Ask HN: What source code is worth studying?   - <AUTHOR> This is one my favourite questions, asked by idlewords: https://news.ycombinator.com/item?id=879101
But its been a long time since then, and with a new set of programming languages, I believe there are new code bases that's worth studying about and learning from.
So, which code-base should I be reading about to improve myself? <comment><USER2> I think you get more benefit from reading code if you study something very close to what you are working on yourself, something in the same domain, in the same framework perhaps, or at least in the same programming language, at best something you are deeply involved in currently.

I never seem to get enough motivation to read deeply into random "grand" code bases like Lua or SQLLite, but some months ago I got into the habit of always studying a bunch of projects that use a given technology before I use this technology, and it greatly decreased the amount of time it takes me to get to a "idiomatic" coding style. So instead of diving in a random, I would recommend making researching existing code-bases related to what you are currently doing an integral part of your workflow.

<comment><USER3> I really enjoy doing this as well. Are you aware of any resources or metrics (number of contributors on github, etc.) to find which projects are "well crafted" in X framework/language?

Perhaps I overestimate how much risk there is in learning idiomatic practices from a project which is not actually all that idiomatic. I like the assurance that what I read is quality, especially with frameworks or languages I'm very new to where it can be tough to tell.

</comment></comment><comment><USER4> Slightly off topic, but Peter Seibel's take on the idea of code reading groups, and the idea of code as literature, is interesting: [http://www.gigamonkeys.com/code-reading/](http://www.gigamonkeys.com/code- reading/)

"Code is not literature and we are not readers. Rather, interesting pieces of code are specimens and we are naturalists. So instead of trying to pick out a piece of code and reading it and then discussing it like a bunch of Comp Lit. grad students, I think a better model is for one of us to play the role of a 19th century naturalist returning from a trip to some exotic island to present to the local scientific society a discussion of the crazy beetles they found."

The reason this is off topic is that it sounds like you were after interesting specimens anyway. I don't have any code examples as such, although if algorithms count I'm particularly fond of Tarjan's algorithm for finding strongly connected components in a directed graph, and the Burrows-Wheeler transform (as used in bzip).

</comment><comment><USER5> Fabien Sanglard [http://fabiensanglard.net](http://fabiensanglard.net) has some excellent code reviews on his website, particularly games.

You could read some of the code-bases he reviews, and _then_ read his review. You'll be able to compare and contrast your opinions with his, and if there's interesting variation you can blog about it ;)

<comment><AUTHOR> Thank you. I remember his Quake and Doom reviews. Will catch up on the others.

</comment></comment><comment><USER6> The Architecture of Open Source Applications book[0] gives a high level overview on many open source projects. It's a good starting point to dive into the code of these projects.

[0] [http://aosabook.org/en/index.html](http://aosabook.org/en/index.html)

<comment><USER7> Great series of books! There are three now, and a fourth is being worked on which is very relevant to this posts query. There isn't much too it yet, but its working title is 500 Lines or Less, and it aims to implement some manner of a working application in 500 lines or less. There is a GitHub repo [0] where the project is being coordinate.

[0] [https://github.com/aosabook/500lines](https://github.com/aosabook/500lines)

</comment></comment><comment><USER8> I've heard lots of people sing praises for Redis source - [https://github.com/antirez/redis](https://github.com/antirez/redis). A cursory look into the source shows a very well documented code-base. It's one of the top items in my to-read-some-day list. Salvatore is an excellent C programmer and takes a lot of pain in writing good documentation, despite his not so great English skills. A shout out for him, thanks for setting an example.

</comment><comment><USER9> To mix things up a bit, I'm going to give two very small examples of code that can be understood quickly, but studied diligently. Both are in JavaScript, which I notice you mention specifically in another comment:

[1] Douglas Crockford's JSON parser. Worth a look because it is excellently commented and is easily understandable [https://github.com/douglascrockford/JSON- js/blob/master/json...](https://github.com/douglascrockford/JSON- js/blob/master/json2.js)

[2] Bouncing Beholder. A game written in 1K of highly obfuscated code, which the author expands upon here. Worth it because it teaches some crazy optimisation techniques that are applicable to all programming, but also includes plenty of javascript-specific trickery. [http://marijnhaverbeke.nl/js1k/](http://marijnhaverbeke.nl/js1k/)

<comment><USER10> Anything Javascript code from Crockford I highly recommend. Well structured and without "hacks" that could cause confusion.

</comment></comment><comment><USER11> Python Sudoku Solver by Peter Norvig -- an elegant solution in one page of code. When I read this, I felt like code is art.

[http://norvig.com/sudoku.html](http://norvig.com/sudoku.html)

<comment><USER5> Tangential, but entertaining, is the TDD Sudoku [http://devgrind.com/2007/04/25/how-to-not-solve-a- sudoku/](http://devgrind.com/2007/04/25/how-to-not-solve-a-sudoku/)

As Ravi said:

Ron Jeffries attempts to create a sudoku solver – here, here, here, here and here. (You really ought to read these articles. They are ummm…{cough} …err…. enlightening.)

Peter Norvig creates a Sudoku Solver.

Compare. Learn.

[http://ravimohan.blogspot.se/2007/04/learning-from-sudoku- so...](http://ravimohan.blogspot.se/2007/04/learning-from-sudoku-solvers.html)

</comment></comment><comment><USER12>
      C -> Varnish
      PHP -> Yii
      Ruby -> Merb
      Scheme -> Arc
      Clojure -> Core
      JavaScript -> Multeor

Any languages in particular that you're interested in not covered above?

<comment><AUTHOR> Thanks for this list.

I was mostly looking for Python, Javascript, Haskell and C#. Any help regarding that?

Also, as I believe this thread will also help others, you can go ahead and post about any other code-bases for other languages.

<comment><USER13> Modules within the Python standard library are very well written. The source code also provides very good examples of decent unit tests.

<comment><USER14> Agreed.

Here is a link to cpython 2.7 libraries: [http://hg.python.org/cpython/file/70274d53c1dd/Lib](http://hg.python.org/cpython/file/70274d53c1dd/Lib)

Those that are implemented in C are in the "Modules" folder from the top level.

I think you [OP] will get the most benefit from reading libraries that you use often because it will give you some direction.

If there are 3rd party libraries you use heavily those will be interesting too.

It is very very difficult to just pick up megabytes of code and start reading them and find it useful. You will be able to pick up style and conventions but not really high-level engineering decisions.

My suggestion is to take software that you use regularly and run it through a debugger. Since you use it you know the problem domain. And with the debugger the code you're reading gets real context. I've done this with Git for example.

And also look at the design documents for big OSS projects.

</comment></comment></comment></comment><comment><USER15> Erlang: Riak [https://github.com/basho/riak](https://github.com/basho/riak) Riak is actually a layering of a few different projects including Riak KV, Yokozuna (Solr), Riak Core, etc. It was grown out of the Dynamo paper.

Haskell: Snap [https://github.com/snapframework/snap](https://github.com/snapframework/snap) Snap is another project built in layers (snap-server, io-streams, snaplets, snap-core). The 1.0 release makes some pretty massive structural changes behind the scenes changes with minimal breakage of the public api and io- streams is a very nice api to work with.

JavaScript: Underscore.js [http://underscorejs.org/docs/underscore.html](http://underscorejs.org/docs/underscore.html) Underscore is a utility library that gives a nice overview of various techniques in JS, such as how to handle equality, use of apply, ternary operators, etc. Many functions have fallbacks to ECMAScript 5 native functions.

<comment><USER16> Reading the Underscore and Lodash sources was hugely beneficial to me. If nothing else, it taught me how to reimplement what I could and drop the dependencies in my libraries. I find the whole "vanilla js" meme a bit snarky and elitist, but it really does make an impact if you are writing a lot of modules used by others.

</comment></comment><comment><USER17> I'm partial to the Tcl C code:

[https://github.com/tcltk/tcl/blob/master/generic/tclFCmd.c](https://github.com/tcltk/tcl/blob/master/generic/tclFCmd.c)

It's very nicely commented and has a nice, easy to read style throughout ( _except_ for the regexp files).

</comment><comment><USER18> The Linux Kernel

Very clean (mostly) and very revised C code, following a strict code convention

(Of course it's kernel code, so some things don't apply to userspace, still)

</comment><comment><USER19> The sources to Lua are pretty darn great:

[http://www.lua.org/source/5.2/](http://www.lua.org/source/5.2/)

<comment><USER20> Here's is Mike Pall's ( the originator of LuaJIT ) guide to reading the Lua source code: [http://www.reddit.com/comments/63hth/ask_reddit_which_oss_co...](http://www.reddit.com/comments/63hth/ask_reddit_which_oss_codebases_out_there_are_so/c02pxbp)

<comment><USER19> Wow, great find! That's from 6 years ago - truly a gem in the reddit layers .. thanks for that!

</comment></comment></comment><comment><USER21> Please enjoy the source code of PostgreSQL (any version, but latest is generally recommended) core. It is very well factored, and typically also very well commented. This community cares a _great_ deal about code quality, because they are so clear on the relation between readability, diagnosability, and execution correctness.

<comment><USER22> I second this.

With most large and modular systems in C (think Linux kernel), you're completely lost and the internal architecture is opaque.

PostgreSQL's source code is a marvel of clarity.

</comment></comment><comment><USER23> Honestly, aside from learning to express a few extremely specific patterns in your language of choice concisely and elegantly and reminding yourself of the existence of certain libraries and utility functions so you don't accidentally waste time reinventing them, I think reading source code is a pretty useless exercise unless you also have a detailed record of how that source code came to exist in its present form. Until there is some revolutionary new tool for generating a human-understandable narrated history of large-scale design decisions from a source control history, your time will almost certainly be better spent reading textbooks that incrementally develop a piece of software over several chapters. Even that is cheating -- the authors know exactly where they want to end up and they won't include all the missteps they made when they first started writing similar programs. But it's still loads better than the alternative. Just as sitting in a law school library absorbing an encyclopedic knowledge of the law won't really train you to make arguments that will fly in front of a judge, reading a code base as a dead, unchanging document won't teach you what it is to live in that code.

<comment><USER24> I sort of agree, and sort of disagree.

It is possible to make misteps gracefully - that is, even when making mistakes you can mitigate the problems by writing clean code and trying to make it fit nice patterns you've already seen.

Sure, you can't copy directly, but you can get a feel for what is nice and isn't by looking at lots of code that has reached it's goal, and thus get an intuition for code smells.

Further, seeing how principles and patterns are used elsewhere helps take abstract concepts and turn them into real examples - for me anyway this is vital for my learning of anything.

</comment></comment><comment><USER25> The plan9 operating system

* The lack of ifdef's that make cross compiling a breeze

* It is easy to understand, compare to reading the Linux kernel

[http://plan9.bell-labs.com/sources/plan9/sys/src/](http://plan9.bell- labs.com/sources/plan9/sys/src/)

</comment><comment><USER26> Take a look at Redis sometime. You might want to actually work on it a bit to help internalize what you're reading. Here are a couple of articles that might help get you started:

[http://pauladamsmith.com/articles/redis-under-the- hood.html](http://pauladamsmith.com/articles/redis-under-the-hood.html)

[http://www.starkiller.net/2013/05/03/hacking-redis-adding- in...](http://www.starkiller.net/2013/05/03/hacking-redis-adding-interval- sets/)

</comment><comment><USER27> Javascript/Node.js: pretty much anything written by [https://github.com/visionmedia](https://github.com/visionmedia) (his less popular libraries are not very well commented though) [https://github.com/jashkenas/underscore](https://github.com/jashkenas/underscore)

Scheme (and functional programming in general): examples/exercises from the SICP book

</comment><comment><USER28> I learned a lot from the Cocotron source:

[https://code.google.com/p/cocotron/source/browse](https://code.google.com/p/cocotron/source/browse)

It's a free cross-platform implementation of Apple's Cocoa, so there's a lot of stuff there. But the project is well organized, and almost everything is written in a minimalist oldschool Objective-C style.

I've looked at some other cross-platform frameworks, and they are often hard to understand because they have been developed by a large group of developers and include lots of complex optimizations and platform-specific code paths. Cocotron is not as finely tuned as Apple's CoreFoundation (for example), but much more readable.

</comment><comment><USER29> I really enjoyed skimming through Ian Piumarta's Maru, a Lisp in C, very pretty code, very concise. (I already mentioned it in other topics)

[http://piumarta.com/software/maru/](http://piumarta.com/software/maru/)

</comment><comment><USER30> I found the annotated source code of the underscore.js to be very educational: [http://underscorejs.org/docs/underscore.html](http://underscorejs.org/docs/underscore.html)

<comment><USER31> Worth pointing out that the tool used to produce the annotated version is open source, and annotated by running it against its own source code: [http://jashkenas.github.io/docco/](http://jashkenas.github.io/docco/)

</comment></comment><comment><USER32> C -> Redis

I haven't written any C for years, but really enjoyed skimming through Redis codebase, it's so clean, easily understandable and extensible.

</comment><comment><USER33> My personal list (mostly imperative languages)

 _C++_ : (Complex software with elegance + performance )

      Dart source code

      V8 source code (Same people as Dart)

      LevelDB

      Chrome (the only downside: too much virtual dispatch ->   "javism")

_C:_

      SQLite

      Redis

      Nginx

      Solaris and Freebsd

_Java:_

      Rich Hickey implementation of the clojure runtime in Java
     (it was there in 2009.. maybe now this is in clojure itself??)

_Go:_

      The Go standard libraries

</comment><comment><USER34> "Beautiful Code" is worth a read-through, particularly for the commentary.

(One thing that I still remember years on is the "drop of sewage" example.)

</comment><comment><USER35> I learned a huge amount about how real operating systems are put together and the compromises that get made by reading the V6 Unix source via John Lions Commentaries (yes...I had a photocopied copy). Made exploring the BSD 4.2 and 4.3 source trees (another worthwhile exercise) much easier. I suppose if I was starting out today and not in 1985 I'd look at xv6 or Minix.

</comment><comment><USER36> Python => SQLAlchemy

Very clean, feature-rich yet pragmatic and well documented. [https://github.com/zzzeek/sqlalchemy](https://github.com/zzzeek/sqlalchemy)

<comment><USER37> Yes! I couldn't agree more on this one. Such a beautifully written library.

</comment></comment><comment><USER38> I'd echo the advice to read the Arc source, and I'd add the various versions of Quake (C, C++). I learned a lot reading John Carmack's code.

<comment><USER39> Quake 1 and 2 source code was excellent to go through. I'd imagine the Quake 3 Arena source would also be great but haven't done that yet.

</comment></comment><comment><USER40> Also can someone suggest what is the best way to approach code reading? When I open a library in Python, I am not sure where to start reading, just a bunch of files. Should I randomly pick one file and start reading from there? Is there any common strategy?

<comment><USER41> I don't get much out of simply reading code. I have to get my hands in there and see how it works.

I load it into a repl and play around. See how changing little things effects tests. I add print statements to give a narrative. I draw diagrams of the code flow, especially startup, shutdown and sometimes error/exception handling.

</comment></comment><comment><USER42> Minix OS source code [http://git.minix3.org/?p=minix.git](http://git.minix3.org/?p=minix.git)

</comment><comment><USER43> I suggest the source code of TeX. Not new, but still very interesting to read.

source that needs some postprocessing (tangle/weave):

[http://mirrors.ctan.org/systems/knuth/dist/tex/tex.web](http://mirrors.ctan.org/systems/knuth/dist/tex/tex.web)

PDF from the source (including hyperlinks)

[https://www.tug.org/texlive/devsrc/Master/texmf- dist/doc/gen...](https://www.tug.org/texlive/devsrc/Master/texmf- dist/doc/generic/knuth/tex/tex.pdf)

</comment><comment><USER44> SBCL or CMUCL -- Lisp compilers written in Lisp.

</comment><comment><USER45> Slight tangent to your question, but one thing I have noticed recently is that having to deal with really crap code inspires me to do my own better.

I inherited a colleagues work after she left, and it was horrible. But I thought about why it was horrible, and how to make it better. _What would it look like if it was done well?_

Even with my own code, if I look at something I did 6 months ago, and it doesn't make sense straight away, the it can usually be improved.

<comment><USER46> It frightens me how my future replacement is probably going to think "gee, that guy was horrible" unless he knows all the historic context and reasons why the code was written the way it was written.

<comment><USER27> > unless he knows all the historic context and reasons

That's what comments are for :) It's not only about your future replacement, it's also about your future self.

</comment></comment></comment><comment><USER47> For all low-level I/O details (fflush/fsync/fsyncdata on files/directories after creation/renaming), I've used to read MySQL routines, pretty simple to understand: [https://github.com/twitter/mysql/tree/31d6582606ddf4db17ad77...](https://github.com/twitter/mysql/tree/31d6582606ddf4db17ad77b8f427674c1e5a05dd/mysys)

</comment><comment><USER48> Any suggestions for smaller codebases? A lot of these are great and you'll pick up idioms here and there, but they're _massive_.

<comment><USER49> I like the Fossil source control system - its not so big and really impressive.

Here is a link to the self hosted source code: [https://www.fossil- scm.org/index.html/tree?ci=trunk](https://www.fossil- scm.org/index.html/tree?ci=trunk)

</comment></comment><comment><USER50> Not a specific codebase, but I went through "Code Reading"[0] many years ago, I found it interesting. Most reviews are not very positive though, so maybe it was just at the right point for me.

[0] [http://www.amazon.com/Code-Reading-Open-Source- Perspective/d...](http://www.amazon.com/Code-Reading-Open-Source- Perspective/dp/0201799405)

</comment><comment><USER51> The most interesting things to read are those where a programmer has done something cleverly, but this only needs to happen when your language or libraries make it hard for you to begin with. Aside from low-level performance intensive functions, the best code is not interesting to read - it just reads like statements of fact.

</comment><comment><USER52> [http://source.roslyn.codeplex.com/](http://source.roslyn.codeplex.com/) for high performance, immutable C# code.

You'll see some differences from more relaxed C# projects (e.g., we avoid allocations like the plague), but I'd say we have pretty good style. ;)

</comment><comment><USER53> Eric S. Raymond wrote a book The Art of Unix Programming [1] that has many "case studies" as well as recommendations of which software/RFCs are particularly worthy of study.

[1] [http://www.faqs.org/docs/artu/](http://www.faqs.org/docs/artu/)

<comment><USER54> Except that Eric Raymond doesn't know what the hell he's talking about, and the main point of everything he writes is ideological warfare to tear down Richard Stallman's work and promote his own career as a pundit and batshit crazy racist right wing whack job.

If you really want to read something by Eric Raymond, you can start here, but you'll need to take a shower afterwards:

[http://esr.ibiblio.org/?p=129](http://esr.ibiblio.org/?p=129)

"In the U.S., blacks are 12% of the population but commit 50% of violent crimes; can anyone honestly think this is unconnected to the fact that they average 15 points of IQ lower than the general population? That stupid people are more violent is a fact independent of skin color." -Eric S. Raymond

<comment><USER53> I'll agree that's rather disturbing.

However, does it detract from his technical works? I didn't find TAOUP to be a work of someone that "doesn't know what the hell he's talking about."

<comment><USER54> Rather disturbing, yet perfectly typical.

One good example of the problem with his "technical" works and his lack of actual experience with the things he likes to talk about so much, is that he makes and promotes outrageously incorrect claims like:

[https://en.wikipedia.org/wiki/Linus's_Law](https://en.wikipedia.org/wiki/Linus's_Law)

"Given enough eyeballs, all bugs are shallow."

When in fact:

Given ANY number of eye, "all" bugs are NOT shallow.

Some bugs are NEVER "shallow".

And only a FEW eyes are qualified to see some bugs, while MANY eyes are totally unqualified, including his own:

His mouth is certainly not qualified to make sweeping generalizations about "all" bugs, given his lack of experience as a programmer, and his spectacular public failure at auditing code in his pathetic attempt to discredit the now- exonerated scientists whose code predicted global warming (described below).

Neither "enough eyeballs" nor "the right eyeballs" are a GIVEN, even for open source software.

"Not enough eyeballs" (or "ZERO eyeballs" as he loves to claim) are NOT a GIVEN for proprietary software, because you can license much proprietary source code, and some proprietary source code is available for you to read and audit for free, under licenses like Microsoft's "Shared Source" license.

[https://en.wikipedia.org/wiki/Shared_source](https://en.wikipedia.org/wiki/Shared_source)

And qualified eye balls are NOT FREE, and usually very busy being well paid to look at much more interesting things than poorly written buggy code like OpenSSL. I doubt that Eric Raymond has contributed any of the profits from his books or VA Linux stocks to Theo De Raadt or anyone else who actually takes the long time and tedious effort to actually audit code.

Wikipedia points out:

>In Facts and Fallacies about Software Engineering, Robert Glass refers to the law as a "mantra" of the open source movement, but calls it a fallacy due to the lack of supporting evidence and because research has indicated that the rate at which additional bugs are uncovered does not scale linearly with the number of reviewers; rather, there is a small maximum number of useful reviewers, between two and four, and additional reviewers above this number uncover bugs at a much lower rate. While closed-source practitioners also promote stringent, independent code analysis during a software project's development, they focus on in-depth review by a few and not primarily the number of "eyeballs".

And then there's the fact that Eric Raymond had the nerve to name and blame the "law" on Linus instead of taking "credit" for it himself.

And of course he also has the nerve to attempt to defend his "law", after we've just gone through three HUGE security holes in open source software that would have been discovered long ago, if only "Linus's Law" were true. On his blog, he constructs a straw man argument that "proprietary software is worse than open source software", which does not in any way support his claim about "all bugs being shallow".

[http://esr.ibiblio.org/?p=5665](http://esr.ibiblio.org/?p=5665)

Nor does he address many of the valid points that people raise, in the wikipedia article itself I just quoted, or that people raised in response to his blog posting.

To quote Theo De Raadt: "My favorite part of the "many eyes" argument is how few bugs were found by the two eyes of Eric (the originator of the statement). All the many eyes are apparently attached to a lot of hands that type lots of words about many eyes, and never actually audit code."

The little experience Raymond DOES have auditing code has been a total fiasco and embarrassing failure, since his understanding of the code was incompetent and deeply tainted by his preconceived political ideology and conspiracy theories about global warming, which was his only motivation for auditing the code in the first place. His sole quest was to discredit the scientists who warned about global warming. The code he found and highlighted was actually COMMENTED OUT, and he never addressed the fact that the scientists were vindicated.

[http://rationalwiki.org/wiki/Eric_S._Raymond](http://rationalwiki.org/wiki/Eric_S._Raymond)

>During the Climategate fiasco, Raymond's ability to read other peoples' source code (or at least his honesty about it) was called into question when he was caught quote-mining analysis software written by the CRU researchers, presenting a commented-out section of source code used for analyzing counterfactuals as evidence of deliberate data manipulation. When confronted with the fact that scientists as a general rule are scrupulously honest, Raymond claimed it was a case of an "error cascade," a concept that makes sense in computer science and other places where all data goes through a single potential failure point, but in areas where outside data and multiple lines of evidence are used for verification, doesn't entirely make sense. (He was curiously silent when all the researchers involved were exonerated of scientific misconduct.)

Eric Raymond's standard technique is to stonewall and ignore valid criticism, while viciously attacking his critics. You can see that behavior consistently applied in most of his blog postings, comments, public statements and publications.

An archetypical example is his mean spirited name-calling defense of Russell Nelson, who was acting as President of the Open Source Initiative, a position that Raymond had just been kicked out of because his divisive in-fighting and life-long jihad against Richard Stallman was embarrassing them and damaging their reputation -- Russell was his replacement: OOPS!

After having been appointed President, Russell Nelson posted a blog entry entitled "Blacks are lazy", which of COURSE drew a lot of criticism, because it was obvious race baiting, and riddled with logical fallacies and racist bigoted presumptions. Russell expressed that it was "poor writing" and withdrew the blog posting, and resigned his position as President of the Open Source Initiative.

The original blog posting can be seen in the comments section of his wikipedia page, so you can draw your own conclusions:

[https://en.wikipedia.org/wiki/Talk:Russ_Nelson#Blacks_are_la...](https://en.wikipedia.org/wiki/Talk:Russ_Nelson#Blacks_are_lazy)

Russell agreed with his critics that his blog posting was wrong -- although as to HOW wrong, he still disagrees with most critics, and he's generalized his argument to "everyone is lazy" and has characterized the criticism of him as "slander":

[http://blog.russnelson.com/economics/blacks-are- lazy.html](http://blog.russnelson.com/economics/blacks-are-lazy.html)

So, now that I've explained the background, I will demonstrate what I mean by how Eric Raymond typically constructs his arguments to support his political agenda, by ignoring valid criticism and turning it around on the critic by calling people names:

Even though Russell agreed the article was badly written, took it down, and voluntarily resigned, Eric demanded that OSI not only SUPPORT Russell, but waste their precious money, time, energy and reputation FIGHTING a BATTLE based on his own extreme right-wing libertarian "principles" against Russell's critics (who he called "FOOLS" and "THUGS"), which had NOTHING at all to do with open source software:

[http://www.eweek.com/c/a/Linux-and-Open-Source/New-OSI- Presi...](http://www.eweek.com/c/a/Linux-and-Open-Source/New-OSI-President- Steps-Down/#sthash.EJtgGdxJ.dpuf)

"The people who knew Russ as a Quaker, a pacifist and a gentleman, and no racist, but nevertheless pressured OSI to do the responsible thing and fire him in order to avoid political damage should be equally ashamed," Raymond said. "Abetting somebody elses witch hunt is no less disgusting than starting your own."

"Personally, I wanted to fight this on principle," Raymond said. "Russ resigned the presidency rather than get OSI into that fight, and the board quite properly respected his wishes in the matter. That sacrifice makes me angrier at the fools and thugs who pulled him down."

Since both Eric Raymond and Russell Nelson lost their leadership positions as President of the Open Source Initiative because of their bigoted, racist, divisive and very public beliefs, you can guess which side of the Brendan Eich controversy they came down on:

"My first thought on hearing of the resignation of Brendan Eich as CEO of Mozilla: Congratulations, gay activists. You have become the bullies you hate." -Eric Raymond

And this from the same self avowed "cheerful gun nut" who threatened Bruce Perens:

[https://lists.debian.org/debian- devel/1999/04/msg00197.html](https://lists.debian.org/debian- devel/1999/04/msg00197.html)

"Damn straight I took it personally. And if you ever again behave like that kind of disruptive asshole in public, insult me, and jeopardize the interests of our entire tribe, I'll take it just as personally -- and I will find a way to make you regret it. Watch your step."

Bruce Perens Dead [http://geekz.co.uk/lovesraymond/archive/bruce-perens- dead](http://geekz.co.uk/lovesraymond/archive/bruce-perens-dead)

Anyway, back to the criticism of TAoUP and Raymond's other technical claims to fame and self aggrandizing Autohagiography:

Everything he writes is deeply tainted with his one-sided partisan ideology and narcissistic self promotion, which is not just limited to Microsoft bashing, but to extreme right wing libertarian politics and guns. You can see that by the changes he made to the "Hacker's Dictionary", and you can see that in everything else he writes.

I've posted some typical reviews of the book in the other message.

<comment><USER53> Well thank you for taking the time to give critique. I was hoping to return to the book at some point and work through the suggested readings in more detail. I will definitely approach it with more caution a second time round and even more so when recommending it to others.

As an aside, how do you know so much about Mr Raymond? :) That's an awful amount of very specific detail.

<comment><USER54> It's pretty well known stuff in the Free Open Source Software Dramatic Political Soap Opera Scene, since he always tries so hard to get attention by writing outrageous bullshit on his blog and throwing tantrums on mailing lists, like this: [http://www.redhat.com/archives/fedora-devel- list/2007-Februa...](http://www.redhat.com/archives/fedora-devel- list/2007-February/msg01006.html)

Rational Wiki has some pretty extensive stuff about him: [http://rationalwiki.org/wiki/Eric_S._Raymond](http://rationalwiki.org/wiki/Eric_S._Raymond)

And then of course there's "Everybody Loves Eric Raymond": [http://geekz.co.uk/lovesraymond/archive/show-them-the- code](http://geekz.co.uk/lovesraymond/archive/show-them-the-code) [http://geekz.co.uk/lovesraymond/archive/moral- compassed](http://geekz.co.uk/lovesraymond/archive/moral-compassed) [http://geekz.co.uk/lovesraymond/archive/microsoft- censorship](http://geekz.co.uk/lovesraymond/archive/microsoft-censorship) [http://geekz.co.uk/lovesraymond/archive/sell- out](http://geekz.co.uk/lovesraymond/archive/sell-out) [http://geekz.co.uk/lovesraymond/archive/two-one-joke- ponies](http://geekz.co.uk/lovesraymond/archive/two-one-joke-ponies) [http://geekz.co.uk/lovesraymond/archive/gun- linux](http://geekz.co.uk/lovesraymond/archive/gun-linux) [http://geekz.co.uk/lovesraymond/archive/terrorismistic](http://geekz.co.uk/lovesraymond/archive/terrorismistic) [http://geekz.co.uk/lovesraymond/archive/mundane- name](http://geekz.co.uk/lovesraymond/archive/mundane-name) [http://geekz.co.uk/lovesraymond/archive/the-redhat- package-m...](http://geekz.co.uk/lovesraymond/archive/the-redhat-package- mangler) (that last one is about the tantrum I linked to above)

I've known Eric Raymond and Richard Stallman since the 80's, and I can confirm that Raymond has always been that way, isn't anything like the "hacker" he claims to be, and instead of writing or auditing code, he has made his career by self aggrandizing himself and tearing down Richard Stallman, who is and will always be a much better and more successful person than he is.

But the he got even crazier, and went off the deep end after 9/11.

His "many eyes" law that he shamelessly promotes has given many people and organizations a false sense of security in open source software, and that's led to many huge commercial corporations taking the free stuff without contributing any money or time back, and building all kinds of critical internet infrastructure on top of software like OpenSSL. And you know what that led to.

When he claimed that the mean old gays were bullying poor Brendan Eich, and his friend Russell Nelson took up and defended his argument, it made me recognize a pattern that explains their motivation very well:

Eric Raymond and Russell Nelson and Brendan Eich all served as the head of major free open source software companies: Eric Raymond was the first president of the Open Source Initiative, Russell Nelson was the second taking over when he resigned, and then resigned himself shortly thereafter, and Brendan Eich was CEO of Mozilla.

All three of them made bigoted statements and performed bigoted actions, and as a consequence of their own speech and actions, and of their high visibility leadership positions of free open source companies, they each felt compelled to resign from their jobs, and now feel very sorry for themselves because of how other people reacted, not because of how they acted.

It's disgusting how Eric and Russell are now whining about the mean "intolerant gay bullies" who didn't respect Brendan's right to be intolerant of oppressed minorities. They're just projecting from their own experiences as ousted bigots. The mean old community just couldn't tolerate their bigoted divisive beliefs which were embarrassing and damaging the free open source software movement.

Russell Nelson goes as far as to disagree with Karl Popper and other philosophers about The Paradox of Tolerance, which states that it's justified to be intolerant of tolerance: [https://en.wikipedia.org/wiki/Paradox_of_tolerance](https://en.wikipedia.org/wiki/Paradox_of_tolerance) \-- Russell argues that it's "baby thinking" to "tolerate everything but intolerance": [http://blog.russnelson.com/politics/tolerating- intolerance.h...](http://blog.russnelson.com/politics/tolerating- intolerance.html)

That's their standard operating procedure, of ignoring criticism and calling their critics names instead of responding with logical arguments. So Karl Popper is a baby thinker in Russell Nelson's mind.

So naturally Raymond and Nelson both feel sorry for Eich. They're birds of a feather, cut from the same cloth: they all lay down with the same dogs, and wake up with the same fleas.

So what does it say about Eich that two of his most sympathetic and vocal defenders were also kicked out of their leadership positions in a Free Open Source Software company, because of divisiveness and bigotry, just like he was?

Eric Raymond and Russell Nelson are far beyond redemption. And Brendan Eich finally put himself into the same boat as they are, and it's all his own damn fault, so of course those guys are his biggest advocates and defenders, and they all deserve each other.

And now Eich's legacy is not just tarnished by his donation to support Proposition 8, but by the fact that two of the most notorious douchebag in the free open source software community have come out of the woodwork screeching a full throated defense of him.

I think it's wonderful that the community refused to be led or fooled by people like them, who would pay money to make TV commercials demonizing gays and destroying sex marriages, or race bait and call the victims of their own bigotry bullies for standing up for themselves and exercising their right to free speech.

</comment></comment></comment></comment></comment></comment><comment><USER55> Anything you find interesting or find yourself using frequently.

A less glib answer try Brogue: [https://sites.google.com/site/broguegame/](https://sites.google.com/site/broguegame/)

A very interesting roguelike with interesting constraint-based features.

</comment><comment><USER56> Python: Flask (and related projects)

</comment><comment><USER57> I had a read through the PCSX2 emulator recently, that was quite interesting: [https://github.com/PCSX2/pcsx2](https://github.com/PCSX2/pcsx2) it's a complex project in what was surprisingly readable C++ code.

</comment><comment><USER58> The old jQuery 1.6.2 code by John Resig is a good start for studying good JavaScript coding practices [http://robflaherty.github.io/jquery-annotated- source/](http://robflaherty.github.io/jquery-annotated-source/)

</comment><comment><USER59> I'm fascinated by concurrent programming. I find that reading classes from Java's java.util.concurrent package gives me very good practical insights as to what goes into building a concurrent class. My all time favorite is ConcurrentHashMap :)

</comment><comment><USER60> I made this tool: [http://codingstyleguide.com](http://codingstyleguide.com) to improve the way I code for different languages and not get lost with too much programming information and it's helping me a lot.

</comment><comment><USER61> Anything by Fabrice Bellard (Google him, it's worth it).

</comment><comment><USER62> OpenSSL

</comment><comment><USER54> The original source code to Zork in MDL. It doesn't matter if you don't know MDL. It's such beautiful code that it just explains itself to you. And if you've played Zork, it's like being invited to explore the underground backstage areas of Disneyland.

[http://simh.trailing-edge.com/games/zork-mdl.zip](http://simh.trailing- edge.com/games/zork-mdl.zip)

</comment><comment><USER63> It's not great code (though I'm working to make it so), and perhaps not the intent of this question - but if you want to looking at a 25+ year old codebase that's being refactored, check out LibreOffice, especially the VCL component:

[http://cgit.freedesktop.org/libreoffice/core/log/vcl/](http://cgit.freedesktop.org/libreoffice/core/log/vcl/)

</comment><comment><USER64> For PHP, I've been very impressed by Phabricator's code (and the related phutils library). It's worth looking at the git commits as well to see just how clean and structured commits can be. I'm much more impressed by it than by any PHP framework code I've read (and I've read Zend, Symfony2, li3, codeigniter as well as custom frameworks)

<comment><USER65> [https://github.com/facebook/phabricator](https://github.com/facebook/phabricator)

</comment></comment><comment><USER66> Lots of great suggestions here, but I'm interested in _how_ you go about reading source code, especially very large codebases?

<comment><USER7> I'm interested in this as well. Working on tooling to make this a more efficient process is something that I daydream about often, so it would be interesting to hear some perspectives.

Do you generate tags and hop around functions as you discover them? Do you do a high level overview of the important bits first, and then dive in later? I am sure it is different for everyone, but would still be interested to read about others approaches.

I've had this idea for awhile about bringing up a project in a methodical way in its source control history, and adding new features in a similar manner, so that it would be easier to introduce a codebase to those starting out in it. The problem with lots of large codebases is that as time goes on, configuration details or special cases are added on that obscure the meat of the program. If it were trivial to see the early version, and its evolution, it would be easy to pick out the mental model of what the code actually does.

</comment></comment><comment><USER67> Find yourself a copy of this. Not only did it play a crucial role in the history of the UNIX/Linux world, it is a gold mine for understanding operating systems. [http://en.wikipedia.org/wiki/Lions%27_Commentary_on_UNIX_6th...](http://en.wikipedia.org/wiki/Lions%27_Commentary_on_UNIX_6th_Edition,_with_Source_Code)

</comment><comment><USER68> In the .NET world, shanselman has a series of _Weekly Source Code_ blog posts and most recently posted a list of seven 'interesting books about source and source code'.

[http://www.hanselman.com/blog/CategoryView.aspx?category=Sou...](http://www.hanselman.com/blog/CategoryView.aspx?category=Source+Code)

</comment><comment><USER69> There is a good book on this theme [http://aosabook.org/en/index.html](http://aosabook.org/en/index.html)

, where the authors actually go deep into the design & architecture of selected _well designed_ open source projects e.g. llvm, git, freeswitch, etc.

Highly recommended !

</comment><comment><USER70> I think 2 suggestions by plinkplonk in the original thread would be still relevant:

Common Lisp - "Paradigms of Artificial Intelligence Programming" by Peter Norvig and "On Lisp" by Paul Graham

C - "C Interfaces and Implementations"

Minix 1 and XMonad are also very good suggestions too.

</comment><comment><USER71> C -> nginx C++ -> Chrome

<comment><USER72> When you read any C++ codebase remember that there are many dialects and so just because something is a good idea in one doesn't mean that it is in another and that you should prefer that way without understanding the reasoning behind it.

</comment></comment><comment><USER73> If you are into java, ElasticSearch is very nicely written by Shay Banon.

[https://github.com/elasticsearch/elasticsearch](https://github.com/elasticsearch/elasticsearch)

</comment><comment><USER74> [https://stackoverflow.com/questions/9603/what-is-some- great-...](https://stackoverflow.com/questions/9603/what-is-some-great-source- code-to-read)

</comment><comment><USER75> * BackboneJS

* UnderscoreJS

<comment><USER76> Both have annotated source code

[http://backbonejs.org/docs/backbone.html](http://backbonejs.org/docs/backbone.html)

[http://underscorejs.org/docs/underscore.html](http://underscorejs.org/docs/underscore.html)

[http://chrisawren.com/posts/Learning-Advanced-JavaScript- via...](http://chrisawren.com/posts/Learning-Advanced-JavaScript-via-the- Backbone-js-source-code)

</comment></comment><comment><USER77> I find anything by [https://github.com/jashkenas](https://github.com/jashkenas) to be transparent and enlightening.

</comment><comment><USER78> [https://github.com/norman/friendly_id](https://github.com/norman/friendly_id)

To learn how to document code.

</comment><comment><USER79> I'm interested in Game Development, specifically physics simulation and graphics programming. The box2D code (C) is fantastic.

</comment><comment><USER80> TeX the Book is good, even if it is in Pascal.

</comment><comment><USER81> For Java I highly recommend H2 SQL DB. It has everything (parsers, sockets, webui...) in very tight and nice package.

</comment><comment><USER82> If you are interested in rendering engines I suggest Irrlicht. It's fairly clean and easy to understand.

</comment><comment><USER83> I've heard that reading the Git source code is very beneficial but haven't done it myself yet.

</comment><comment><USER84> Any suggestions for Clojure projects?

[Update: Oops. I missed the "Clojure -> Core" by jacquesm]

<comment><USER85> I don't know about the Clojure Clojure code, but the Java Clojure code is rather bad. At least the main compiler file is terrible spaghetti code.

</comment></comment><comment><USER86> FreeBSD kernel & userland

</comment><comment><USER54> I highly recommend checking out [http://voxeljs.com](http://voxeljs.com) for some beautifully factored JavaScript npm packages, that implement a lot of Minecraft and more in the browser.

Max Ogden's talk (the first video on that page, also here: [https://www.youtube.com/watch?v=8gM3xMObEz4](https://www.youtube.com/watch?v=8gM3xMObEz4) ) about how voxeljs and browserify work is inspirational, and his energy, motivation, deep understanding and skill, thirst for learning, reading other people's code, building on top of it, and sharing what he built and learned, is extremely contagious!

You may want to pause the video frequently and take notes -- there is so much great information in there, and he covers a hell of a lot of amazing stuff.

And the source code is really nicely broken up into lots of little npm modules that you can plug together to make all kinds of cool stuff.

This stuff is a great fun starting point for teenagers or students to learn how to program and create their own games and web applications, or master programmers to learn the node.js / npm ecosystem and idioms. There are some great ways for new and non-programmers to get into it.

He says "Everyday I work on it I get more motivated to work on it" \-- and you will too!

What you will be benefitting from by watching his video and reading his code, is the fact that he actually did a survey of a HUGE amount of code, and took the best, read it, learned from it, rewrote it, and built on top of it.

"So many people have written voxel stuff, that I should just copy them." He used github search, and searched for minecraft, filtered by javascript, and went through ALL 23 PAGES of projects! He cloned ALL the repos he found, and read the ones that seemed promising, cloned them, got them running, understood how they worked.

A lot of them were the classic genius programmer projects, really impressive visually, super hard to understand, a giant lib folder with 50 files, everybody writing their own 3d engine.

Then he found out about three.js, and learned that, and combined all the stuff he had seen on top of it, including a PhD project in computational geometry that showed how to efficiently implement minecraft with three.js, for removing interior faces, etc.

So he learned from and built on top of all that great stuff, and made voxel.js and an insane amount of demos. Now the community has written a whole bunch of nice modular node.js npm modules and demos, that browserify can combine them together into a package that runs in the browser.

My only trivial beef with it is that their style guide says not to use trailing semicolons! That makes emacs very irritated and it breaks out in a rash.

But other than that, the code is very clean and modular and comprehensible, and opened my mind to a lot of stuff that I didn't realize was possible.

</comment><comment><USER87> FFTW.

</comment><comment><USER88> Xournal

</comment><comment><USER89> == Vim or Emacs ==

Just pick one and force yourself to use it to the exclusion of other editors. Future you will thank you later, because you'll still be using it 20 years from now. "We are typists first, programmers second" comes to mind. You need to be able to move chunks of code around, substitute things with regexes, use marks, use editor macros, etc.

== 6.824: Distributed Systems ==

[http://pdos.csail.mit.edu/6.824-2013/](http://pdos.csail.mit.edu/6.824-2013/) Do each lab. Read the discussion and rtm's course notes.

== Tarsnap ==

[https://www.tarsnap.com/download.html](https://www.tarsnap.com/download.html) How to write C. Study the "meta," that is, the choice of how the codebase is structured and the ruthless attention to detail. Pay attention to how functions are commented, both in the body of the function and in the prototypes. Use doxygen to help you navigate the codebase. Bonus: that'll teach you how to use doxygen to navigate a codebase.

== xv6 ==

[http://pdos.csail.mit.edu/6.828/2012/xv6.html](http://pdos.csail.mit.edu/6.828/2012/xv6.html)

[http://pdos.csail.mit.edu/6.828/2012/xv6/xv6-rev7.pdf](http://pdos.csail.mit.edu/6.828/2012/xv6/xv6-rev7.pdf)

[http://pdos.csail.mit.edu/6.828/2012/xv6/book- rev7.pdf](http://pdos.csail.mit.edu/6.828/2012/xv6/book-rev7.pdf)

Read the book. Force yourself to read it in its entirety. Use the source code PDF to study how to turn theory into practice.

== Arc ==

[http://ycombinator.com/arc/arc3.1.tar](http://ycombinator.com/arc/arc3.1.tar)

You're not studying Arc to learn Arc. You're studying Arc to learn how to implement Arc. You'll learn the power of anaphoric macros. You'll learn the innards of Racket.

Questions to ask yourself: Why did Racket as a platform make it easier to implement Arc than, say, C/Golang/Ruby/Python? Now pick one of those and ask yourself: what would be required in order to implement Arc on that platform? For example, if you say "C," a partial answer would be "I'd have to write my own garbage collector," whereas for Golang or Lua that wouldn't be the case.

The enlightenment experience you want out of this self-study is realizing that it's very difficult to express the ideas embodied in the Arc codebase any more succinctly without sacrificing its power and flexibility.

Now implement the four 6.824 labs in Arc. No, I'm not kidding. I've done it. It won't take you very long at this point. You'll need to read the RPC section of Golang's standard library and understand how it works, then port those ideas to Arc. Don't worry about making it nice; just make it work. Port the lab's unit tests to Arc, then ensure your Arc version passes those tests. The performance is actually not too bad: the Arc version runs only a few times slower than the Golang version if I remember correctly.

== Matasano crypto challenges ==

[http://www.matasano.com/articles/crypto- challenges/](http://www.matasano.com/articles/crypto-challenges/) Just trust me on this one. They're cool and fun and funny. If you've ever wanted to figure out how to steal encrypted song lyrics from the 70's, look no further.

== Misc ==

(This isn't programming, just useful or interesting.)

Statistics Done Wrong [http://www.statisticsdonewrong.com/](http://www.statisticsdonewrong.com/)

A Mathematician's Apology [http://www.math.ualberta.ca/mss/misc/A%20Mathematician's%20A...](http://www.math.ualberta.ca/mss/misc/A%20Mathematician's%20Apology.pdf)

Surely You're Joking, Mr. Feynman [http://web.archive.org/web/20050830091901/http://www.gorgora...](http://web.archive.org/web/20050830091901/http://www.gorgorat.com)

Zen and the Art of Motorcycle Maintenance [http://www.arvindguptatoys.com/arvindgupta/zen- motorcycle.pd...](http://www.arvindguptatoys.com/arvindgupta/zen- motorcycle.pdf)

== Above All ==

Don't fall in love with studying theory. Practice. Do what you want; do what interests you. Find new things that interest you. Push yourself. Do not identify yourself as "an X programmer," or as anything else. Don't get caught up in debates about what's better; instead explore what's possible.

<comment><USER53> >Do not identify yourself as "an X programmer," or as anything else.

Yet every single programming job post these days is basically looking for someone with X years of experience in a long enumeration of specific technologies. The usual reason being "They need to be productive. Now."

<comment><USER90> In my experience, best jobs you get aren't posted — as best candidates don't send out resumes.

<comment><USER91> But we can't all be the best.

<comment><USER92> Not at first. But work with people you like and respect, and learn from them. Then ask them when looking for your next job.

Any place worth working isn't looking for the absolute best candidate for X at any cost. A good fit with someone with a good work ethic who wants to learn always works out better than just raw expertise. And a reference from someone you both respect is the fastest most reliable place to find them.

<comment><USER93> Whenever I hear this, I find I don't recognize the world the poster lives in. Is it a thing to tell coworkers when you're looking for a new job? If not, how many jobs do you need to have and leave before you have a big enough network for this to be a viable strategy? How do you get those jobs?

<comment><USER94> It really depends on the co-worker and the culture of the company. Sometimes I would tell co-workers, sometimes I wouldn't say anything because I was concerned they would leak that to management and I would be asked to leave before I was ready.

I have found user groups meetings a great place to network though. Everyone is helpful when someone says they are looking, even if it is that persons first time at a meeting.

</comment></comment></comment></comment></comment></comment></comment><comment><USER95> Get to know the command line before you start any language.

</comment><comment><USER96> nginx/src/os/unix/ _

<comment><USER96> also

ghc/libraries/base/GHC/

arc/

</comment></comment><comment><USER97> Everything at Google.</comment>


Ask HN: How to get part-time jobs in startups? - <AUTHOR>

So, I am an non-technical undergraduate and I find the startup ecosystem very interesting. I have read a lot and have actually gain alot of insights from the same. I want to get involve with startups, I have no technical skills, but I do have and urge and I believe that I do have skills set to contribute to startup. I just dont know how to ask them for a paid part-time gigs as all they want are technical people/hackers. <comment><USER2> Ask yourself, what "specific value can I offer this particular company?" Then apply for a realistically suitable role and throughout this process, provide (AND prove) this answer.</comment>


AdSense Versus Just Begging Your Users For Money - <AUTHOR> http://datastrategy.wordpress.com/2007/09/08/adsense-versus-just-begging-your-users-for-money/

<comment><AUTHOR> _The surprising thing is that AdSense has so far only made a few more dollars than begging. Begging has gotten me $120 in the last 10 months_

Maybe TipJoy is on to something.

<comment><USER2> "$120 in the last 10 months"

\--That's not a lot. Assuming Tipjoy will take a percentage of that, they will need hundreds of thousands of users to be able to have a viable businness.</comment></comment>


C0, an Imperative Programming Language for Novice Computer Scientists (2010) [pdf] - <AUTHOR> http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.480.8484&rep=rep1&type=pdf <comment><USER2> For everyone complaining about how they taught themselves pointers while in diapers so why can't college freshmen already do this stuff...

1st: Restricting the set of students who can succeed in CS 101 to those who have already done extensive programming is one way to make sure the field never diversifies.

2nd: Computer science is not (supposed to be) about programming. Let's teach them how to think before we teach them how to be language lawyers.

<comment><USER3> Computer science _is_ (and _must be_ ) about programming.

It need not be about C, or present-day digital computers, or even anything to do with the von Neumann model.

But there must always be a formal notation for describing computations, and students of Computer Science must always learn to treat that notation with rigor and come to grips with its nuances.

Probably too they must always deal with the concept of indirection, and think about references to (objects that contain) other references.

I'll grant you, though, a language with a saner notation for describing pointers (and types in general) would be easier to learn than C, and could still be equally useful - if not moreso.

<comment><USER2> Programming is a critical tool, but computer science isn't about programming any more than physics is about advanced mathematics.

<comment><USER3> What is it about, then?

<comment><USER2> When I think computer science, I think things like the lambda calculus, invented before programming languages. Richard Hamming's work on information theory.

In the distributed systems world we have Lamport's work on vector clocks and Paxos, the CAP theorem by Brewer, the Domino paper from Amazon.

In other spaces we have the machine learning and neural networks, blockchain...

These are computer science, and they're certainly implemented with programming languages, but they were conceived (and often proved) independently of any implementation.

<comment><USER4> I think what the prior posting was getting at (and this too is fuzzy and doesn't capture the full scope of CS) is that most of what you mention is algorithmic. Understanding, proving, and discussing algorithms requires describing and reasoning about computation using some form of notation. That doesn't require any particular programming language or pseudo-code notation. But it does require something to communicate with any kind of rigor.

</comment></comment></comment></comment></comment></comment><comment> murph-almighty I was an ECE major at CMU.

C0 basically served as an introduction to C, with contract annotations. The contract annotations were used to enforce more thinking about your code (i.e. proving your code worked via pre/post/loop conditions). There were still pointers, there was just a bit of syntactic sugar surrounding it.

About 2/3's through the course we switched to full-blown C, at which point we _had_ to learn pointers. The intro to computer systems course (think malloc, proxy, and buffer overflow labs) used C as well, and that in turn required us to use pointers. There's no "losing out" on learning pointers. It's basically a step-stool to C.

At the time, I had a pretty good grasp of pointers and thought C0 was a bit silly- I'd never used contracts in my life. I currently work as a full-stack web developer (bit of a twist from my intended path) and I've never seen anyone "write out contracts" like I did in C0. I now think it was a valuable exercise in that it forces you to define the parameters that allow your code to run.

<comment><USER5> the CS department also offers a compiler class that has you write a compiler for C0: [https://www.cs.cmu.edu/~fp/courses/15411-f13/resources.html](https://www.cs.cmu.edu/~fp/courses/15411-f13/resources.html)

</comment></comment><comment><USER6> C with training wheels?

So it seems to me that this course is trying to accomplish two things that are mostly orthogonal: 1) teach principles of computation, 2) teach where the semicolons and curly braces go.

#2 is a valid goal if you eventually want to ramp someone up on C/C++ without suffering language switching turbulence. But overall, I would expect that an intro course should be teaching fundamentals first. Language syntax is a completely secondary issue with respect to learning good imperative programming practices.

Languages come and go. Semicolons come and go. Yes, language switching causes speed bumps, I switch between C (embedded) and Python regularly. Twitchy- semicolon-pinky is a thing. Inventing another language to teach the basic corpus of imperative programming ideas seems like a lot of effort for little lasting payoff.

<comment><USER7> Although I learned to program past when it was popular, I can't shake the feeling that BASIC is the best way to teach programming. The basis of any computer is the sequential execution of instructions, and it's this model of computation that informs things like algorithmic complexity or Turing completeness. Even if teaching BASIC wasn't possible, I would still prefer to see a subset of x86 assembly taught than something ridiculous like "a simpler C" which obscures the core functionality of a computer with abstractions, without teaching a practical language.

<comment><USER8> These days the sequential execution of instructions is a convenient lie at most.

BASIC is one way. But you can also start with 'How to Design Programs' approach and start with Racket ([http://www.ccs.neu.edu/home/matthias/HtDP2e/Draft/index.html](http://www.ccs.neu.edu/home/matthias/HtDP2e/Draft/index.html)).

<comment><USER7> > sequential execution of instructions is a convenient lie at most

Could you expand? Obviously some processors reorder instructions and try to do things in parallel, although this isn't true everywhere and the model of sequential instructions is still valid.

<comment><USER9> Instruction reordering, branch prediction, speculative execution, and optimizing compilers would all be examples of details that are abstracted over by the model of sequential instructions.

"Lie" might be too strong of a word, but "simplification" would be accurate. And sometimes that abstraction is leaky.

<comment><USER10> Not to anyone working in BASIC.

And probably more importantly, they're implementation details: you can't feed a modern processor out of order instructions, the entire system is built and optimised to efficiently execute sequential programs (but possibly several of them concurrently).

<comment><USER9> Depends on the BASIC. Some varieties are compiled and have modern optimizations.

> And probably more importantly, they're implementation details

Well, right, programming languages are abstractions built on top of the actual implementation.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> If you're willing to break compatibility with C, why not make a clean break and use a language that better supports the things you want? The authors go on (correctly) at great length about the difficulty of union types in C compared to an ML-family language; why not use an ML-family language? (My university used Standard ML for their first programming course and I see it as a good choice)

<comment> instruction-ptr The course that uses C0 goes on later to C, and is literally titled "Principles Of Imperative Computation". We use Standard ML for "Introduction to Functional Programming".

\- source: I'm a TA for this course

<comment> murph-almighty I was an ECE and now regret not taking Intro To Functional Programming (I almost typed 150 by instinct). I was put off by the horror stories, and perhaps also by a lab I saw once that was basically a longform story about "pleasing Senpai".

My iteration of Principles of Imperative Computation was... something. I liked the course but the professors who ran it that semester were really unpleasant. They accused a friend of mine for cheating when she pointed out an obvious mistake in someone's code during office hours when the line for TA help was basically on two whiteboards. She became a TA the following semester. ¯\\_(ツ)_/¯

</comment></comment></comment><comment><USER12> I mean I get the idea but

      No floating point datatypes
      No ... switch statements or do...while loops

seem like terrible things to leave out, occasional gotchas of floating point not with standing being only integers means no division

<comment> instruction-ptr "No division"? How do you reason this? Integer division is a thing

<comment><USER12> division is not defined on the set of integers, you only have modular arithmetic.

<comment> instruction-ptr See section 7 of [http://www.cs.cmu.edu/~15122/handouts/02-ints.pdf](http://www.cs.cmu.edu/~15122/handouts/02-ints.pdf)

(As an aside nearly every language defines division on the set of integers this way so it's not even like we're making this up)

</comment></comment></comment></comment><comment><USER13> C language is as simple as it gets. The only concept people struggle with is pointers, but even that is a very simple concept. Teaching something that is simpler than C to computer scientists will breed very poor engineers.

<comment><USER14> I am currently a TA for 15-122 at Carnegie Mellon, the class that C0 was originally made for. I would argue that C0 does an excellent job at breeding good programmers because of the following features:

1\. Contracts in C0 bake preconditions, post conditions, and loop invariants right into the language. Contracts are only checked when in "dynamic recompilation" mode (basically debug mode). This allows you to check the correctness of your code more easily (and, importantly, in an easily gradable way).

2\. The language is designed in such a way to introduce C to programmers that are used to other higher level languages. In the C0 phase of the course we introduce students to fundamental concepts like memory allocation, code reasoning and contracts, binary representations of numbers, and unit testing. Next we transition to C1 (included in the C0 install) which introduces typedefs and other features of C. At this point we focus on introducing data structures. Finally we make the final transition to C, where we talk about undefined behavior, gcc, stack vs heap, etc.

I've taken this course myself, and I would argue that this measured approach to learning C is far superior to throwing students (most of whom have no low- level programming experience) straight into C.

<comment><USER15> I've replied here [https://news.ycombinator.com/item?id=15500321](https://news.ycombinator.com/item?id=15500321) I think I mean to reply to you.

</comment></comment></comment><comment><USER16> I would have thought that Pascal is a great candidate for a simpler, safer language that still has enough features to write serious applications.

</comment><comment><USER17> One can see why they chose a more-safe version of C for an intro course- beginner C programmers can fall into a wide variety of difficult to debug pitfalls (memory leaks, out of bounds reads and writes, undefined behavior) that can make the task of teaching and grading a nightmare.

My university opted to use C++ as the introductory programming language, since it is somewhat more safe. Now they are transitioning to even safer languages like Python and Javascript. While I don't agree with it, I can see why it is necessary to reduce the headache for instructors.

C0 seems like a good tool to use for teaching, although it may lead to bad habits later.

To wrap it up, in my opinion students should definitely be exposed to the concepts of the C family of languages early on: imperative programming, pointers, dynamic memory allocation, et cetera. All the pitfalls associated with these concepts also need to be explored.

The language doesn't necessarily matter as long as the students are allowed to make mistakes and learn from them.

</comment><comment><USER18> Here is some more information about C0:

C0 is used in 15-122, Carnegie Mellon's second semester introductory programming class. I am currently taking this class. The class teaches C0 for the first two thirds of the semester and then transitions to C for the final part of the semester.

C0 has essentially the same syntax as C, but for pedagogical purposes the semantics of the language have been changed to be much more similar to java. Instead of manual memory management, there is a garbage collector, and user defined structs can only be allocated on the heap. Additionally, there is only one integer type which is a signed 32-bit two's complement integer. Overflow is defined as wrapping. strings are opaque immutable types implemented at a language level, rather than just null-terminated buffers. C0 catches out of bounds array accesses at run time. While C0 internally stores array lengths to perform this check, the length is not accessible from C0 code so array lengths must be passed around just the same as C.

C0's biggest feature beyond C is that it allows for contracts. Functions can have preconditions and postconditions. There are also loop invariant contracts and assertions. These contracts are checked at run time when specific flag is passed to the compiler or interpreter (C0 has both, and uses a bytecode internally). A major focus of the class is proving the safety and correctness of the programs we write using these contracts. We are encouraged to prove safety and correctness using only logical reasoning from contract to contract, not operational reasoning. A co-requisite of the class is a course in proofs. There seems to be a heavy influence on the teaching style from Dijkstra's "On the cruelty of really teaching computing science" [1].

The 15-122 class has written assignments focusing on the proofs part of the course and programming assignments which for the most part are automatically graded by autolab [5]. Our code is tested against a number of unit tests to ensure its correctness and our contracts are also tested to see if they can catch bugs in faulty implementations.

C0's implementation is not open source, but it appears to be used in ongoing research [2]. Here is the language website and course website [3], [4].

[1] [https://www.cs.utexas.edu/~EWD/transcriptions/EWD10xx/EWD103...](https://www.cs.utexas.edu/~EWD/transcriptions/EWD10xx/EWD1036.html)

[2] [http://www.cs.cmu.edu/~fp/papers/cc016.pdf](http://www.cs.cmu.edu/~fp/papers/cc016.pdf)

[3] [http://c0.typesafety.net/](http://c0.typesafety.net/)

[4] [http://www.cs.cmu.edu/~15122/](http://www.cs.cmu.edu/~15122/)

[5] [http://www.autolabproject.com/](http://www.autolabproject.com/)

<comment><USER19> A cmu freshmen on hn and over 900 days old. The one thing i don't like about this school is that most cs majors aren't the hn type

<comment><USER20> What is the HN type?

<comment><USER15> Likes to solve interesting problems that no one has done before?

Learning about strange/engaging things, even if it's not directly useful?

Taking apart a new toy, just to see how it works?

<comment><USER21> Having too much free time on your hands and wasting it on the Internet while fooling yourself into believing that you learn something useful..

</comment></comment></comment></comment></comment><comment><USER22> Does anyone know of a website containing resources for teaching this? I'd also be interested in seeing who is using it now a days.

<comment><USER23> 15-122, an introductory programming course at CMU, uses C0 for most of the course. Lecture notes are available on the site: [http://www.cs.cmu.edu/~15122/schedule.shtml](http://www.cs.cmu.edu/~15122/schedule.shtml)

<comment><USER24> also their compiler course you implement a compiler for C0 [http://www.cs.cmu.edu/~rjsimmon/15411-f15/schedule.html](http://www.cs.cmu.edu/~rjsimmon/15411-f15/schedule.html)

</comment></comment></comment><comment><USER25> Using a weird local subset of C as an introductory imperative programming language seems like a really bad idea to me, unless you're using your weird local subset of C as the source language for a compiler construction course.

There's just so many other good options.

</comment><comment><USER26> Here's an interesting extension to the language to allow for session-typed concurrency.

[0]: [http://mwillsey.com/papers/cc0-thesis.pdf](http://mwillsey.com/papers/cc0-thesis.pdf)

</comment><comment><USER27> I thought this would be for kids, I don't see the point of a simplified language for college students.

However, if they as someone said use it in a compiler-writing course, for that purpose it makes sense to have a simplified language. I had to do that back in college and basically used a C subset for it (for the compiled language, not the implementation language).

<comment> instruction-ptr To quote a fellow TA below:

"I am currently a TA for 15-122 at Carnegie Mellon, the class that C0 was originally made for. I would argue that C0 does an excellent job at breeding good programmers because of the following features:

1\. Contracts in C0 bake preconditions, post conditions, and loop invariants right into the language. Contracts are only checked when in "dynamic recompilation" mode (basically debug mode). This allows you to check the correctness of your code more easily (and, importantly, in an easily gradable way).

2\. The language is designed in such a way to introduce C to programmers that are used to other higher level languages. In the C0 phase of the course we introduce students to fundamental concepts like memory allocation, code reasoning and contracts, binary representations of numbers, and unit testing. Next we transition to C1 (included in the C0 install) which introduces typedefs and other features of C. At this point we focus on introducing data structures. Finally we make the final transition to C, where we talk about undefined behavior, gcc, stack vs heap, etc.

I've taken this course myself, and I would argue that this measured approach to learning C is far superior to throwing students (most of whom have no low- level programming experience) straight into C."

<comment><USER15> >I've taken this course myself, and I would argue that this measured approach to learning C is far superior to throwing students (most of whom have no low- level programming experience) straight into C.

Sure, I'd love to read this argument. I taught myself to program, started with python, then learned C. The hurdle of learning how memory is mapped, the knowledge/understanding gained by being required to clean up after yourself when you do *alloc. That's what makes learning C helpful. Perhaps I gave up reading the introduction to soon, but honestly, after I read it adds in GC to C.... I had the same reaction everyone else has already voiced. "Why use C here?" There's many other better languages if your just adding in hand holding.

Finally, if grading assignments was one of the defining reasons for inventing a new language, you need to take a step back from the text editor, and ask... "How did I get here?"

<comment><USER28> Just wanna add that we used C0 for a subset of the class, and most of the students jump into a more rigorous course which involves actually implementing malloc.

I agree with you that learning the ins and outs of memory is super important, but the methodology of this course doesn't imply the lack of teaching memory management

</comment></comment></comment></comment><comment><USER29> Why not use Oberon instead?

</comment><comment><USER30> Here is the Tutorial Wiki</comment>


Lessons Learned from Kaggle's Airbus Challenge - <AUTHOR> https://medium.com/@YassineAlouini/lessons-learned-from-kaggles-airbus-challenge-252e25c5efac <comment><USER2> One thing I always recommend when doing segmentation is first altering the color space; even utilizing a CNN (which should, when trained, essentially perform that step). This is especially true of pre-trained models where you don't know if it's been tuned for that.

Just in terms of edge detection, you'll see nearly a 10% improvement just from shifting the color space to LAB:

[https://austingwalters.com/edge-detection-in-computer- vision...](https://austingwalters.com/edge-detection-in-computer-vision/)

What's even better about the color space conversion, is you can utilize it as a pre-processing step to dramatically reduce the number of edges to search:

[https://austingwalters.com/chromatags/](https://austingwalters.com/chromatags/)

In the case of a blue sea, you can shift to the LAB color space and probably only search the 'A' channel; the channel representing green to red. As the 'B' channel represents yellow to blue. Which is less likely to produce edges in the ocean.

This means you only process 1 channel, which dramatically speeds up most algorithms.

Just food for thought.

<comment><USER3> The related L-star c-star h-star works well too, and is easier to interpret than LAB.

These spaces benefit from being approximately perceptually linear, which also helps when any metric is computed on them.

</comment></comment><comment><USER4> Great meta article. Some other general advice concerning iterative development:

\- Test your ideas on a smaller data sample at first to iterate and debug more rapidly.

\- Caching your augmented data to disk may also improve iteration speed. Or it may not, depending on kernal disk cache vs disk bandwidth vs compute tradeoffs.

\- Wrap your functions in timers so you can notice when a new processing stage is unnaturally slow, rather than having to back out later what happened.

\- Make sure you're actually setup and using the GPU and not accidentally running on the CPU.</comment>


Bleve: a modern search indexing library for Go - <AUTHOR> https://sourcegraph.com/blog/live/gopherconindia/113241457917

<comment><USER2> Good thing about bleve is that it's a library. Probably it's early but I'm looking forward to use it.</comment>


An 11-Year-Old Changed the Results of Florida's Presidential Vote at DEFCON - <AUTHOR> https://www.buzzfeednews.com/article/kevincollier/voting-hackers-defcon-failures-manufacturers-ess <comment><USER2> > "If you're saying 'even a kid can hack into this,' you're not getting the > full story, which can have the impact of the average voter not > understanding," Manfra told BuzzFeed News.

BuzzFeed's headline: "An 11-Year-Old Changed The Results Of Florida's Presidential Vote At A Hacker Convention."

If all you see is the headline, that's exactly the impression you're going to get. Lampshading it halfway through the article doesn't counteract that.

<comment><USER3> I typed out a big comment criticizing the fact that the kid was also shown how to do the exploit, as opposed to figuring it out for himself.

But y'know what? Good for them. That's step one to figuring out their own exploits. And it makes you think: If even a preteen can pick up the gist of how to do the exploit, you could imagine paying someone to go around and try to run it on election day. They don't need to be very smart, just hard up for cash and willing to take a dumb risk.

<comment><USER4> > ...figuring it out for _herself_.

Fixed that for you.

<comment><USER3> Whoops, thank you!

</comment></comment></comment></comment><comment><USER5> I've noticed now it's become almost accepted knowledge among the general public that Russia literally hacked election machines and changed votes. Even this article appears to present that view in the first couple paragraphs before finally stating otherwise halfway through.

<comment><USER6> I really don't understand what the media is trying to accomplish by pushing this narrative. This fear mongering will create distrust in elections and the election results, undermining democracy.

<comment><USER7> They quite clearly should be distrusted in the current conditions. Electronic voting should go. This greatly reduces the attack surface.

</comment></comment></comment><comment><USER8> How seriously can we take an article that refers to Windows 4.1?

(100% against voting machines, but this article doesn't seem to know what it's talking about.)

<comment><USER9> Probably referred to Windows CE 4.1. But not encouraging given that this is their writer focusing on the _cybers_.

And yes, it's important to be precise when you're reporting on something. It's the details that make the story. What happened if he said "Windows 4.0"? Would people think Windows CE 4.0 (supported until 2012) or Windows NT 4.0 (out of support for well over a decade).

</comment></comment><comment><USER10> Awful title.

>In another area of DEFCON, organizers set up a semicircle of computers preloaded with copies of secretaries of states' websites to allow young children to try to alter the appearance of a vote result .... Notably, the kids were instructed to use a simple database hacking tactic called SQL injection .... Within a few minutes, Audrey, 11, had figured it out, and made it appear that libertarian candidate Darrell Castle had won Florida's presidential vote in 2016.

The discussion about the vulnerability and the unwillingness of the companies to secure them was more important.

</comment><comment><USER11> Why do we not have a completely open source government owned voting system? It seems ownership of voting system companies are partisan.

</comment><comment><USER12> lol, anyone in the trenches of computering thinks electronic voting is terrible. I don't even trust electronic vote tabulation.

<comment><USER13> Unless if done right with end-to-end verifiable manner with auditable paper trail. [1]

[1] [https://en.wikipedia.org/wiki/End-to- end_auditable_voting_sy...](https://en.wikipedia.org/wiki/End-to- end_auditable_voting_systems)

</comment></comment><comment><USER14> TL;DR from the title. 11 year old uses sql injection to change the election results on a voting machine at defcon.

In reading the headline I was expecting they would explain it within the first few paragraphs but instead buried what the kid did in the last 5 sentences of the article.

Like most of us though still alarms me that these machines are in use and have some easily exploitable vulnerabilities but as mentioned by one of the vendors in the article some/most of these exploits require physical access to the voting machine. Not to take way from the exploits but it would be pretty obvious if someone was doing this (plugging a device into the voting machine) on election day.

<comment><USER13> > "it would be pretty obvious if someone was doing this (plugging a device > into the voting machine) on election day."

Poll workers (or someone posing as a poll worker) could easily do this and it wouldn't be noticed as suspicious because poll workers are naturally assumed to be allowed to interact with the poll machines.

"What are you doing there?"

"Oh, just updating the firmware to protect against a new zero-day threat."

<comment><USER14> Interact sure, but on election day no way would they be 'updating the firmware'. From my own personal experience there is always more than one person watching or hands-on the polling machines. I'm sure some places are probably more lax than my experience.

There is also variance in where you vote what machine they might have. My location has always been a scantron type and only one device per voting location. You'd have to know ahead of time what device is used where and have the correct exploit handy. Still in my scenario going to be hard to pull off an exploit while people are waiting to enter their ballots into the machine.

Not saying it couldn't be done but I'd say it is out there for a probable attack. They do make for good headlines and of course are something no one wants to see tampered with. I'm glad the one's in my district still have a paper trail, which has been used in the past to verify votes by hand when the election was close.

</comment></comment></comment><comment><USER15> The headline is a bit sensationalist.

There was a SQL backed lab setup with loaded results from Secretary of States websites, for kids to attempt SQL injection attacks.

<comment><USER16> Source? I believe you, just would like to see for myself.

</comment></comment><comment><USER17> Is it me or are we seeing a bit too much buzzfeed articles here lately?

SQL injections are child's play. Literally. It's last decade's "hack", if we can call it that. Using parameterized queries ( which you should be doing in the first place ) or simple defensive measures nullifies sql injection threats. The headline is clickbait nonsense.

Also it's a shame that defcon has turned into a "disney" event. Who even attends it anymore other than families and FBI agents and slimey salesmen peddling their software.

<comment><USER18> Agree that it's a media circus. Most of us attend to catch up with old friends.</comment></comment>


When Worse Is Better (2011) - <AUTHOR> https://susam.in/blog/when-worse-is-better/ <comment> chupa-chups This is so wrong since it implies that a decision is binary, thus taking the opposite decision of a "wrong decision" is well defined and automatically right.

Which is hilariously different to reality.

<comment><USER2> Well, in the author's defense, they specifically stated that "Each assignment required a yes-no decision". I agree, though, that there really is no great lesson to be learned here since the real world doesn't work like that. The technical bit about channel capacity was honestly more interesting. It's a neat result (that should be fairly obvious to anyone who's worked with probabilities) with a not-so-great example to illustrate it.

<comment><USER3> Agreed, "Yes/No" is in no way correlated with "50/50 chance".

Will I win the lottery? Yes/No. 50/50?

My favorite conflation is the "are we in a simulation?" argument. That's a yes/no also, and the ignorant conclusion is that its very likely we are. Without any statistics on the probability either way.

<comment><USER4> Also, Pascal's wager. The presented sides of the bet aren't equal, because on the one hand you have existence of a _particular_ God, and on the other hand its non-existence, whereas in the real world, there's a whole space of possible Gods that people believe in that are not included in the wager.

<comment><USER5> "Wheareas in the real world" is an interesting phrasing for that poylemma.

</comment></comment></comment></comment></comment><comment><USER6> Binary choice describes a range not a distribution. Suppose Bob is optimistic and always decides "yes". The opposite of Bob's decision is always "no".

The right course of action requires looking at the data, not theory. In a context where the probability that "yes" is right is 0.05 -- 19/20 proposals being bad ideas is not an implausible reality -- there's no excuse for keeping Bob, just answer 'no'. There's no reason to assume that correct _yes_ 's and _no_ ;s are equally distributed.

There's also no reason to assume that an incorrect _yes_ has the same cost as an incorrect _no_ or that a correct _yes_ has the same benefit as a correct _no_. Silicon Valley venture financing comes to mind.

To me, it's probably a good idea to base business decisions on business facts rather than the beauty of a theory. It's not that theories shouldn't inform decisions, but data is probably a better place to start.

</comment><comment><USER7> As long as Bob doesn't observe himself and tries to improve his performance.

</comment><comment><USER8> I think the problem with this example is assuming that both decision outputs can equally impact profits (that both are perfectly symmetrical on their effects).

For example, if this person is deciding whether or not to extend a credit line to a client, the NO decisions are not going to have an effect on the profits bottom line.

Saying NO a lot, in this case, means having the same cost to operate but fewer opportunities to profit from new and existing clients. On the other hand, saying YES a lot means that the company can profit from extending those credit lines but there's a risk that they would lose money from unrecovered credits and a more heavy collections operation.

So, actually, Bob is only useful if he is the conservative one that says NO a lot. If Bob says YES a lot, his impact is only as good as the 5% of his correct decisions.

</comment><comment><USER9> Related to this is the maxim about how to tell if a game is based on luck or skill: can you lose on purpose?

</comment><comment><USER10> We named people like Bob "Oracles of Wrong".

In any big enough group there is always an Oracle of Wrong. They are very precious. It's very hard to be right all the time, but less hard to be wrong all the time.

Over decades I have puzzled over the existence of Oracles of Wrong. One clue is that they always come from privileged backgrounds. Taking the easy, wrong choice has never caused them any personal discomfort, but has often saved them some minor inconvenience that the hard, right choice would have cost.

</comment><comment><USER4> TL;DR: when facing binary choices (yes/no), stupidity is being ~50% correct, not ~0% correct. When someone is correct e.g. only 5% of times, it means they're strongly anticorrelated with reality, and you just have to do the opposite of what they say to be 95% correct.</comment>


Ask HN: Resources for learning Computer Networking ? - <AUTHOR> I am looking for resources for getting a good background in computer networking. I did some research and the best thing I found is class cs144 from Stanford (https://cs144.github.io/): Introduction to Computer Networking.
Since the class is not open for enrollment right now, my plan is to watch the Youtube classes (https://www.youtube.com/playlist?list=PLvFG2xYBrYAQCyz4Wx3NPoYJOFjvU7g2Z) and to complete the labs and assignments. The priority being to do the labs and assignments since I learn by doing. Now here are my questions:
- Is it a good approach? - Any other relevant resources I should check? - I did not find any labs/assignments solutions to verify my code for cs144. Anyone aware of some clean solutions?
Thanks for the help! <comment><USER2> [https://beej.us/guide/](https://beej.us/guide/)

</comment><comment><USER3> Computer Networking a top down approach, currently it's the 7th edition iirc</comment>


Show HN: Open source SSH honeypot with an API - <AUTHOR> http://sshpot.com/

<comment><USER2> Does this do anything after login, like Kippo does?

[https://github.com/desaster/kippo](https://github.com/desaster/kippo)

<comment><USER3> yeah, this is what I was talking about. Once for a college project we had VMs acting as honeypots, to try to get the big bears (not just bots) so we changed OpenSSH source code, let them in at the 3rd try and then the idea was to send back through ICMP payloads the session keys to decrypt the communication, based on a nettables module hack published at phrack!

<comment><USER4> Linky? This sounds interesting.

</comment></comment></comment><comment><USER4> Hey namidark,

As an avid honeypot person I like this project a lot, I'll be doing a talk at a conference about them soon. Do you provide a master repository for the username/password combinations that have been guessed? I understand I could do this with constant JSON fetching but I admit, I don't have an incredible talent when it comes to web technologies (but it is something I am working on improving).

<comment><AUTHOR> If you drop me a line I can get you a DB dump - josh [ at ] bluescripts.net or open an issue on github

<comment><USER5> Any chance you'll make it generally public? I can see reasons for keeping it private and for having a public repository with occasional database dumps, don't know where you fall on that.

Of course, anyone who runs an SSH server on port 22 knows it's not that hard to generate your own little database quickly enough.

<comment><AUTHOR> All the data is currently public (via the API) - you just have to know how to query the API to get it. Not sure if a publicly accessible endpoint to dump _all_ data is a good idea (since that could get resource intensive).

If you have a suggestion for some api endpoints or better querying, let me know.

</comment></comment></comment></comment><comment><USER3> That looks cool! How about letting them in and gather the 1st ~10 commands issued :D (i done something similar for a college project)

</comment><comment><USER6> Is there any benefit to running this vs just keeping your SSH port on 22 and running fail2ban or denyhosts which also run servers cataloging black-listed IP address (well, denyhosts supports the option, not sure about fail2ban).

<comment><USER7> It allows us to collect passwords crackers are using, and banner users from using them? Increasing security by learning what the attackers are doing?

<comment><AUTHOR> That is also another goal I would like to add - is the ability to cross-check passwords against the API so you can prevent users from using them.

</comment></comment></comment><comment><USER8> Pedantic: daemons, not daemon's (the possessive) :)</comment>