. In fact, it has been mathematically proven that they can contribute little to the discussion: the theoretical difficulty in constructing a correct program is the same regardless of the abstractions used[3]; only cognitive effects -- which can only be studied empirically -- could provide arguments in favor of a certain paradigm making it easier _for humans_ to write correct code.

[1]: As someone who worked on software written in procedural code before the popularity of OOP, it wasn't any better (actually, it was worse). For contemporary examples, see Toyota's car software.

[2]: Those are, of course, proxies for "very complex requirements, both functional and structural", but the point stands.

[3]: The cost of verifying/constructing a correct program is at least linear in the size of the program's state-space (or, more precisely, its Kripke structure, which also includes transitions) regardless of representation in code or abstractions used to make it more succinct. E.g., _" Kripke structures that admit a succinct representation are not simpler for model checking purposes than arbitrary Kripke structures"_ ([http://www.lsv.ens- cachan.fr/Publis/PAPERS/PDF/Sch-aiml02.pd...](http://www.lsv.ens- cachan.fr/Publis/PAPERS/PDF/Sch-aiml02.pdf)), and model checking can be reduced to any other verification/construction methodology.

<comment><USER14> Very well said! Bjarne Stroustrup resumed with: "There are only two kinds of languages: the ones people complain about and the ones nobody uses."

<comment><USER7> That quote is often cited, but it stymies the discussion.

First of all because there are counterexamples. E.g. I think SQL is generally well-liked for its domain and widely used.

Secondly, even if we complain about languages that are used, we can still distill and compare pros and cons. Speaking of C++ specifically - once Rust is in wider use, people will probably complain about it too. But we can describe in what regards Rust is safer objectively.

<comment><USER15> I don't like SQL. I think there could be a worthy successor to it. Something functional, typed, Haskell-like. Something that can incorporate other data processing paradigms, such as ETL, stream processing, map reduce and so on.

</comment></comment></comment></comment><comment><USER16> I feel like this is a real newbie question but since I've never seen it answered I'm gonna dare ask it:

Isn't Python widely considered a good programming language, and isn't _everything_ in Python an object?

How does this fit with OOP being bad?

<comment><USER17> Let me take a crack at this.

There have been three main movements or philosophies in programming. The first was the "structured programming" movement starting in the late 50s, discussed in the article. This was at the time when high-level languages (for a weak definition of high-level) were first becoming usable, and most people were used to using assembler. Structured programming gave some structure (hence the name) to the control flow methods used at the time. This is where for and while loops come from. "GOTO Considered Harmful" is one of the main texts from this period, and I think we can say by the 70s structured programming had won over the mindshare of most developers.

The second is object-oriented programming, which started in the late 60s, and achieved mindshare in the mid-80s to early 90s. The most influential OO language is Smalltalk (1983).

The third is functional programming, which either started in the 50s or the 70s (depending on where you draw the line) and is in the process of winning mindshare from OO right now. It's important to note that the modern incarnation of functional programming (by which I mean static types + abstractions like monads and applicatives) is very new, in programming language terms. The main standard for Haskell is 1998, Scala was created in 2005, and key techniques such as free monads are the subject of ongoing research. It has only been viable to do production quality statically typed FP for about a decade.

Python was created in the early 90s, and looks back to Smalltalk for inspiration. Culturally Python is (obviously) in the OO camp. Culturally, most developers are in the OO camp as well. Thus their definition of "good" is OO, and Python fits this. The linked post is a sign of the change that is happening right now---more developers are discovering FP and their definition of good is switching from OO to FP. From the perspective of an FP proponent, Python is not a good language.

The key point I'm trying to make is that programming is a cultural movement. We like to pretend we're objective and scientific, but we aren't. That's ok. Neither is science (see, e.g., "The Structure of Scientific Revolutions"). I do believe, however, that we're improving over time (said as a true FP adherent, of course :-)

<comment><USER16> Thank you for the very thorough explanation.

I was under the impression that lisp was the mother of all functional languages, so I was surprised not to see it in your comment.

<comment> nv-vn Interestingly, Lisp tends to be more closely related to modern imperative or OOP languages than modern FP languages most of the time (although this is very much a matter of dialect, as Clojure and Scheme code tend to resemble FP much more than CL and Elisp code do). Lisp had some ideas influential to FP that also made their way into other types of programming (garbage collection, closures, etc.), but things which are considered a modern necessity for functional programming are not present in most dialects of Lisp (like immutability of data, at least by default, currying, etc.). In fact, most Lisp dialects don't even have first-class functions (in the sense that variables and functions are stored in totally different namespaces), which even languages like C# support. So to call Lisp 'functional' is a bit of a stretch, despite the large divides between different dialects and the multi-paradigm abilities of those languages, but that's not to say that it wasn't hugely instrumental in the onset of functional programming.

<comment><USER15> I think another way to look at it is that Lisp took untyped lambda calculus and turned it into practical programming language, although in an opinionated way that was necessary at the time for performance reasons.

However, modern FP languages always start from some form of typed lambda calculus, because it has more desirable properties.

</comment></comment></comment></comment></comment><comment><USER15> I feel the same way as the author. The dependencies are inherent in the problem, and no amount of abstractions is going to remove them. So worrying whether you should split them this way or that way (or how you should structure your "objects") is a false worry.

I think the mathematicians got it right with typed functional programming, which has a rigorous basis. I think OOP is flawed because it's not formal enough.

</comment><comment><USER18> This is just a cool, affirming day for me with several recent articles praising dynamic languages, to pointing out flaws with OO in practice.

I'm fairly pragmatic when it comes to OO, FP etc.. I happen to like modern JS, I like FP for most workflows, and will use classes where it makes sense. By not needing to create DI systems and other "enterprise" patterns early on, I'm able to create simpler solutions... in most cases FP/Procedural hybrids make more sense in terms of workflow/state ... for state that is tethered to UI context, but no necessity to persist/reload will use more class oriented approach (React + Redux for example).

Once you're past the initial boilerplate and concepts, adding features adds far less complexity this way than with more traditional OO approaches.

</comment><comment><USER19> The real disaster here is when you assume that OOP is the only path to follow.

OOP is a programming paradigm among others, the same way you have many types of hammers.

Only ignorance (or lack of culture) motivates oneself to use a mace instead of a carpenter's hammer for driving nails into a wall.

In case you're curious: [https://en.wikipedia.org/wiki/Hammer](https://en.wikipedia.org/wiki/Hammer) [https://en.wikipedia.org/wiki/Programming_paradigm](https://en.wikipedia.org/wiki/Programming_paradigm)

</comment><comment><USER20> OOP is a tool, like FP. Sometimes it make sense, sometimes it doesn't. In my opinion, a good language should allow to do both. Encapsulation and polymorphism are obviously the most important things in OOP. I think what made some projects hard to maintain is the over reliance on inheritance. If Java had something like mixins or traits , developers would rely less on inheritance to achieve polymorphism. I wish Go had true traits for instance ( struct embedding are not traits ) , it would have made the language close to perfect.

</comment><comment><USER21> > procedural code—particularly pure functional code—...

How is procedural code pure functional? Can you explain please?

And how is procedural code supposed to solve the global/shared state problem?

<comment><USER22> I think he means that purely functional code is procedural code (with some limitations) not the other way around.

</comment></comment><comment><USER23> The author failed to provide the story of a realized disaster. I do get the silliness of ManagerManager objects though.

ManagerManager managerManager = new ManagerManager

</comment><comment><USER24> Yup, I heard a lot about _objects_ and _object oriented programming_ (OOP). On some selected toy problems it seemed to have some advantages. Okay.

It's good to read from the OP and in this thread yet more explanations of what OOP was supposed to be about. Okay.

So, in my current project, I make a lot of use of the classes in .NET and have defined some classes with some methods, etc. Okay -- the _encapsulation_ seems to help make the code easier to understand and debug.

I have made some use of polymorphism, and mostly I like it. So, I use _interfaces_ , and, really, those are a lot like, but much less powerful than, what I used to do in languages where I passed as an argument to a subroutine or function the name of a subroutine or function the subroutine or function could call. E.g., in solving an initial value problem for an ordinary differential equation, have a function that does that and pass to the function a function that will evaluate the differential equation. For finding the minimum value of a function X, have a function Y that is a general purpose function minimizer and pass X to Y and let Y do the work of finding the minimum value of X.

For inheritance, .NET seems to use a lot of it, at least in their documentation, but so far in the code I've written I've never used any of inheritance. I love hierarchical file systems and the idea of inheritances of capabilities and access control lists (ACLs), but I don't really like the idea of inheritance among OOP classes. Sorry 'bout that.

If I want to build an outhouse, then I don't want to inherit a small house and add a toilet -- instead, I just want an outhouse.

For _passing messages_ , sure, I saw that in Smalltalk but never thought to use it among objects in one program.

My server farm architecture and software does have some message passing among some of the back end servers. For a case of that, sure, OOP helps: For the data to be passed, I define a class, allocate an instance, put data into the members of the instance, serialize the instance to a byte string, send the byte string via just old TCP/IP sockets, wait for the response, a byte string, deserialize the byte string to an instance of the class that is supposed to get the returned data, and continue on. If there is an error, then the code writes a message to the Web site log file and returns a notification of an error to the user. Works fine.

For _immutable state_ , no thanks -- e.g., in software about a car, the current state is position and velocity, and as the car moves that state changes and is not immutable. The speedometer of the car does not have immutable state, either, nor the steering, throttle setting, transmission gear, etc. Sure, could define an immutable state separately for each instance of time, but I guess that speedometer makers didn't think of that. If I put some raw meat in the oven and cook it, what comes out should be a good roast, and not something immutable. I think of state as changing, not as immutable.

Some of what the OP describes that is supposed to be _real_ OOP, I was never tempted! No thanks! I never tried that and never would. To me, those rules were obviously nonsense, like programming standing on my head. Able to do it? Yes. Want to do it? No. A good idea anyway? Nope. Good to read that author of the OP now agrees!

But that de/serialization to/from a byte string, I like that! The .NET classes, sure, they are very nice to have. For sending data from one server to another, sure, define a class, allocate an instance, assign values to the members, and send the data -- terrific, easy to understand, works great. E.g, the data I send might be fairly complicated, but classes usually have enough generality that can define good places for all the complicated data.

And, can have arrays of object instances -- terrific! And one of the members of a class can be an instance of another class -- I do some of that.

And the methods have some name scoping, and I very much like that -- I wish that scope of names was much more finely grained, as in Algol and PL/I.

Otherwise I program much like I always have back through lots of various programming languages.

How to make the code easy to understand? By far the most important way is documentation, clearly written in English. Think of a freshman text in calculus or physics: The equations are like the code, and the text is like the documentation of the code. Math is written in complete sentences; there is never any attempt to make the symbols and expressions understandable by themselves. And my code is understandable mostly only due to the documentation. Between the documentation and the code, the documentation is the more important. I make essentially no attempt to write _self documenting_ code, no more than a calculus text author tried to write self-explanatory equations.

For more, sure, I have a lot of functions. A function does something easy to document with logic easy to understand. It helps if each function is short and has relatively few arguments. The documentation for the function describes what the function does -- this is what you give to the function, this is what the function does, and this is what comes back from the function. If that's all nice and clear, then that's usually good enough for well written code.

Sure, in simple terms, a program has four steps:

(1) Get input data.

(2) Process the input data.

(3) Send output data.

(4) Return to (1).

Step (2) is essentially a function. It reads its argument, processes that data, and returns its results to the arguments and/or the function value. To do this, this function does its version of (1)-(3).

A server? It does (1)-(4).

I call all of this, SCSONUPS -- _simple, common sense, obvious, nearly universal programming style_. No, no, no, don't thank me. Don't make me famous. No, I won't be writing any books or giving any seminars. I have nothing on Github. If this _style_ is not obviously simple, then I apologize.

I'm not writing code for anyone else. Instead, I own my own business and am writing code for my own business. So, I'm reporting only to myself and am free to write the code anyway I want to. The code I have, I like. With all the documentation, the code is relatively easy to understand and change.

Really the code is organized much like usual work, say, in cooking, lawn maintenance, car maintenance, washing dishes, etc., and the documentation is much like descriptions for how to do such work.

Enough with programming style!

<comment><USER25> I think you just invented Realism in programming. The programs are written by programmers not academics. There is no perfect way to code something. We should stop the dogma fetishism. Structural/OO/Functional programming theories have all their pros/cons but it can't be proven that one is better than the other. So instead of committing ourselves to the one true cause, we should focus on writing code that achieves its purpose. Why shouldn't we use goto statements at all?

PS: I wanted to write "programming is not sacred", but I couldn't. I only use emacs and open source software. I love computers religiously and think that there is something magical about them. So I admit to a certain extent of hypocrisy. We computer geeks are obsessive people.

<comment><USER24> Terrific! You named it -- _Realistic Programming_! Now you will be as famous as Dijkstra, Wirth, Knuth, Stroustrup, etc.!

Yes, I saw some sense in some of the criticism of the GOTO statement, but, yes, I still use the GOTO statement.

Main usage: In a function, some bad situation is detected. Okay, that code might write to a log file and should set a return code value. Then that code just does

GOTO OUT

which means, time to give and just get out'a here, ASAP, where OUT is a statement label of some code that does whatever general clean up is needed and just returns.

There's another cute use of nearly a GOTO: For a loop, have something like DO FOREVER and in the code of the loop, maybe several places, decide when to get out'a the loop and then, do so with a statement LEAVE or some such which is really a GOTO the next statement after the end of the loop. It's essentially a GOTO and in some languages is implemented with an actual GOTO.

But there was a totally sweetheart use of a GOTO in PL/I: In some code could have a statement

ON FUBAR

where FUBAR was a _condition_ that could be _raised_ , and this statement ON was followed by some code to be executed if condition FUBAR was raised. The ON statement made the condition FUBAR _enabled_ and _established_ what to do if the condition was _raised_. The code of the ON statement could have a GOTO.

So, the code of function A has such an ON statement. Function A is called and the execution comes to the ON statement. Now the condition FUBAR is enabled and that ON unit is established for condition FUBAR should it be raised. If the code of function A returns, then that ON condition is no longer established.

Function A calls function B which raises condition FUBAR. Then the code immediately jumps to the code of ON FUBAR. If that code executes a GOTO to a label in the code of function A, then all the code in the stack of active code from function A and lower is ended (e.g., storage automatically allocated is freed), and execution continues.

So, look, Ma, a way to handle exceptional conditions that is easy to code and understand and does the usual, obvious stuff to clean up the mess for, e.g., no memory leaks.

And could do GOTO X, and the X could be a statement label in any code so far called but not yet returned, and the label in the code most recently called but not yet returned would be the target of the GOTO. Again would get stack cleanup. Nice.

Ah, Dijkstra would roll over, screaming.

GOTOs are a common part of life: If get a flat tire, then raise an exceptional condition, cancel a lot of plans and work in progress, and go to the shop of the towing service and call a cab. If the computer processor fan stops and the processor overheats, then something similar. Lots of common situations in life.

</comment></comment></comment><comment><USER26> "when I have umpteen Manager objects, I then need a ManagerManager"

Actually, when this happens it only makes sense for you to get inspired from the real world again and end up designing a hierarchy called "bureaucracy"! </sarcasm></comment>


2016 Nobel Prize in Physiology or Medicine Is Awarded to Yoshinori Ohsumi [pdf] - <AUTHOR> https://www.nobelprize.org/nobel_prizes/medicine/laureates/2016/press.pdf <comment><USER2> I wish they'd rename the prize to "Nobel Prize in Fundamental Biology". Medicine is important but this is clearly a fundamental biology discovery.

<comment><USER3> Yes and no. You can argue that genetics of autophagy are fundamental but it is clear that the prize is being given in recognition of the fact that this led to better understanding of neurodegenerative disorders and so on. For better or worse, the Nobel doesn't really go to discoveries that don't have applications somehow.

<comment><USER2> It's disappointing that the "prize is being giving in recognization ... better understanding of neurodegenerative diseases".

My point is that I think the prize itself should honor scientific achievements, rather than medical ones, and that this discovery, on its own, stands as a fundamental biological understanding. That it helped understand neurodegenerative disorders is ancillary, and unecessary to justify the prize.

<comment><USER4> Alfred Nobel apparently disagreed, and it's still the interest on the money bequeathed by his will that funds the prize. So it's unlikely that the name will be changed.

<comment><USER2> Neither kind of restriction is applied to the physics or chemistry prize (they do not require some sort of nebulous "medical benefit" to qualify).

<comment><USER4> I'm not talking about the medical benefit, I'm talking about the name specifically. His will stated that there should be prizes for chemistry, physics, literature, peace, and physiology or medicine.

</comment></comment></comment></comment></comment></comment><comment><USER5> In case anyone is interested in the personal implications of this, this is part the mechanism by which intermittent fasting gains it's health benefits. People have fasted for 16-48 hours and gained benefits through history but what is happening in the body is really ketosis + autophagy. Most people in the modern world eat too frequently to benefit from autophagy, but men (16 hours of fasting) and women (14 hours of fasting) can both benefit from the 3-4x faster cell recycling and potential life extension properties. More: [https://en.wikipedia.org/wiki/Autophagy](https://en.wikipedia.org/wiki/Autophagy)

<comment><USER6> Please, everyone in the IT/CS world, ridiculous health "benefit" claims are in fact the origin of the term "snake oil." There is no accepted guidance from the biomedical community regarding fasting that draws a link to autophagy. Please keep your completely unscientific and unfounded health "benefit" claims to yourself.

<comment><USER5> It seems as though many of your historical posts are similarly angry "source- your-claims" posts. Here is an article entitled "Short-term fasting induces profound neuronal autophagy": [https://www.ncbi.nlm.nih.gov/pubmed/20534972/](https://www.ncbi.nlm.nih.gov/pubmed/20534972/)

<comment><USER6> Thank you for stalking. The paper you cite is preclinical work in mice, and the mechanistic association between starvation conditions and autophagy induction were already well understood before this paper. (That was, in fact, the Nobel-winning work on which you commented.) Any consequential claims of autophagy are unsupported by data in that paper, even in mice. The claim that autophagy has net "health benefits" or "life extension properties" in humans is completely unsupported and not something on which there is professional medical guidance.

HN is replete with medical and health claims that should not be propagated by responsible people. Face it: IT professionals don't have expertise in this area, but that doesn't apparently stop you from having opinions and propagating them authoritatively as truth. If you'd like to do original research in this area, please do, but don't spread misinformation as if it's factual.

</comment></comment></comment></comment><comment><USER7> Not to CRISPR - again!...

<comment><USER4> The Nobel Prizes in science are generally awarded a few decades after the fact. That gives enough time for the impact of the work to become clear.

<comment><USER8> Very true. It took 8 years for Craig Mello and Andrew Fire to be awarded for RNAi (published 1998, awarded 2006 -- and that was considered fast). CRISPR as a gene engineering tool isn't even that old yet, so we've got a few years.

<comment><USER9> Counter example: yamanaka</comment></comment></comment></comment>


The Windows Update Marathon in a VM: From Windows 1.01 to XP - <AUTHOR> https://www.winhistory.de/more/386/updatem.htm <comment><USER3> The level of backwards compatibility in Microsoft products is very impressive.

Microsoft Office 2019 can open .doc files created in Microsoft Office 97 and upgrade them to a modern format, with zero loss (except for things like OLE objects, which are no longer supported for security reasons). My parent's computer has documents which haven't been touched in 20 years and they still open just fine.

Or applications written for Windows NT that still work - unmodified! - <USER2> Windows 10 thanks to layers of compatibility hacks. A true feat of engineering.

If you want to read more about the horrors of maintaining APIs that are backwards compatible with software written decades ago, I can heartily recommend Raymond Chen's blog: [https://devblogs.microsoft.com/oldnewthing/](https://devblogs.microsoft.com/oldnewthing/)

<comment><USER4> I was impressed when I upgraded an old Win7 system and Office 2007 still worked on W10. Makes me wonder what the oldest version of Office is that would still work. There are a lot of things to not like about Microsoft, but their dedication to backwards compatibility is great.

<comment><USER5> Reminds me of that time when they fixed a buffer overflow in the ancient Office Equation Editor by manually patching the binary because they lost the source code:

[https://arstechnica.com/gadgets/2017/11/microsoft-patches- eq...](https://arstechnica.com/gadgets/2017/11/microsoft-patches-equation- editor-flaw-without-fixing-the-source-code/)

<comment><USER6> Oh that reminds me of learning some assembler by writing cracks to shareware programs to patch away test period warnings, license key checks, etc. using a disassembler (w32dasm I believe) on the binary executable. That was a fun learning experience, helped a 14 year old to use software he otherwise couldn't buy (me) and helped understanding quite a few internals of binaries.

<comment><USER7> Some binaries are obfuscated by overlapping several routines together.

<comment><USER8> Oh, there's a bunch of ways you can try to make reverse engineering harder, but I don't think these techniques are really that common for most software.

</comment></comment></comment></comment></comment></comment><comment><USER9> Cool to see this. I saw a video of someone doing it before, but I didn't want to share it with co-workers because the person making the video used whatever the "paint" equivalent was on that version to draw genitalia before upgrading to the next version.

</comment><comment><USER10> My last clean install of Windows was with Vista and since then I have done in- place upgrades without much hassle. There is no hardware left anymore from the original setup and it even survived several mainboards, switches between AMD and Intel and the boot drive migrated from an IDE HDD to an AHCI SSD.

I believe that periodic clean installs of OSes are not necessary anymore and every modern OS install should survive hardware changes and upgrades to newer versions.

<comment><USER11> The thought alone of this makes me jitter. I reinstall my PC every 3-6 months and it's always a fresh breath of air.

Probably because I know I will reinstall not too long from any point in time I just install everything I think I need. I need to convert an IMG to ISO? Let me just try these 5 apps and forget about them. They will be cleaned after the fresh install anyway.

</comment></comment><comment><USER12> The screenshots documenting the process are fun but it would also be neat to see graphs of install time per OS and how much storage and memory were in use after completing each upgrade step. I don't recall: could you upgrade 16-bit DOS/Windows to 32 bit or did that require a clean install?

<comment><USER13> Depends on what you count Win95 as. It billed itself as a 32 bit OS, but it wasn't really. However, you could update from Win 3.11 to Win95.

To go from the DOS based Windows (95, 98 and ME) to the NT based Windows versions (Windows NT 4, Windows 2000, Windows XP) required a fresh install.

Update: Actually, I was wrong: XP could update from ME - as seen in the OP.

<comment><USER14> I'm curious why you think Win95 wasn't a 32bit OS?

<comment><USER15> It was still possible to use "real mode" (16-bit DOS) device drivers with Win95. [1] I believe there was a 32-bit kernel running on top of this 16-bit foundation, but it was definitely a hybrid arrangement. User space processes definitely ran in 32-bit "protected mode", and 16-bit legacy processes ran in their own protected address space when run from inside Win95 - with the 32-bit OS kernel taking the place of what would normally have been the interplay of BIOS and DOS, handling the interrupts routinely generated by 16-bit DOS software for making what we would now call syscalls.

I believe much of this was already in place with Windows 3.1(1)'s 386 enhanced mode and Win32s, although from memory Windows 95 moved far more device drivers into the 32-bit kernel. Presumably this was enabled by not having to be able to end the windowing session and quit back to DOS without rebooting.

[1] I seem to remember CD-ROM drive controller drivers being particularly common culprits in this regard, with virtual mode device drivers often being unavailable, so you had to use real mode drivers in config.sys even on Win9x. Yes, back in the day of single-, double-, and quad-speed CD-ROM drives, you typically had an ISA card with a custom controller that then connected to the CD-ROM drive via an "I can't believe it's not IDE" ribbon cable. Only later did we get ATAPI and hard drives and optical drives could use the same controller and bus. (Sound cards often had an on-board CD-ROM drive controller and ribbon cable connector around that time.)

<comment><USER16> > Presumably this was enabled by not having to be able to end the windowing > session and quit back to DOS without rebooting.

The original "It's now safe to turn off your computer" screen after shutting down windows 95 is actually just a dos prompt.

You cannot see it, because the computer was left in a graphics mode, but if you can blindly type a command to switch graphics mode you're back at a normal DOS prompt.

</comment></comment></comment></comment></comment><comment><USER17> OTOH, the history of Windows 10 seems to be one botched update after another.

True story, last week I tried to update Windows 10 v1803 (preinstalled) on my dinky ASUS VivoBook E12 to v1903. The result was a seemingly endless "Reverting changes" bootloop that I haven't gotten around to fix yet.

<comment><USER18> Yep, I had the exact same problem with v1903. In the end I had to make an install USB, reformat the disk and do a true reinstall (Windows claims it can do a clean reinstall of itself but it still keeps a ton of data and doesn't fix a broken installation)

</comment></comment><comment><USER19> I still remember using Windos ME as a kid and loved it because it felt more modern than Win98. I still don't get what was so bad about it but then again even if I would know I would have no idea.

<comment><USER20> Stability was the main issue. My personal experience is that the kernel would crash frequently and unpredictably. If I remember correctly, this would depend to a large extent on drivers, and so vary depending on your hardware. The kernel and driver model design is based on the legacy Windows 9x family, rather than Windows NT (like its successors).

Apparently, according to Wikipedia: "Although Windows 9x features memory protection, it does not protect the first megabyte of memory from userland applications. This area of memory contains code critical to the functioning of the operating system, and by writing into this area of memory an application can crash or freeze the operating system. This was a source of instability as faulty applications could accidentally write into this region and with that halt the operating system"

As it was aimed exclusively at home users, various features aimed at enterprise (but often desirable to power users) were stripped out or broken.

</comment></comment><comment><USER21> Okay, thought experiment time: how far back can you do this with Linux? I mean, obviously with enough effort you can make Yggdrasil to modern era, but like, without dropping into a root shell?

I think you can probably get from ubuntu's release to current. But I also happen to know they 'supported' upgrading from Debian to warty warthog. And I've done a few Debian OS upgrades, so that's also doable. Possibly all the way back to 1.1 released in 1996. Can you upgrade from something else to Debian?

<comment><USER22> I've been upgrading Debian continually since around 2000 (don't remember exactly). It's even the same disk image, migrated to various disks (using mdadm), expanded, converted to ext3 from ext2.

But not without pain, I've almost always needed to manually intervene and fix configuration files. So you need root shell.

</comment></comment><comment><USER23> I'd enjoy a timelapse video of this with a timer at the bottom and an occasional pauses or slow-downs to show specific parts.

Fun stuff. My first thought is the time I was installing Windows 9x from floppies and one of thirty-something were bad...

Considering how much I fresh install things, I really had no idea that you could upgrade all the way from 1 to XP.

</comment><comment><USER24> Is there a 32bit Windows 10? Perhaps possible to go all the way.

Would be cool to produce some files in the first Windows like a picture in Paint 1.0 and then upgrade it again and again.

<comment><USER25> I did not realize there was a 32-bit version of Windows 10. Crazy. With a standard component, 16-bit Windows applications can still run on Windows 10 32-bit:

[https://www.groovypost.com/howto/enable-16-bit- application-s...](https://www.groovypost.com/howto/enable-16-bit-application- support-windows-10/)

Getting 16-bit on 64-bit Windows takes a little more work:

[https://medium.com/hackernoon/win3mu-part-1-why-im- writing-a...](https://medium.com/hackernoon/win3mu-part-1-why-im- writing-a-16-bit-windows-emulator-2eae946c935d#.fqddlzmq6)

<comment><USER26> For the latter here is a working VM/layer partially based on Wine:

[https://github.com/otya128/winevdm](https://github.com/otya128/winevdm)

It can be installed systemwide to get almost seamless support for 16bit Windows apps.

</comment></comment></comment><comment><USER27> Damn I'm old. I remember all of them :/

</comment><comment><USER28> Am I the only one who doesn't like the backwards-compatibility that Microsoft Windows provides? I find it frustrating to see the operating system itself not coherent, thinks like having multiple places for configuration (settings app and the control panel), non-HiDPI panels that popup from various parts of the operating system, etc.

I find it frustrating to not have an operating system that has the polish & coherency of macOS on non-Macs, and that's one of the biggest reasons why these Mac people (myself included) doesn't even consider moving out of macOS.

<comment><USER29> We could retain the ability to launch old apps _and_ still have Settings in one place. They don't inherently go together.

Microsoft might need to add something like a legacy control panel which only appears if you install an old app that adds something there. Users who don't use old apps wouldn't see it, so no harm done versus dropping support completely. And, I don't understand why Microsoft couldn't integrate those panels into the modern Settings UI, even if the underlying framework and visuals were different.

<comment><USER28> > I could imagine you might need a legacy Control Panel that only appears if > you install an old app that adds something to it—but anyone who doesn't use > those legacy apps wouldn't see it.

Yeah, and that means (at least for me) non-coherency of the platform. Why should there be two different settings on one OS, depending whether the user installed the app it or not?

> And even then, there's no reason Microsoft couldn't add a visual update and > even integrate the UI into Settings.

FYI: the reason Microsoft can't remove this control panel stuff is because some legacy apps (mostly designed for enterprise) installs DLLs that adds a control panel item. This is one of the examples where their backwards compatibility drags them to make a better OS.

<comment><USER29> > Yeah, and that means (at least for me) non-coherency of the platform.

Then don't install old apps and you'll get coherency. This is much better than outright blocking those old apps for _everyone_.

> FYI: the reason Microsoft can't remove this control panel stuff is because > some legacy apps (mostly designed for enterprise) installs DLLs that adds a > control panel item

If I were Microsoft, I would remove the "Control Panel" as a program the user can open, but keep the underlying framework. Then, if a legacy program adds a control panel item, I'd place a shortcut to that item in modern Settings. It might not be 100% visually perfect, but you'd get most of the way there.

If there's some technical reason Microsoft can't do that (I don't understand how there could be—we're talking about _shortcuts_ ), at minimum the legacy Control Panel shouldn't appear until a 3rd party item is pushed to it, and it shouldn't contain _any_ Microsoft settings. The current situation is completely unnecessary.

<comment><USER30> > If I were Microsoft, I would remove the "Control Panel" as a program the > user can open

They did and people got upset. It's a "who moved my cheese" backward compatibility problem for people. People get upset if they can't find that thing they always used and worked just fine.

For a brief while Windows 10 the legacy Control Panel was entirely removed from Search, and there were so many complaints so they backed off and it's searchable again. That's about the only way to find it; at this point in Windows 10 it's not in the Start Menu, it's not File Explorer Quick Access. People have to intentionally find the Control Panel.

People still talk about the COM GUID to the legacy Control Panel as if it were some secret cheat code to Windows, making shortcuts to the Control Panel because it looks familiar and powerful and/or they don't want to relearn anything new, don't want to get used to the all the cheese that moved around in the modern Settings app.

<comment><USER29> I have vague memories of complaints, but I recall it being because Settings was lacking a lot of really basic functionality at the time.

<comment><USER30> I think the attitude to Settings resembles a lot of the attitude to the Office Ribbon switch. Just about no one uses more than roughly 20% of Control Panel/Settings, but just about everyone uses a slightly _different_ 20%, so even just defining what's "basic functionality" is fraught with a wide variety of subjective opinions.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> The nostalgia... spent many hours of my life looking at some of those install screens and inserting new floppy disks.

</comment><comment><USER32> This is beautiful

</comment><comment><USER33> Is MS Virtual PC really this slow? On VMWare Workstation I can install Windows 3.11 in about 7 seconds, not the 6 minutes this author is showing.</comment>


Ask HN: Hacker-Travelers, please share your techniques and experience. - <AUTHOR>

This recent submission[1] sparked a really inspiring bunch of "me too" comments from folks with experience travelling the world while doing their life/company's work. I'd like to know how you travelling hackers work and what tricks you've picked up.
For example: do you keep to a strict work/adventuring schedule, or just do whatever you feel like? what kind of equipment do you use? Do you really feel like you can work from anywhere, or do you have to find coffee shops/libraries?
1. http://news.ycombinator.com/item?id=3266772 <comment><USER2> I travel for pleasure and like to stay in new places for quite a while (more than a week if I really love the place). I find it easy to work out most hotels, stay with friends or use AirBnB. If I'm interested in relocating (which I do often) it will be because I've visited somewhere and fell in love with the place, or the language, or just landed in a good spot. The key I believe is just be interested in everything and follow your instincts. If you want to move somewhere really out of the way it may not be possible, but then again I've had great broadband along the Swiss Alps' lower ranges at friend's holiday homes for example, and in unexpected spots along the Croatian, Australian and Oaxacan beaches. Be surprised and hope for the best. Even better, if you can work offline and sync when you get to a cafe. My most productive days come when I'm not near a wifi signal. Oh, and if you're US based just get a wireless card and go roaming. If you can and want to go offline just be extremely communicative with your team, and always always keep your deadlines when possible: they need to know they can trust you.

</comment><comment><USER3> I don't get to travel to far away lands while I program from the beach, but I do get to travel around the US for work.

I was in NYC over the summer, Dallas in most of the fall, and now LA until Christmas and maybe some of next year. Because I go to work for different companies and actually work in their offices with their people, I also get all my travel and housing expenses paid for, on top of a nice pay check. So now I am travelling around on another company's dime while I explore some cool cities in the US.

</comment><comment><USER4> Some tips from a recent interview i did:

Living in many parts of the world is much less expensive than living in North America. When you're starting a company, it's really important to keep costs low, so living in a place where the cost of living is much cheaper makes a lot of sense. I lived for two months in the south of Spain while preparing to launch Art Sumo. For a fully furnished, two bedroom apartment in the center of the city, I paid approximately $300/month. How can you argue with that?

That said, be careful how much you travel around. Generally, I find that there is a serious tax to moving from place to place, because for each place you go, you need to spend approximately one week setting up (renting a place, getting sheets, finding a gym, etc). Keep in mind that while you're setting up, it's still time away from the business, so you must be able to plan for that. Also – if you're living in a place that generally is very chill (eg. South of Spain!), it can be hard to motivate yourself to work 10 hour days when everyone else is getting up at 11 am only to take a siesta 2 hours later.

More at <http://ideamensch.com/naysawn-naderi/></comment>


Ask HN: How do you find projects to work on? - <AUTHOR> Whenever I attempt to teach myself a programming language I get partway through the coursework and then lose a lot of interest because I'm not able to use it for anything relevant to me. Is it just a matter of grinding out the course and overcoming the monotony?
How would you recommend a thought process for coming up with beginning projects that have utility and aren't complex enough to be intimidating?
Would helping work on open-source projects that I use be a good way to make what I'm learning relevant to learning language? Are there any good resources that beginners might not be aware of that will help that beginning hump?
Thank you <comment><USER2> I am still a beginner programmer myself, but I do have a couple small projects under my belt. If you happen to have an office job, I would recommend trying to automate anything you do that involves copying information from one source to another. We have many different systems here and they do not communicate, i.e. our complaint database and our POS. I've made programs that make it so I don't have to retype information over and over again. My next project is to make it so that certain weird text documents are easier to read by exporting them to a excel document.

This solution doesn't work for everyone, as some of us don't work at computers. But, if you can find a way to automate anything that you do, whether at home or at work, you'll have a good project to work on.

<comment><USER3> Automating stuff and writing little helpers is a great idea. I would suggest to start with the command line. I wrote a lot of tools for it. Basically everything in daily life, which involves repetitive math, like tracking finances, calculate taxes etc, has the potential to be transformed into some tailored script in your favorite language. Also everything which transforms or involves text, is appropriate. For instance, instead of using some random smart phone app to train memory, I wrote a program to practice the mnemonic peg system by using the shell. Once you start writing such a tool, you will quickly run into practical problems, which need to be solved. Usually this triggers creativity and a learning effect.

</comment></comment><comment><USER4> I tend to be a content oriented maker so as long as I have the content the project gets formed around it. I used to like to play with logo designs logominer.com was my website. You can still find my twitter account @logominer that shows screenshot of the website. Basically I was looking for away to present a break down of established logo designs such as DHL, Nike or Dropbox and other so I created an app portfolio. Recently I came across a book author that I made a contact with as I liked his books so much. After some email exchanges we came up with idea of promoting his books on a website that I would have to build [https://hundredfoot.com](https://hundredfoot.com). Later I got a few other authors onboard but the point is that go and look for the content to process and present in a different shape or form. Go after things you like and make a product around it. It will often end up being just a side project but you will enjoy the process not to mention learn new things. Good Luck

</comment><comment><USER5> My go-to is to build a web scraper with the new language/framework. You touch a little bit of everything and get a pulse on it's ecosystem.

\- HTTP requests \- JSON parsing \- XML parsing \- Iteration on lists \- Persisting data to a database

And in between all that you get types, conditionals, loops, packaging system, etc etc. It's a nice catch all.

</comment><comment><USER6> I usually like to make projects which solve one simple problem or fill one need.

For fun once I made a site where I categorized images of bouquets by the flowers that were in them. This learning ended up being the basis of the photo browsing functionality on my site [https://officesnapshots.com](https://officesnapshots.com)

I also like to look at city government websites to see what parts of them are terrible and then make my own, better version.

For instance, Santa Barbara posted their crime stats in tables on their website as well as precinct boundaries on a different page. I then learned a bit about combining those two things using CartoDB so you could visually see where crime happened.

Lots of inspiration everywhere if the goal is learning or fun!

<comment><USER7> If you don't mind me asking, do you make money off affiliate links on your site?

<comment><USER6> We sell advertising space which is not affiliate driven. Our readers are primarily architects and designers who are purchasing products through furniture dealers as opposed to online so affiliate stuff doesn't really work (I've tried).

</comment></comment></comment><comment><USER8> [https://github.com/karan/Projects](https://github.com/karan/Projects)

A list of practical projects that anyone can solve in any programming language. Fine for beginner's projects in various domains along with solutions in many langs</comment>