Control your RC Car through NodeJs and Arduino - <AUTHOR> http://blog.derivatived.com/posts/Control-Your-Robot-With-Node.js-Raspberry-PI-and-Arduino/

<comment><AUTHOR> I was wondering , if we can do Home Automation and use the latest iOS 8 features to control most of the stuff in house</comment>


Lego elements will be made from plant-based plastic sourced from sugarcane - <AUTHOR> https://www.lego.com/en-us/aboutus/news-room/2018/march/pfp/ <comment><USER2> Cynically, I wonder if this is an attempt to create a new patent-moat based around producing bricks with a novel material, now that the exclusive Lego brick design in ABS patents have expired?</comment>


Python malware on the rise - <AUTHOR> https://www.cyborgsecurity.com/python-malware-on-the-rise/ <comment><USER2> I think a lot of people will read 'python malware' and assume packages; that's not what this is about.

A lot of exploits are two-stage. Stage one is usually the vulnerability, usually written in C given the low-level and tightly controlled instructions required. The exploit breaks security to run an executable or otherwise gain control. Stage two is usually downloading a python executable to grab the goods.

There's nothing especially sinister about the selection of Python for this case over other interpreted languages. Malware authors are just regular developers - they don't want to spend hours trying to hack together a C binary to dump a database when six lines of Python will do it. Python just runs on a lot of platforms, has a lot of mature drop-in libraries, and decent documentation. They use it for the same reason we use it.

The article just makes it sound like malware developers are using modern packaging tools to turn that two-stage exploit into a single-stage. That doesn't strike me as particularly surprising. Teams tend to gravitate towards specializing in one tool when they can. I'd obviously prefer to write a bunch of python than do the same in C, when performance isn't a huge concern (It's the other guy's CPU, after all).

Just seems like a minor observation, rather than some doom trend.

<comment><USER3> _Malware authors are just regular developers - they don 't want to spend hours trying to hack together a C binary to dump a database when six lines of Python will do it._

It used to be that malware authors (virus writers in particular) were characteristically more "hardcore" than the average developer, as in preferring native code (even handwritten Asm) and clever optimisations to make their software smaller and more "tricky", for lack of a better term. But that was when it was as a whole not as commercialised, so it's not so surprising to see that aesthetic disappear with increasing commercialisation.

 _It 's the other guy's CPU, after all_

...and that might be why malware was initially more optimised than average; it spreads more easily when it's tiny and fast, doing its thing without being noticed, than if it causes a noticeable increase in system load that will prompt further investigation and lead to its discovery.

I wonder when we'll see Electron being used for malware...

<comment><USER4> > It used to be that malware authors (virus writers in particular) were > characteristically more "hardcore" than the average developer, [...]

A subgroup of them still operates like that but I feel like "it used to be" might be a bit outdated. It doesn't seem new for malware authors to utilize low hanging fruits from languages to infrastructure. We've had VBA macros that are or spread malware for decades now, it used to be a pretty regular sight in the early 2000s to see low-effort payloads to be written in some high level language and utilize some random IRC server as a C&C for example. Not everything out there is some state actor level APT nightmare, with more developers in every part of the market and even more users that simply don't care enough it seems like a normal development to see stuff like this more often.

</comment></comment></comment><comment><USER5> The article mentions that Python malware comes with difficulties but in my experience it has the advantage to be an easy and simple way to write reliable malware. Packaging with PyInstaller to create a single (but large) executable is easy and helps avoiding detection as the interpreter is embedded in the PE (I never went in depth on this topic but it would be interesting to check out).

Shameless plug; I wrote a few popular articles on 0x00sec about Python malware on Windows just to show how simple and easy it is to build either using ctypes to call WinAPI functions or using pywin32 wrapper which makes the whole thing a lot faster.

See part 1 here [https://0x00sec.org/t/malware-writing-python-malware- part-1/...](https://0x00sec.org/t/malware-writing-python-malware-part-1/11700)

Definitely not the way to go if you have limited memory and need to write tiny shell code but it's good enough for a stage 2 payload.

<comment><AUTHOR> Author here: I've seen your guides before, they're really great! I'd say my article looks at the difficulties, but also the great benefits malware authors have by writing in Python.

> Packaging with PyInstaller to create a single (but large) executable is easy > and helps avoiding detection as the interpreter is embedded in the PE

If you look down further in the article it explores detecting PyInstaller generated executable using simple YARA rules. So, I'd disagree a bit there. I personally think that Nuitka (talked about in the article) in conjunction with a packer would be the best compilation method to use in-order to evade detection. It's actually quite surprising to me that limited malware samples have been seen in the wild using Nuitka, but as the title of the articles states- it's on the rise.

<comment><USER5> You're totally right about Yara. Unfortunately I skimmed through the article pretty fast before commenting as I was on a rush when I read it and missed this part. Just finished a second read, great article and well detailed. But my point about detection is more about the good old VirusTotal submission.

As for Nuitka, I was not able to make it work but I will try again. The alternative I also tried in the past was using Cython to generate C code then compile it but because it requires packaging Python std libs Dlls it was too much trouble and I ran into crashes when running.

I also had bad experiences when using packers because they have a tendency to trigger AV detection just for being packers, like ASProtect. Python malware is definitely a topic that deserves more in depth dive.

Good work!

</comment></comment></comment><comment><USER6> This is a very interesting article, and it is somewhat surprising to see Python entering the malware space more in recent years. Other compiled languages with sophisticated runtimes and cross platform support fit in quite well (Go especially) but to see Python is quite interesting. I guess these actors are at a point where they can churn it out relatively quickly, and are not too worried about the code being reversed rather trivially.

What I'd want to learn more about is whether or not these Python samples tend to be very large (in terms of actual code, and not just language internals/pyinstaller/boilerplate). I expected the real life samples to be smaller than some of the larger botnets and the like written in these compiled languages, but some of the ones you go in depth on are somewhat surprising.

<comment><USER7> It's not malware, of course, but the way Dropbox was able to obscure its use of python was interesting and pretty similar to me. [https://www.anvilventures.com/blog/looking-inside-the- box.ht...](https://www.anvilventures.com/blog/looking-inside-the-box.html)

In short, they shipped a python interpreter that understood rc4 encrypted pyc/opcode files.

</comment></comment><comment><USER8> I was going to mention Python 3.8's audit hooks[1] as a possible way to catch some of these issues, (like web requests, for example) but when I went to Google to find the link, it also came up with an article explaining how to bypass the audit hooks[2]...

[1] [https://docs.python.org/3/library/audit_events.html](https://docs.python.org/3/library/audit_events.html)

[2] [https://daddycocoaman.dev/posts/bypassing-python38-audit- hoo...](https://daddycocoaman.dev/posts/bypassing-python38-audit-hooks- part-1/)

<comment><USER9> Audit hooks have a different use case. Here, in this article, we see described a way to package up the interpreter _as part of the payload_. This is very traditional malware, they 'bring their own binary' so to speak.

A much more modern, and statistically far less common approach (say, top 15% of malware), wants to bring less to the system. Instead, they leverage existing mechanisms for execution - some of this is covered in LOLBAS (Living of the Land Binaries and Scripts).

Interpreters such as Powershell, bash, Python, ruby, even perl, are used by attackers to run their payloads.

There are a number of advantages. For one thing, if you're monitoring the system for new binary executions, it'll appear as just a Python interpreter - often quite normal on a number of systems. You also don't need to set any sort of execution rights, or drop executable files - just a regular, plain old python file.

But the downside is now you're using the system's interpreter, and you have to follow the interpreter's rules. Powershell really kicked this approach off since it was a favorite of malware authors, and Python followed suit with this. As a much newer implementation, with 3.8 being an extremely recent release, it's not so surprising that there are bypasses. Still, you'd be surprised how few attackers will take the time to do so (and how few orgs will monitor their Python interpreters anyways).

</comment></comment><comment><USER10> OT: Those graphs* are interesting in that the spikes for Java/C++ seem to align with fall/spring school semesters, and Javascript tends to invert that pattern and have a spike during the summer (internships? personal summer projects?).

* [https://www.cyborgsecurity.com/wp-content/uploads/2020/07/py...](https://www.cyborgsecurity.com/wp-content/uploads/2020/07/python_growth.jpg)

<comment><USER11> I noticed the same thing and wrote essentially the same comment before I noticed yours. There's also a bit of a peak in Javascript during winter break, which is when some schools do "externships."

</comment></comment><comment><USER12> This seemed to be more about how to compile/decompile and obfuscate Python code then anything about malware. The two examples were the ability to take screenshots and make web requests were the only two actual potential malware related topics, but even those are fairly basic concepts that have a huge range of applications outside malware. These things are also fairly trivial in most even slightly mature languages.

The section on eval was a little more interesting but still nothing special.

Personally, and this is just my probably uninformed opinion, the biggest thing about Python that makes it useful for malware is its huge, mostly uncurated repository of libraries and addons that are easy to install and use without ever looking at it. This aspect of Python seems likely the most appealing for would be malware writers. The ease of making malicious code widely available without a lot of scrutiny.

<comment><USER6> I think your last point and the article's points reflect two different contexts though. One is attacking python software with malicious libraries, while the article's context is python being used to attack any system, even systems that don't have an interpreter installed.

That being said, the security of PyPi and python packaging in general is certainly another interesting topic. I like to think that so far it hasn't been as bad as NPM, but there have been backdoored packages put out onto the internet. It's bound to happen with any public software repo, and with any project that trusts outside contributors without perfect review.

<comment><USER13> PyPI's architecture isn't meaningfully different than npm's. Npm has seen more high profile incidents because:

1\. Packages tend to be smaller, and the transitive dependency trees of projects corresponding larger. This means there are more single points of failure.

2\. More people are using it.

Python, and for that matter most language package ecosystems, have the same problems as js, but many of them have gotten away with it for a bit longer due to (lack of) scale.

</comment></comment></comment><comment><USER14> This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" example, does malware installs open-cv library on windows in background ? (this simply does not compute)

<comment><AUTHOR> Author here. The obfuscated code example was to show what a malware author might do to make malware analysis of a Python "compiled" binary more difficult. The code might be obfuscated & turned into an executable before deployed.

As far as the opencv library goes, used by PoetRAT, you can choose to bundle third party packages inside your executable with all the executable generators I mentioned at the beginning of the article like PyInstaller or Nuitka.

<comment><USER14> Thanks for article and explanation I am less confused now.

I wonder how large malware payload size will be when packaged with open-cv :)

<comment><AUTHOR> They can get really large, especially if it's a dependency that has many dependencies itself! Glad you enjoyed it, thanks so much for reading.

</comment></comment></comment></comment><comment><USER15> Is it just me, or does this read like a friendly howto for a would-be python malware author?

<comment><AUTHOR> "What I cannot create, I do not understand." -Richard Feynman

I do hope that those reading this will use this knowledge to do good.

</comment></comment><comment><USER16> This has been the case for some time. PowerShell is an even more popular malware interpreter because it is already on the target and its obfuscation options are numerous.

<comment><USER17> [https://github.com/danielbohannon/Invoke- Obfuscation](https://github.com/danielbohannon/Invoke-Obfuscation) is great.

</comment></comment><comment><USER18> Python is very versatile from a malware perspective, especially toward anything *nix since python is always pre-installed. There are tons of pip packages that can be used to the bad guy's advantage that they don't have to rewrite themselves (e.g. keyloggers, video camera related packages. All they need to do is have a way to deploy it and receive the data, then it's just a matter of hiding the communication. Building loaders, reverse shells and bypassing AV is hell of a lot easier in Python as well.

See PupyRAT, a full-on multi-os admin tool mainly written in Python (2 unfortunately, also it's buggy and outdated), it's a great example. They use a C wrapper around their remote admin tool that is written in Python. Their (C) loader downloads the provided Python payload from an http link, stores it in a specific memory address that gets executed right after. Because it's in memory, it doesn't touch the disk, Unless you are using the Windows payload (which provides multiple options to hide the program using a set of windows' exploits).

</comment><comment><USER19> If it weren't for your examples, I wouldn't have believed blackhats would waste time using Python. It seems like it would be easier to defend against Python malware isn't precompiled, and if it is precompiled, we're just back to hand analyzing trojans at the assembly level. When you said that SeaDuke was cross-platform, isn't that a huge problem that could easily be detected since the attacker requires target-side interpretation? E.g., more security built into Python about how it is invoked: requiring user interaction to determine whether the user is running something.

</comment><comment><USER20> The article is totally mistitled. It refers to Python being used to create Windows malware using compilers, instead of using C or somethign else.

Packages are not targeted for now.

<comment><AUTHOR> Author here. Wasn't my intention to mislead, but I also don't think the article is mistitled. What would have been a better name? This article is about actual Python malware that would affect an endpoint like a remote access trojan (RAT). If the article was about malware within the Python package index, I would have named it "Malicious Python packages within PyPI on the rise!" It could also be a confusing professional domain interlap, as I exist typically within the security world.

</comment></comment><comment><USER21> Fascinating read. I almost passed up on this article.

Python's eval() function reminds me almost of Lisp's eval/apply feature, which is supposedly at the heart of what makes Lisp so special.

I imagined building a program, that I could teach, to eventually write its own programs. But, I figured I would output it to a separate file, and run that file instead.

</comment><comment><USER22> Most of the exploit scripts are written in python. Easy string manipulation and third party packages (angr, ctftools etc)

</comment><comment><USER23> One issue is Anki's shared add-ons - [https://ankiweb.net/shared/addons/2.1](https://ankiweb.net/shared/addons/2.1). They're written in Python, and can potentially be malware. Is auditing them the only way?

</comment><comment><USER24> [https://youtu.be/56ciki25j2I](https://youtu.be/56ciki25j2I) presentation at the local hacker connlastvywar on how simple it is to write some shitty but functional malware in python.

geared towards someone who has never coded before

</comment><comment><USER25> SCYTHE's in-memory client loads an in-memory CPython interpreter/runtime, even, so you do not even have to compile .py to an exe to run on Windows, for example.

<comment><USER26> Can you tell me more? A google search isn't showing anything relevant

<comment><USER25> Yeah... I was being hesitant about what to say since I work for the company, to avoid an impression that I'm promoting the technology.

Basically, here's SCYTHE's client architecture: [https://www.scythe.io/library/under-the-hood-scythe- architec...](https://www.scythe.io/library/under-the-hood-scythe- architectural-overview-part-1)

And here's how you would load your python to run on the client: [https://www.scythe.io/library/software-development- kit](https://www.scythe.io/library/software-development-kit)

</comment></comment></comment><comment><USER27> Python is the new VB. Popular and easy to learn.

<comment><USER28> Yes, VB is popular back then and is very easy to learn. I wonder why VB.Net is not as popular as C# nowadays given that they have the same access to .NET Framework.

<comment><USER29> Most of the VB.Net adopters came from VB6, only to find out that VB.Net had very little in common with VB other than syntax. If you had to learn a whole new framework and ecosystem anyway, there were more popular options available for VB refugees out there like C# or Python.

</comment></comment></comment><comment><USER30> It's a well known problem that many languages (Python, Ruby, Node) have notoriously insecure trust chains in their dependency management frameworks. If more malware is hitting the Python ecosystem, I think it's just a matter of time until someone manages to publish a tainted version of `requests` or some similarly popular Python lib.

I know for a fact a lot of cybersecurity automation mind share is in Python. Curious to see if this new wave of Python malware will make it into any big cybersecurity vendors. I've performed due diligence on a number of cybersecurity vendors that I wouldn't qualify as having good security posture for stuff like this.

<comment><USER31> Few years ago someone published a trojan version of ``colorama`` with a British spelling ``colourama`` that was found to be mining bitcoins on victims machines!</comment></comment>


Ask HN: What's the most important piece of code you've written? - <AUTHOR> What's the most important piece of code you've written?
My answer is as follows... The most important piece of code I've written was a rudimentary 2d tile engine in QB64 for an RPG I never finished. It's memorable and important to me because of what writing it did for my confidence as a developer. At the time, writing a tile engine "from scratch", in my mind, would make me a "professional".
I had been following a Game Development YouTube series called "Adventures In Game Development". I wanted to be a game developer! It was my dream! I was a novice developer when I took on that challenge. After a few articles and discussions with some people in various IRC channels, I began.
A few hours later, I saw a map appear that I had hardcoded which contained 0's, 1's. When I saw the square patch of grass with water in the middle (my clever map design), I thought I could accomplish anything. It was one of those moments that changed my life.
I'm not kidding when I say I had wanted to write a tile engine for a year, at least, before I was actually able to do it. I was probably around 14 years old, at the time.
I hope you enjoyed reading my answer to this question and I look forward to reading yours!
EDIT
I found the link to one of the articles I read when writing the tile engine.
http://www.petesqbsite.com/sections/tutorials/tutorials/rpg_tut2.txt
EDIT 2
Another important piece of code I've written was the prototype for this game.
http://hdfgame.com/
I helped with the commercial version a bit but it was awesome to see my prototype turn into the first commercial game that I helped release. The prototype was simple but it had the basic functionality that Hexapod Defense Force has. <comment><USER3> This isn't the most important thing I've done, but it's certainly one of the coolest. And it was important to millions of Starcraft players.

There was a time when we broke patching for Starcraft. I point no fingers because, of the top 4 engineers that worked on Battle.net from the beginning until the point of this incident, 3 of them (myself included) broke patching (Diablo, Warcraft II BNE (my bad), and now Starcraft). This is a tragedy, because we always took the mechanics of it very seriously, and still would get it wrong.

A patch went out that broke the patching mechanism. Starcraft worked fine, but if you had to download another patch, the game would crash. We were looking at a scenario where everyone would have to reinstall the game, and that sucks. Worse, this was back in the early 2000s, so we had no way to message everyone easily.

I spent two days non-stop trying to find a way out. And then I had a crazy brilliant idea, based on the original bug. See, the crash bug was a stack overwrite, causing the version detection code to crash inside the game when returning from the version check. I figured out a way to cause another stack overwrite to fix the first one; use the downloadable version DLL we used at the time to leave a trampoline on the stack that would be right at the stack overflow caused by the bug, and cause the game to jump straight to the download-next-patch section of the code. It took a little while to get everything to work properly, but it was glorious. We made a small patch to fix the bug, and used my stack-overwrite hack to get the game to download it. And then I went and got some sleep.

After this, we (Blizzard) overhauled how we did patch testing, and stopped breaking patching.

<comment><USER4> Kerrigan would be pleased.

</comment></comment><comment><USER5> It really depends on what you mean by important? Some of my most important code saves a company millions of dollars a year... It's not at all important to me, but it does it's job and it is important to _someone_.

The most important code to me is a difficult question... I look at code as solutions to problem. What's most important to me, is the code that made me realize none of us are free (weird as that sounds). I can track anyone on the web from their discussions (provided enough comments, i.e. 1000+ words):

[https://twitter.com/AustinGWalters/status/104189476543920128...](https://twitter.com/AustinGWalters/status/1041894765439201281)

Expanding on this system I built an investment framework part of which is incorporated in ([https://projectpiglet.com](https://projectpiglet.com)). It has helped me make 100% yoy returns since 2013 (including >200% last year, even with the downturn):

[https://twitter.com/AustinGWalters/status/107014266501716787...](https://twitter.com/AustinGWalters/status/1070142665017167872)

It's the basis for my startup, but perhaps more importantly, made me realize we have no freedom. I can do this with no funds, in my house, with a computer. I track a couple million people in real-time (public data only)... I wrote a blog post about my introspection:

[https://austingwalters.com/the-last-free- generation/](https://austingwalters.com/the-last-free-generation/)

In a sense, it's open my eyes to the dystopia we are building and it's changed my outlook dramatically.

<comment><USER6> You might want to redefine "freedom" for yourself. I personally struggle with this too, but I find it useful to remember; I can still go down the street, buy something to eat, then go to town and see all that's around.

<comment><USER5> > I can still go down the street, buy something to eat, then go to town and > see all that's around.

So can any animal in a zoo...

Freedom of self-determination is what I think most people define as "freedom". If I redefine freedom, I'd argue I should use a different word, as it wont convey the same meaning to others. When our world is manipulated around us to control what we know and to extent what we think, we are in a cage (at least most of "us" are).

<comment><USER7> I agree an animal in a zoo can do all those things, but an animal in the wild (usually a good example of being free) can do them, too, and to a much greater degree. I do not quite understand how the comparison works better for a caged animal as opposed to a free one. Draw a big enough fence, and everyone's always been in a cage?

Agreed that our world is manipulated around us, but I think the manipulations are much less influential than (a) the difference in society between now vs 500 years ago (and vs where we will be in 100 years) and (b) what we choose to believe and want for ourselves by thinking critically. Still, I do wonder sometimes about the things we choose to believe vs what society convinces us to believe.

How far off the mark am I?

<comment><USER6> Not off the mark at all, at least as far as I see it. I'm probably more free than a person 500 years ago could ever imagine... I'm also more caged than they could know too.

Times change, as do perspectives. Sorry I can't be more helpful.

</comment></comment></comment></comment></comment><comment><USER8> In 1987 I wrote about 150 lines of 68000 assembler that applied a low-pass filter to every sound heard by the towed-array sonar system on the Los Angeles class fast-attack submarines. I was an intern (co-op) and nobody even looked at my code. But it fixed the problem that had been plaguing the ANN-BQQ-5D system, preventing it from going into trials and 'management' just shipped it once the tests started passing.

Compared to other things (including some of the ID3 tag processing code that's still in Windows today, and OLEView) this seems pretty important.

<comment><USER9> For what it's worth to you, I still remember the first time I watched Windows detect that a folder was full of MP3s and enumerate artist/album data alongside the other typical file attributes, and feeling that it showed a big step in its development. It felt like something close to magic for Explorer to be able to do that.

</comment></comment><comment><USER10> The most important code I ever wrote was as a phd student. No one uses that code, but they use the concepts behind it every single day.

The Q was how does one manage large numbers of heterogeneous containers (VM sprawl was already considered a problem, but we said if containers took over the sprawl would be worse). At the time the primary container mechanism was Solaris Zones and people uses ZFS clone functionality to create per zone container file systems. However, this only really helps if your containers are homogeneous. I built a system that created container file systems out of composable layers. One would define template file systems as a collection of layers that are stored in local and remote layer repositories and these layers would be instantly unioned together on demand when one provisioned new containers. We also demonstrated that since heterogeneous containers are now easy to manage, we can not just use containers as lower overhead but similarly long lived VM replacements, but also enable them to be used ephemerally, opening up many new use cases.

You probably know of this by a different name today.

<comment><USER11> > The Q was how does one manage large numbers of heterogeneous containers

my god this man invented UPS

> At the time the primary container mechanism was Solaris Zones and people > uses ZFS clone functionality to create per zone container file systems.

oh wait nevermind he invented docker

<comment><USER10> I wouldn't take credit for James E. Casey's work.

</comment></comment></comment><comment><USER12> I wrote a lot of code for payments processing at an Indian e-commerce shop & see/make it scale from 100s of QPS to ~200k QPS. Just having the code paths exercised by so many people over a day gives me joy.

One change that I will not forget that made the highest "perceived" impact with a one line change. The payments flow was at a different domain the rest of the site. This meant the users incurred a fresh set of DNS lookup, TCP connection establishment & a SSL handshake cost. The change was to load a "pixel" image from the payments domain a page before. It dropped the first call latency from 550ms to 100ms :-)

</comment><comment><USER13> I'm an IT/SysAdmin type guy so I don't really code beyond web stuff at a hobbyist level, though I did do CompSci at uni way back when. However when I followed my partner overseas for a few years, the only job I had while away was working in a computational research group at a university.

I was brought on to provide a nice looking web UI for an online system that scientists could use to submit jobs to a server running molecular dynamics simulations. After finishing the job queue and interfaces though, I had plenty of time to spare. So the boss asked me to try and run some necessary manipulations on the uploaded PDB (protein data bank) files, before they would be sent to run in the simulation.

It's still the only time I have ever actually used direct material from my undergrad degree at work - using Dijkstra's algorithm and standard deviation to discover protein structural features, then manipulating them. It was also the only time I ever used the Python I spent just one semester learning a decade before. With all those libraries, I can understand why it was the language of choice my boss' field.

I made a log of the jobs as well, and in the 5 year since then, over 10,000 jobs have been submitted, helping scientists from dozens of countries all over the world. It's also the only code I've written since my uni days which isn't just typical web app type stuff. It's just this pokey little online service but I'm really proud of it, and I hope I've contributed to humanity's progress in some tiny way.

</comment><comment><USER14> I added support for the middle finger emoji to the WhatsApp iPhone app.

Unlike other messaging platforms, WhatsApp provides their own emoji graphics to ensure backwards compatibility even on old versions of the OS that don't support that emoji natively.

<comment><USER15> Very important!

</comment></comment><comment><USER16> I designed and implemented the core algorithm that currently allocates Azure VMs to physical nodes (though the policies aren't mine, and I owe much credit to my coworkers for actually shipping it.) It removed a fundamental scale bottleneck.

Later, I designed an efficient solver for a category of NP-hard graph problems that currently powers Azure's WAN, 98% faster than the module it replaced.

Hopefully with time I'll be able to publish both. I had mental and physical breakdowns on the way, but those experiences make me proud to be alive.

<comment><USER17> I see. You must have been a Microsoft blue badge...

</comment></comment><comment><USER18> The most important code I "wrote" was merged with code from my wife and produced a tiny human executable.

</comment><comment><USER19> I was at university working on a side project: I wanted to have my own movie torrent website. The idea was to list movies and under each movie list the best available torrents.

This is now a pretty common feature, but at the time trackers only had a list of file going like Titanic.1998.DVDRiP.Proper.MyGroup.

I was able to fetch the torrent, but the hard part was linking each torrent the correct movie (by IMDb ID). I tried for ages to get it right with reg exp to extract the movie title from the torrent name, use the IMDb API, and so on until I found the solution.

The solution, was to just simply take the torrent name, extract the year as the last 4 digit sequence, remove all regular tokens like dvdrip, TS, xvid and so on and perform an automated google search on the string: IMDb "Everything else" (Year). and extract the ID from the first result. It took me less than an hour to implement, and gave absolutely glorious results, matching movies with typos, rejecting non movie torrent and generally getting a fantastic accuracy.

I went on to release the website, which went on to become semi famous in the field and the consequences for me were :

\- Sometimes complex problems actually have simple solution, think outside the box, you don't have to do everything yourself.

\- I actually earned money from some ads I put there, which made uni life a lot funnier. I also experienced what it's like to put a ton of efforts in a product only to get a very slow growth. And then see "something" happen, and you get rewarded for all of that. In a way I felt like a founder.

\- I maintained the website for years. I was able to apply most of what I learned in my lessons on an actual product, learn new stuff on my own, and faced challenges like scaling that my peers simply could not grasp. I finished uni with top grades and a significant reason for that was my illegal torrent website.

\- I got a ton of recognition for my work from friends and family. Even met someone at a bar that wanted to show me the cool website he found when we started discussing movies. One of my bets memories. I started working at BigCo and did not get that kick anymore, which prompted me to change path and work in startups. Really happy with that choice.

The code itself was simple, not really beautiful or efficient, non scalable, completely against any TOS you can dream of, and the goal was to aid movie piracy. It dod not generate million of USD. It probably did not change the life of many, but it changed mine

</comment><comment><USER20> Wrote whole ad tech platform and roped in the advertisers/publishers with my sales skill then received 5M payout got kicked off the company.

After that they hired sales guys from big companies because they had enough cashflow going.

I don't really regret it but he could have given me atleast 10% equity.

I didn't know that the project will ever end up doing multi million dollar business. I couldn't see it coming.

But I did whatever tasks of sales/coding/customer service were demanded from me.

And the worst part? My girlfriend left me for him because she met him at a party and got impressed by his Noveu rich lifestyle and a new supercar.

<comment><USER21> Same thing happened to me. The founder was a business major, knew nothing about tech but was Street smart and contacts with lawyers.

I developed an advertising tracking platform, similar to Voluum.com

But founder kicked me out and now they do roughly 10M sales from ad agencies.

He was even blogging about it how he did corporate Takeover and considered himself supersmart about this move.

He told me see pal, you are not my enemy but in life you only get on shot, either you can be loser or a winner, and you know what I'll choose.

</comment></comment><comment><USER22> I wrote some code related to a class action case supporting child victims of molestation by Catholic priests.

That said, the details of that ugly situation, extremely narrow scope of litigation and details of any possible settlements led me to stop working in the legal industry entirely. When we were working on that project I was simultaneously furious and in tears pretty much every day for weeks.

</comment><comment><USER23> Important to the company? A system which could automatically perform partial- stroke testing on pneumatic emergency-shutoff valve/actuator blocks. The end goal was to allow big chemical plants to run for longer between maintenance cycles. The idea is you part-close the shutdown valve enough to prove it can move but not enough to interrupt process.

We were one of the first to prototype, and the only one to do it without needing a bulky valve positioner. The prototype worked on nearly every setup we could build in the lab. Then we added an automatic setup mode which nobody else had.

Alas, marketing got involved. "We want the manual setup removing, permanently. Not just disabled."

And of course the first sale, the customer was doing something which screwed up automatic setup and couldn't be worked around. Manual setup would have worked, but both marketing and management fought engineering tooth and claw to prevent us re-adding it.

The customer sent every single unit back. The stress burned me out (and more besides)... Not long after that, I was "managed out" of the business (read into that what you will).

On a happier note, most important to me? I help out a small-medium size volunteer-run fandom convention (think Comic Con on a smaller scale). I rebuilt their radio communications infrastructure, added call recording (for training/liability reasons) and staff-call pagers. At the staff debrief, the chairman called it "a game changer" and asked if I'd come back as their Head of Operations.

I said yes.

</comment><comment><USER24> My first professional job was doing a little bit of work for the Human Genome Project. I've never done anything else nearly as worthwhile.

<comment><USER25> Could you outline what the code you wrote did?

</comment></comment><comment><USER26> At my previous company I created a buildpack that allowed our proprietary runtime to run on Cloud Foundry (an open source Enterprise PaaS like Heroku). I built the first version in my spare time in a couple of evenings. It made our software and company compatible with the platforms of major players in this space, including SAP, IBM, GE and Siemens. The compatibility made our tech and our company much more interesting to these companies. In fact, the company was acquired by Siemens last year for $730M.

If I would not have built it, another engineer in the company would have done it a couple of months later while explicitly being assigned the task. I proved that it worked within a couple of days. The code powers tens of thousands of deployments today and is also the basis for running on Docker & Kubernetes.

</comment><comment><USER27> Probably this UI: [https://www.facebook.com/live/create](https://www.facebook.com/live/create)

I didn't do it alone of course (probably a dozen people have worked on the UI, and hundreds on the backend), but it was my main project for around 9 months. Lots of videos that people care a lot about go through there.

<comment><USER28> That seems like a very impactful project. Hundreds of thousands of people (millions?) have used Live videos on FB. Not many engineers can say they've made an impact like that. Congrats!

</comment></comment><comment><USER28> The first Flash game that I released [1].

I had been programming for about 6 years but had never finished anything of substance. The game took about 6 weeks of working on it between classes (and with the help of a friend with the polish and graphics). It went on to be played millions of times and made several thousand of dollars in ad revenue. Even 10 years and a PhD later, this is one of my biggest accomplishments.

It was one of those moments that makes me feel like _now_ I can actually do this (this feeling seems to repeat every few years...).

[1] [http://www.mindjolt.com/stay-up.html](http://www.mindjolt.com/stay- up.html)

</comment><comment><USER29> Actually nothing, which makes me really frustrated.

I'm just building boring CRUD systems for boring companies. I can use a lot of concepts/buzzwords, like microservices, serverless... But at the end, just CRUD apps.

How can I improve? After 5 years just doing this, I don't feel capable of doing something cool like some of the posts in this thread.

<comment><USER30> Ehh, if you've only been developing for 5 years I'd say that's fairly standard. Think about other fields: after 5 years practicing medicine you're barely out of residency and still working 24 hour shifts doing the dirty work no one else wants to do. After 5 years as a lawyer you're likely still an associate working 90 hours a week doing the same.

Just focus on learning new things as much as you can. Whether that's from more senior guys at work or in your own time with side projects, all that matters is you learn. Then start applying for new jobs. You'll probably be disappointed at first with rejections and/or the pay they're willing to offer, but that's fine - their feedback will show you where you need to focus your efforts to improve.

</comment></comment><comment><USER31> I wrote a data collection and messaging framework for devices with a few MBs of memory, that had to stay powered-on and connected to a TCP socket server for about a year before they were going to be accessible again for maintenance etc. A bug in the code that could require a reset of the device could cost the company a big client. I couldn't find any ready-made solution that would satisfy all of the requirements. So I wrote, tested, documented and deployed it in a month almost single handedly. Two and a half years later, that code is still serving them.

</comment><comment><USER32> I guess when I was 12 and had a Commodore 64 in my bedroom. I stayed up late and got up early to learn basic, put sprites on the screen, debug and otherwise get caught up in whatever I wanted to create that day.

I'd like to say thank you to my father for buying it and keeping the chocolate milk and powdered doughnuts flowing.

<comment><USER33> Oh man, this brings up so many good memories :)

<comment><USER32> For me too. Having that Commodore set me up for my future.

</comment></comment></comment><comment><USER34> I used to work in the main office at the college I was attending. For my senior project I wrote a contact manager application that would also help with transcript analysis - allowing transcript data entry, prerequisite mapping, and schedule planning. Most of the students were working adults who had attended classes at other institutions but were unaware which credits could be transferred. In college administration, an 'Articulation Agreement' is a covenant between two colleges that says Calculus 101 at PSU is the same as Calculus 101 at UofO, and they should apply towards a degree at either school without much administrative effort -- that easy transcript analysis. It's more complicated when there isn't an agreement, or when the attended school has trimesters and the degree school has semesters, or when the names of the courses don't match but the content does. My application (and some personal guidance) helped a few students shave a year or more off their schedule by prepping them for meetings with the department head to get transfer credits for courses they'd already taken, or to test out of subjects they already knew from work or personal experience. If you're in college and aren't sure about how to schedule your term, the hour you spend with a department head or guidance counselor can be worth a full term saved. Do it early and often. If there's a class you'll be in that looks too easy, switch out as early as possible to save your time and your instructor's, and maybe get into that cool elective class that didn't fit your schedule.

</comment><comment><USER35> In order to save a friend's answering service (small business), I wrote an answering service software package with PHP, using Comet (the precursor to websocket) using Asterisk as the PBX in 72 hours. Their previous system had been running since 1986, which utilized a 386 SCO server and some sort of external caller id / DID identification box that integrated with it. That caller id box died and a replacement couldn't be found, which pretty much rendered the system useless.

</comment><comment><USER36> Probably 2FA at Pinterest [1].

Actually, on this topic, I'm planning a talk on how to build 2FA (specifically how to add 2FA to an existing site/app). If you need to implement 2FA or are interested in this topic, what would you like to learn from a talk on 2FA?

[1] [https://medium.com/@Pinterest_Engineering/two-factor- authent...](https://medium.com/@Pinterest_Engineering/two-factor- authentication-on-pinterest-238aa3dc92d1)

</comment><comment><USER37> I was responsible for writing a lot of the Unity shell for Ubuntu with my team, taking it from Ubuntu Netbook Remix -> Unity (Mutter) -> Unity (Compiz).

During that period I feel like my team and I wrote a lot of important code, but the fact that Unity survived for so long and was used by so many people makes it stand out.

I'd say a close second was Avant Window Navigator (AWN - a Linux dock), because it got me enough attention to be offered a job working on Open Source full time!

<comment><USER38> Thank you for Unity! I was really sad when Canonical dropped it - it's taken a lot of hate over the years, but I have yet to find a desktop manager I like better... (And I'm still using it.)

</comment></comment><comment><USER39> Most important piece of code I wrote controls the delivery of electrical stimulation for a nervous systems stimulation system that goes in people. Second place is a human metrology system that diagnoses eye issues in a lot of clinical settings.

</comment><comment><USER40> Well, this is important to me, but it isn't exactly a scientific breakthrough or as worthwhile as what others might say, but several years ago at the utility I'm currently working for, we have this stupid method of adding users to a HMI...by manually typing in their user ID, their name and some default password into the user credential file onto the HMI (this is also a crappy HMI software, so the text document isn't even hashed) and then emailing said password to the users.

Anyways, what I did was write a VBA code that

1) Allowed me to take the user ID of the people that needed to be added into said HMI, then get their first name and last name from outlook using an outlook api and automatically adds these users into the credential files.

2) Send the email to the same list of users after I update the file onto the HMI (the HMIs themselves in an air gap network).

Why is this important? Because it got some of my other coworkers to trust that I can find bullshit problems and solve them (this isn't the only bullshit problem I have to do over the years), thus gaining their trust and overtime, got a promotion.

</comment><comment><USER41> My entire full-stack web framework because it's currently what's used for all my commercial projects.

It has been the most beneficial project to me both financial but also in terms of gaining knowledge.

It's the most important code I've ever written because while some would say you shouldn't reinvent the wheel, by reinventing the wheel I have made my overall performance and knowledge ten times better.

<comment><USER42> Could you elaborate a bit? What tech are you using? What's the core design? etc.?

<comment><USER41> Yeah, I sure can.

I used the following tech: D ([https://dlang.org](https://dlang.org)) - <USER2> as the primary programming language. vibe.d ([https://vibed.org](https://vibed.org)) - Used to handle the basics of http/https, but nothing more.

For the database tech the following are used: ORM (Supports the MySql/MariaDb/MSSQL engine) Mongodb (Uses a wrapper around the vibe.d implementation) MySql/MariaDb (Uses mysql-native) Redis (Usable through vibe.d) MSSQL (Uses mysql-native) PostgreSQL/SQLite (Coming in next version.)

The core design of it was a native full-stack web framework based around the ideas of ASP.NET, Razor and MVC.

You can find the project here: [https://diamondmvc.org/](https://diamondmvc.org/) or at Github: [https://github.com/DiamondMVC/Diamond](https://github.com/DiamondMVC/Diamond)

HN Post: [https://news.ycombinator.com/item?id=16743476](https://news.ycombinator.com/item?id=16743476)

</comment></comment></comment><comment><USER43> 20+ years ago when I was 16 I spent months to learn Turbo Pascal. Those were the days of reading thick books and diving into code samples you grabbed from your near BBS. I was working on a project to predict soccer games results based on past games and help gamblers spread their risk wisely. Looking backwards only now I understand how complex and big the codebase was and not sure how I survived to tell (no coding guidelines back then, the source was huge spaghetti mass, but a working one). Anyhow, the project got traction and a software publishing house started to sell it in computer shops nation-wide. Boxed software, 1.44" floppies. The good old days. It also earned me a decent money. \-- Since then I've wrote thousands of code lines and stretched my expertise to leading development and product teams. I consider this project and those days to be my best tech-school, where I gained much more than in my BSc. Looking at the kids these days copy-pasting StackOverFlow solutions makes me think something is missing in their foundations.

</comment><comment> git-pull I think open source contributions / patches depending on the project can be helpful and impactful.

Merely giving back in _any_ sense helps. Sometimes open source patches are _not_ important in themselves, but taken as a whole make a big dent: A good portion (1/3? 1/2?) of my contributions are very trivial (typos, package updates, etc.)

I use a few things to track open source contributions: OpenHub ([https://www.openhub.net/accounts/git- pull](https://www.openhub.net/accounts/git-pull)), and a new thing called sourcerer.io: [https://sourcerer.io/tony](https://sourcerer.io/tony).

It goes back to my first patches which were tiny and failed to conform to the project's code standards :P I hope this can be encouragement that little wins build up.

There are also projects I've made that I personally deem important, but aren't known or are in a niche space. For instance, unihan-etl ([https://unihan- etl.git-pull.com](https://unihan-etl.git-pull.com)), a tool for extracting UNIHAN ([https://www.unicode.org/reports/tr38/](https://www.unicode.org/reports/tr38/)). If someone is in a situation where they need an extraction of Chinese/Japanese/Korean unicode characters, this tool can save them a lot of time.

There's more to the story: It's also a building block of a larger project, cihai: [https://cihai.git-pull.com](https://cihai.git-pull.com). I am planning on making this project a spiritual successor to Christoph Burgmer's cjklib ([http://cjklib.org](http://cjklib.org))

</comment><comment><USER44> I wrote an entire e-commerce inventory SaaS platform singlehandledly (frontend, backend, database, cache, nginx, blah blah blah) that had 100 users and about $30k/mo revenue.

Then I got kicked out by the owner high and dry after I refused to take sales calls and support calls on top of my developing responsibilities. :)

Software is still running today. It's probably at $50k/mo.

<comment><USER45> Wanna write a competing software solution?

If they didn't have an IP contract, I'm interested :D

<comment><USER44> The hard part in my eyes is the marketing/advertising. Getting a landing page built, on-boarding customers (every customer wanted custom development to fit their business), getting well written app store listings written, getting support + documentation written for the customer. Videos, images, graphics, blog articles. We'd be up against startups who get $15m+ in funding and have a 7 year head start.

I think the market space is beaten down. At first, we were going to do a free beta. That attracted nobody. Then $29/mo. Well, will you look at that? It's not profitable undercutting everybody because of something we didn't think of: support. Ok, let's try $99/mo. Well, that kind of works, but people are coming and going way too quickly. What finally worked is to do $99/mo per user, with a minimum of 3 users. All other companies in this space pretty much charge a $750-$3k onboarding fee because they have realized what a time suck you'll be.

I have proved I can build pretty much any SaaS platform (which I'm sure 100k people here could do). In my opinion, it isn't the technology part that is hard (CRUD API endpoints are trivial to say the least). The super hard part technology wise is good user interface. Naming technical things easy terms (your item in inventory... is it an item or a kit/bundle? ok... how many channels do you sell it on? ok, well, you have 3 _listings_ that are linked to your _kit /item_. Try getting that concept across)

Plus, after people choose a system, they invest a ton of time into it (their entire business lives and dies on it. Sync inventory + pricing for Amazon/Jet/Walmart/Shopify. Purchase orders. QuickBooks exports, yada yada). Not a lot of people signing up left and right, and if they were, they really probably weren't worth the headache (anybody can make a "mom and pop" e-commerce shop, but if you have no business/orders, all you have to do to fill an 8 hour day is take out your aggressions on the person on the other end of the phone supporting your failing business inventory software wise)

I'm down to write whatever, but we need marketing + advertising + everything else I just described.

<comment><USER28> If the two of you manage to pull this off, please update us. I would love to see a story of people meeting in the HN comments and go off and build something. I'm sure it has happened on here, but I never hear about it!

</comment></comment></comment></comment><comment><USER46> It's not really coding, but I helped with troubleshooting and analysis when Obamacare first rolled out.

There was quite a fire-- the front-end would crash, lines were endless, etc. The government quickly formed a Tiger Team, with contributors from various companies.

I didn't care for the way the legislation was formed, but I am proud of my involvement. I gave it 100%.

<comment><AUTHOR> Oh wow. I remember that. Cool to hear of your involvement.

</comment></comment><comment><USER47> # As a programmer

Some software for GAE, that may now be part of the SDK - at the time, circa 2010/2011, GAE wasn't being actively maintained (the employee in charge of the platform had other responsibilities and did not care for GAE).

The code allowed a user to define a model of the errors they expected to encounter, a retry algorithm, and a maximum amount of errors. It was used to do almost everything in the largest GAE app at the time, and one of the most profitable Google programs, and is essential for doing anything in an environment with expected transient failures.

# Back a decade or so when I was doing ops

'at' jobs to reset the firewall in 10 minutes, while we were remotely configuring a firewall. If we locked ourselves out, we wanted for the at job to execute. If we configured everything successfully, we cancelled it.

</comment><comment><USER48> The most important I can think about right now is a CLI Mac app to install apk/ipa on devices (iOS and Android).

You see, my company has about 10 apps, all sort-of maintained, that we manually test on several devices for each single feature (because not having bugs is very important).

Previously, devs (we are only 2 devs) were disturbed all the time to build apps and install them on specific devices.

Because I was fed up being disturbed all the time, I automated all builds, then created a CLI app to install the nightly build on all USB-connected devices at once. Then teached the QA guy how to SSH onto the build machine and invoke the command to install.

It's used daily, several times a day.

</comment><comment><USER49> wrote an entire CRM platform for a niche which is still my business today. revenue is at ~200,000 $ per month, profit margin is >60%.

Tech stack: MySQL, Java EE, JQuery, Bootstrap and the like. No big frameworks. All hosted on Google Cloud.

<comment><AUTHOR> Stories like this are incredible. If you ever want to go into detail with this story in an article or something, I'd love to read it.

<comment><USER49> Thank you, I don't enjoy writing anything else than code or short texts/comments though.

<comment><AUTHOR> I probably couldn't afford to pay you to change your mind but I could volunteer some time on a project or something in exchange for you answering a few questions that I could turn into an article about your success, perhaps? Win win?

<comment><USER49> Thank you for your offer. No offense, but that would be of no use for me. I learned that external outsourcing of development tasks is not effective at all if you want to focus on delivering quality that customers really love.

Another point is that my market is really not obvious at all and I want to have competitors as late as possible. Currently there are none I know of. Only competitors who solve parts of it which existed before me anyway.

</comment></comment></comment></comment></comment><comment><USER50> Like others, it depends upon what you mean by important.

In grad school I helped another PhD student by writing control software for a device used to assess the locality and severity of brain lesions. I got a tee shirt for doing that work.

</comment><comment><USER51> A ringbox mailbox multi-threaded implementation.

Whilst I'm sort of proud of the 'word at a time', always contiguous and zero copy aspects of it... the important bit is the metadata.

All the optimization was really to allow me to record metadata around...

* When was a message posted?

* When did it start to be handled?

* When was it finished being handled?

* What was the correlation ID? (ie. the ultimate causal source of the events chain)

...and then extract this data into a sqlite DB and either query that directly or to create message sequence diagrams with the mscgen tool.

Why is this important?

Because I have lost count of the really hard, gnarly real time bugs I have solved using this tool.

</comment><comment><USER52> For me, it's been codes that have been for internal use. One ran a room full of production machines. Another has been in use for a decade, and is the main utility for manufacturing a complex apparatus that requires a lot of adjustment and testing steps.

So each time one of these programs goes through its mainloop, a little bit of money comes into the kitty. ;-)

Possibly a coincidence, but these are also the programs that I was the most disciplined about writing so that they have been in production for years with extremely small and manageable lists of known bugs.

</comment><comment><USER53> I wrote an important piece of the business logic that compensate trasactions in the ATM circuit of my country.

I also wrote the transcoding and CMS component of a video streaming application that is used all around the world by several broadcasters. I played a decisive role in the optimization of many of the underlying processes.

It might not be fashionable here but all the work I did have been in C++, Java and .NET.

</comment><comment><USER54> I currently work for a company that is focused in increasing online privacy. Everything I write now supports this effort. I've never felt better about a job.

Second to that would be the games I wrote on my TI back in high school (90s) when I should have been learning trig. That and some late night script kiddie exploits got me on the path to a career in tech.

</comment><comment><USER55> Hmm, nothing too sexy. The most important code I've written was a tool to automate some business logic for schematics generation, hard to quantify the exact cost savings but it saves a couple of million/year (cost of writing off hardware built on a bad schematic) and hundreds of hours of engineer time / year.

</comment><comment><USER56> A long bunch of tests for a python RPC I was writing. My boss did rewrite the core code against the tests, so I could merge his code without even understanding it fully. And until now the test code is still healthy and growing, and it proves the core code to be working as expected.

</comment><comment><USER57> I worked in a advertising network company which is a major player of one city. I re-write the ad-serving algorithm to solve some of the problems. That piece of code is running 24/7 for 5+ years. If you are in that city and browsing the web. It will run through my code path.

</comment><comment><USER58> Contributions to open source software. Knowing that the code I wrote runs on millions of machines feels great.

Also, another favourite project of mine is my book, written in Markdown+LaTeX and hosted with Git. Writing and editing experience was great.

</comment><comment><USER59> The most important code I ever wrote was probably the control system for a submersible robot we developed in grad school. It was important not so much from a money standpoint, but because a whole group of graduate students got their Masters' and Doctoral degrees using it, it was sort of my bequest to humanity. And boy was it a hack...

I had decided to use a new single board computer on the robot that used a compact PCI bus, which at the time was a brand-new standard. It was very expensive - $25,000 - which was a whole lot of money for a university lab, but the computer had specs that we just couldn't beat with other existing single- board computers at that time.

There were no available compact PCI motor controller boards, so we had to use a motor controller board that was built for a different bus standard, and then convert from the Compact PCI system to the other board using a bridge chip. The particular motor controller board we chose was based on an 8-bit motor controller IC, the LM629. This particular chip uses memory-mapped 8-bit registers, and in order to communicate with it you have to write and read the registers in a very specific order. If you do anything in the wrong order, or you try to write to a read-only register, or vice-versa, the chip generates an error.

I was a decent low—level C programmer at that time, and was able to crank out the code in two days. But it didn't work. Whenever we tried to communicate with the chip, it threw an error. I went over the code with a fine-toothed comb, and I was absolutely certain it was all correct. I had no idea what was wrong. I was looking pretty bad to my advisor; I was the C stud, and I couldn't even write this simple device driver. And worse, I had recommended that we use this particular computer system, which cost $25,000, far more expensive than any other SBC we had ever bought, and now I couldn't make the thing work.

Finally, after banging my head against it for a week and making no progress, we threw up our hands and asked the motor controller board vendor if we could bring our system to their facility and get their help debugging it.

We arrived at the vendor and set up. Their programmer checked my code, and he couldn't find anything wrong with it either. After two days the owner took pity on us and asked his best engineer, a digital logic expert, to help us. He carted in a $20,000 digital logic analyzer and hooked it up and had me run my code. What he discovered was that when I had issued an eight-bit read, the chip saw a 16-bit read, which it wasn't expecting, so it threw an error, because the high-order byte was getting read from a write-only register. But the code was clearly issuing an 8-bit read. So where was the 16-bit read coming from?

It turned out the bridge chip had a bug. When it saw an incoming 8-bit read request on one bus, it translated it into a 16-bit read on the other, then threw away the most significant byte. We called the manufacturer, and were told "that's known, documented behavior - it's clearly spelled out in the manual." And when we checked, sure enough, it was - it was mentioned on page 48 in the third footnote, in 8-point type.

The solution we eventually came up with was to cut all of the address bus lines on the motor controller board and shift them to the right by one, and then take the least significant bit line and connect it to most significant line on the address bus. That way, access requests to any odd 16-bit memory address would map into unmapped register space so the LM629 wouldn't see them. Then I rewrote the code to only use even memory addresses. Worked like a charm. But I still feel sorry for the grad students who had that robot after I graduated. There was no way they ever figured out what I had done. Or why.

<comment><USER33> Improvise. Adapt. Overcome.

Thanks for sharing that nugget!

</comment></comment><comment><USER60> Tiny patch to OpenSSH, but it'll get onto millions of boxes eventually.

</comment><comment><USER61> I'd have to say the headless server infra/features for Windows server 2003. The previous dev quit saying it was impossible, but as a new engineer I didn't know any better.

</comment><comment><USER62> [https://github.com/prettydiff/getNodesByType](https://github.com/prettydiff/getNodesByType)

</comment><comment><USER63> Machine vision applications to inspect inkjet printheads during manufacturing. You've probably used a cartridge my apps inspected.

</comment><comment><USER64> Adventures in Game Development is the perfect example of the risks of giving assholes your money for crowdfunded projects.

The guy that runs it spent years bragging about doing drugs and drinking to all hours of the night with nothing to show for it and then shits on his backers for asking about the progress of the project (none).

<comment><USER65> Link to the Kickstarter?

</comment></comment><comment><USER66> Nothing.

<comment><USER67> Same. I don't think anything I've written is really important in the grand scheme of things. Important enough that someone will pay me to do it, yes. But not important, really.

<comment><USER68> My most 'important' thing was probably a novelty passcode for phones. The important part was the timing of getting it done, as I was low on funds and this allowed me to continue on the path I was onto (still to this day) instead of 'retreating' back home.

</comment></comment></comment><comment><USER69> "<!doctype html>"

Four years ago, I was hired to reboot the front-end development of a french search engine from a blank html page. It has millions of users now.

</comment><comment><USER70> tl;dr: the most important code I ever wrote saved us millions of dollars by setting `disabled="disabled"` on an html element

I don't know if this is the correct measure for "most important" but it is provably and measurably the most valuable (in terms of dollars) code that I have ever written.

I used to work at a fintech company. This company gave out loans. One of the main reasons you might get a loan at this company instead of a bank is because the bank refused to give you a loan. So, as you might imagine, this company needed to deal with a considerable default risk, and be very, very careful in its underwriting.

At one point, we had a minor crisis. The default rate was considerably higher than we had projected, and this was threatening the business. Without getting into details: this was potentially an existential risk to our business.

Preliminary analysis of the problem revealed a few significant causes. One: our underwriting rules were complicated, and manually applied. At the time we were working on a rules engine that would offload a lot of fiddly rule checks, but this was still a few months out. In the interim, people would manually check the spreadsheet and they made mistakes.

I was tasked with fixing this with a stopgap. So what I did was I added about 15 lines of code to our front-end. It collected a handful of stats (that were already being exposed to the front-end) that covered ~80% of the underwriting cases, and hard-coded the current underwriting rules on them. If the stats on a given loan didn't meet the threshold, and would therefore be rejected by our manual underwriters, my code disabled the 'approve' button.

The entire code was a function that looked something like

```javascript THRESHOLD_1 = 123; THRESHOLD_2 = 123; ... //etc

function buttonDisabled(){ if( stat1 < THRESHOLD_1 || stat2 < THRESHOLD_2 || ... //etc) { return true; } else { false; } } ```

plus the react binding necessary to attach this to the approve button.

I got this done start to finish in about two days (most of those days spend talking to PMs trying to figure out what the values of the THRESHOLD constants should be), and it was deployed in prod by the end of day 4. It was cheap, terrible, shitty code, but that was ok! Because it was throwaway code. We had an existing project to replace this with an actual rules engine, and it was on track to get rolled out two months later. So who cares about shitty code, it's getting replaced in two months. In the interim, speed was more important, and they got speed.

By my own numbers (based on estimates as I didn't have access to real numbers), I estimate that this code saved somewhere between $500k and $2M in defaults. Whatever it was, the company agreed. Every Friday afternoon the CEO would hand out recognition awards for someone who went above and beyond, and for this code I won the award three weeks in a row.

tl;dr: the most important code I ever wrote saved us millions of dollars by setting `disabled="disabled"` on an html element

</comment><comment><USER17> I got involved in the SAME era, reading the same QB tutorials (remember Tsugumo or Gradius?). It changed the trajectory of my life forever. Called another guy from the same era after finding his github page 1 or 2 years ago. He is a PhD making ~$300k on Wall Street and I'm a senior leader, only slightly behind him, doing tech consulting. Needless to say, writing code early puts you on an advanced path. Neither of us came from privileged families, but we found a need in the market for highly skilled programming combined with great communication. If you are reading this comment, you have 100% definitely used or seen one of the systems I have helped build. QB was the beginning for many of us. No doubt JavaScript will do similar things for this generation.

<comment><AUTHOR> I definitely remember seeing those names. I can't tell you how awesome it was for me to read this. If you ever want to connect and discuss some stuff, let me know. My email is j.horne2796 at gmail.

</comment></comment><comment><USER71> Literally a logstash clone. Was written in an emergency over like 6 hours on a weekend to prevent a P1 issue.

I've done some bugfixes and modifications over the years but it just keeps on trucking and doing exactly what I need it to do.</comment>


Show HN: iPhone case that mutes your microphone - <AUTHOR> My friend and I designed an iPhone case that mutes all the microphones so even if someone did remote turn on your mic, this could mute it.
https://www.kickstarter.com/projects/kevando/airstrip-zero <comment><USER2> Great idea. You should make it always muted and the user could flip a switch or slide something to ummute.

Also why not do a full privacy case? Sliding cover for cameras. Maybe faraday cage?

<comment><AUTHOR> oh man thats intense. we plan to release the CAD so hopefully someone can take it to that next level!

</comment></comment><comment><USER3> A great idea and something i would definitely buy. However, its crazy that we are at a stage where we have to willfully sabotage our devices to feel safe.

</comment><comment><USER4> Does it work for phone calls?

<comment><AUTHOR> That's a bit tricky. We figured it the kickstarter gets a good response we will make that better. As it stands, the iphone has several mics and the os uses which ever has the best audio</comment></comment>


Ask HN: How much is too much payload for a webpage? - <AUTHOR>

With tons of JavaScript Libraries, Extensive CSS Frameworks and "Cover" pictures a webpage/app can get quickly become very big (payload). How much is too much? <comment><USER2> 1 byte of javascript is too much.

</comment><comment><USER3> Yes,I think so. pay more get less for a web</comment>


Show HN: tmux.sh - <AUTHOR> https://github.com/bsandrow/tmux.sh

<comment><AUTHOR> This spawned from a thread[1] in the "Workflow in tmux" story[2]. There seemed to be a bunch of people that were frustrated because session grouping wasn't the default operating mode in tmux, so I whipped together this shell script that makes the behaviour the default.

[1] <https://news.ycombinator.com/item?id=5542227>

[2] <https://news.ycombinator.com/item?id=5541401>

<comment><USER2> BTW, this is beautifully tidy bit of shell programming.

</comment></comment><comment><USER3> Thanks, I was confused when tmux didn't act as gnu screen did when I first tried to use it for pair programming.

</comment><comment><USER4> Nice, although tmux -S /tmp/pairprog and tmux -S /tmp/pairprog attach isn't that hard to type :-)

<comment><AUTHOR> In this example, you are both connected to the same session. Each client can't focus on a separate window. It looks something like this:

             +</comment></comment><comment></comment><comment>-+
             | tmux server |
             +</comment><comment></comment><comment>-+
                /
           +</comment><comment>---+
           | session |
           +</comment><comment>---+
            /       \
      +</comment><comment>---+ +</comment><comment>---+
      | client0 | | client1 |
      +</comment><comment>---+ +</comment><comment>---+

\- `tmux server` is the 'backend' process listening on /tmp/pairprog

\- `client0` and `client1` are the 'frontend' processes connecting to the socket /tmp/pairprog.

\- `session` is the collection of windows that you are using.

The issue is that the currently active/focused window is an attribute of the session, meaning that all connected clients are always focused on the same window. What if you want to have each client focus on a separate window? This is behaviour that you get by default in screen, but you have to work a little more for in tmux.

The script is just a simple way to use session grouping, which would look like this:

             +</comment><comment></comment><comment>-+
             | tmux server |
             +</comment><comment></comment><comment>-+
                /        \
           +</comment><comment>---+ +</comment><comment>-----+
           | session |=| session-1 |
           +</comment><comment>---+ +</comment><comment>-----+
                |           |
           +</comment><comment>---+ +</comment><comment>---+
           | client0 | | client1 |
           +</comment><comment>---+ +</comment><comment>---+

Note the '=' between the sessions. I'm using this to denote that `session` and `session-1` are grouped, meaning that they share the same windows. Since each client is connected to a different session, they can switch windows independently.

<comment><USER5> It's one reason I hadn't used tmux before, i couldn't figure out a nice way to get this. I love to use screen this way on multimonitor setups, and tmux's other windowing features would make this awesome.</comment></comment>


Ask HN: how would you A/B test iPhone apps? - <AUTHOR>

patio11's A/Bingo post got me thinking.  How would you go about doing A/B testing for iPhone apps?
The issue, obviously, is the app store submission/approval cycle which makes changes slow to reach users.  (even without that, you probably wouldn't want to make users update their apps every day).
If the app is mainly web-based, it's pretty obvious, but what about native apps? <comment><USER2> I know very little about iPhone programming so forgive me if this is ludicrous but just thinking out loud...

We had an app launch on launchly awhile back that was basically trying to be the iPhone version of GetSatisfaction or UserVoice. You could plug in their code into your app and it would handle feedback and bug reports for you.

Maybe there's a market for something similar for A/B testing on iPhones. If it's a tricky problem to solve, even better cause then people will pay you for it.

Initial thought w/out knowing anything about the security model is can you set up config files or even remote code on a server somewhere and then access it from your code on the iPhone using an API key? If you can then you could maybe set up multiple config files on the server and have your code load different versions randomly and report back statistics...

Of course that brings up an interesting point. What would you be A/B testing in an iPhone app? The user has to have already downloaded/installed your app. At that point there's really not any landing page or funnel to test like there is on a website. Obviously you can still A/B test internals just to improve the app which will affect ratings which can affect downloads (conversions).

Anyways, just thinking out loud here.

<comment><USER3> do you remember the name of the iPhone support app?

<comment><USER2> Tap4Help

</comment></comment></comment><comment><USER4> If the screen which you want to A/B test is not the first screen, you can make background calls to your server and based on result decide which screen to show. Write to user settings when you want to permanently disable it.

Note:

i) Reasoning behind not having it as first screen as it really slows the application launch.

ii) You should make sure that if webservice call takes too long, just pick one default which is shown to user instead of waiting for result

iii) if you really want to do it for first screen, load and save the result in user settings for next launch while the application is running

</comment><comment><USER5> It's actually pretty simple to A/B test on App Store apps:

1\. Prepare two versions of each feature you want to test

2\. Generate random integer on first launch

3\. Save to NSUserDefaults

4\. Present A/B based on the value of a particular bit in the random integer

5\. Collect statistics and send back anonymously via NSURLConnection

Question is probably better suited to StackOverflow

</comment><comment><USER6> Guess:

\- Do fake A/B testing for your AppStore product page, toggle once a week and compare sales.

\- For the product itself, try usability testing face-to-face with potential users, using ad-hoc distribution.

</comment><comment><USER7> Design an iPhone app that's a CMS pulling in data streams (XML) and displaying them to users. Set the first queried data stream to be the A/B switch and all other data is pulled into the app dependent on the state of that switch. This is all assuming you're talking about testing within the app itself after it has been downloaded. (I'm an SEM/SEO UX guy, so this is out of my league, but I think that makes sense.)</comment>


The 2018 Web Developer Roadmap - <AUTHOR> https://codeburst.io/the-2018-web-developer-roadmap-826b1b806e8d <comment><USER2> Are people not understanding OSI model these days?

Is the flag icon the 'magic layer of mystery' now? _eye twitch_</comment>


This is what happens when you take Ayn Rand seriously - <AUTHOR> http://www.pbs.org/newshour/making-sense/column-this-is-what-happens-when-you-take-ayn-rand-seriously <comment><USER2> "There are two novels that can change a bookish fourteen-year old's life: The Lord of the Rings and Atlas Shrugged. One is a childish fantasy that often engenders a lifelong obsession with its unbelievable heroes, leading to an emotionally stunted, socially crippled adulthood, unable to deal with the real world. The other, of course, involves orcs." [http://krugman.blogs.nytimes.com/2012/04/27/a-is-not-a-it- se...](http://krugman.blogs.nytimes.com/2012/04/27/a-is-not-a-it-seems/)

</comment><comment><USER3> No better proof of the intellectual bankruptcy than the left can be found in the constant bashing of Ayn Rand -- and the companion ignoring of her philosophy - Objectivism. Or the book Atlas Shrugged, which is a 1,000 page logical argument of all the different ways that leftism is evil.

The left can't stand the risk of people actually reading the book before metaphorically burning it, and so they bash Rand and ignore Objectivism.

The reality is, if you read Atlas Shrugged, and you're a thinking being, you will no longer be a leftist afterwards.

Alas, now the Left wants to silence any dissent- calling it "hate speech" and on this site, literally making people who think independently invisible (if they aren't hellbanned.)

What a shame. What happened to tolerance? What happened to embracing facts, logic and reason?

<comment><USER4> Do you have any comments about the referenced essay? Because what you wrote seems like a tangential complaint rather than addressing anything in the essay.

What is the Objectivist interpretation of what happened with Sears and in Honduras? If those are incorrect or atypical examples of Objectivism as applied on a larger scale, what are the better examples of success stories?</comment></comment>