OpenBSD base now free of C++ - <AUTHOR> http://undeadly.org/cgi?action=article&sid=20110314142734 <comment><USER2> You can still add g++, boost and other high-quality C++ libraries to OpenBSD via ports/packages. They just prefer plain C in the base install. Plain C is inline with their "keep it simple" philosophy.

<comment><USER3> g++ hasn't gone anywhere.

<comment><USER4> Indeed, just to make it clear: There's no more C++ code in the OpenBSD's base, but g++ the C++ compiler is still present.

I don't think that g++ will be removed. Too many things are written in C++. And as long as GCC is present in OpenBSD, there's no reason to remove G++.

<comment><USER5> And what will they do when GCC moves over to C++?

<comment><USER2> I believe they are working on pcc (for various reasons).

</comment></comment></comment></comment></comment><comment><USER6> What an interesting development. The year is 2011 and we are proudly announcing removal of C++ due to bloat.

<comment><USER7> I didn't catch the word "bloat" in the linked article, nor really any hint of such a complaint. Rather, it seems like the OpenBSD has happily announced the removal of C++ in their base because of compilation speed issues.

> Groff was also one of the slowest parts in a full build...

C++ compilers might be many things, but zippy they are not.

<comment><USER6> > and its replacement is much faster in rendering manpages

Besides the build bloat, that certainly hints at it.

<comment><USER8> Mandoc is a tool specifically for formatting man pages. Groff is a general typesetting tool. That probably accounts for most if not all of the difference in speed.

<comment><USER9> Probably a good choice. For a workstation, you might encounter the need for a typesetting system. But for your router, you probably don't need it. So I think OpenBSD made the right choice about what to ship in core.

<comment><USER10> troff is technically a general-purpose typesetting system, but how many people are still using it for anything other than formatting man pages? (La)TeX and other formats have pretty much taken over.

<comment><USER11> Indeed. I hope Linux distributions will follow with replacing Groff. It's a huge, slow, ancient system and for the purpose of formatting manpages it can be replaced by a 15-line Python script.

(this has _nothing_ to do with C++ versus C, simply with removing some bloated UNIX legacy code)

<comment><USER10> Well, 15 lines is a bit optimistic. mandoc is ~25 000 lines of C, and not yet complete.

<comment><USER11> I was figuratively speaking. In Python it'd be less lines than C, but still a substantial project.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I write more C++ than C, but this still makes me happy.

Some people set an objective, for whatever reason, and accomplished it. Other people seem happy with the result.

I'd call that a positive outcome for OpenBSD and all the developers involved. Cheers!

</comment><comment><USER13> Wow, another reason to check back in with OpenBSD. Regardless of the meta debate on C++'s virtues or issues, having the core system build with just C would seem to help in simplifying things.

I am perhaps in the minority but I would really like a straight forward to build and maintain UNIX derivative and perhaps this can be it.

<comment><USER14> I know I'm just one data point, but I've been quite happy with OpenBSD as my _primary_ OS for over 7 years.

I'm running Debian on a spare laptop for "common Linux distro" testing purposes, but am _continually_ annoyed by it.

<comment><USER15> Not being familiar with OpenBSD, what are some of the pain points you have when using Debian that you don't experience with OpenBSD?

<comment><USER14> I don't like apt-get. The way they break up packages is annoying and sometimes leads to debian-specific forks. I also hoped that Debian's vastly larger community would mean discovering several good packages apt-get (which I'd port to OpenBSD), but there really hasn't been much that OpenBSD doesn't already have. Disappointing.

GNU coreutils. The BSD userland (the core system) is much better integrated, which affects a great many things. In particular, I _really_ prefer BSD top.

When I installed some recommended package so that closing my netbook's lid would make it suspend, it didn't work. I read the source, and it was so obviously broken (among other things, it was suspending on lid-close AND lid- open) that I just wrote my own. Usually I contribute patches, but...eh. Other stuff that tried to "automagically" configure itself, but didn't work quite right, and interfered with manual configuration.

"This project only has a man page because we want to note that man pages suck, look at the info page instead." I hate empty man pages, and it's particularly annoying because the documentation on OpenBSD is phenomenal.

I prefer /etc/rc.conf to /etc/init.d/ , though that's fairly minor. (I usually run daemons via runit anyway.)

There are probably several other things that don't come to mind at the moment.

</comment></comment></comment></comment><comment><USER16> Language purity for a project is never bad, it makes it easier to contribute to a project. However, this is barely a feature, given that C is weakly typed and common C functions do not use boundary checks _.

For an operating system that aims to be secure, one would expect a more progressive stance, and heavy (intellectual) investment in a language that makes safety easier.

_ Yes, I know that OpenBSD prefers more secure variants of common functions.

<comment><USER17> When you only have 1 program using another language and it slows the builds, you tend to want to replace it. There are still scripts and such in different languages (ksh and I do believe some perl).

<comment><USER16> Right, just as I said, it is always a good idea to make a project more (language) uniform. But that wasn't my main point.

<comment><USER17> Since OpenBSD still compiles on a VAX, removing C++ from the build is a decent feature. As you say, OpenBSD has function with bounds checking and that seems to satisfy their requirements. Also, they haven't achieved language purity and I don't think they are trying.

</comment></comment></comment></comment><comment><USER18> It's funny, they are so proud of it. Groff is so ancient, you can't seriously claim it's written in C++. It's written in C++ circa 1988. Pre-template collections, no Standard library, no namespaces, no exceptions, practically plain C code. Well, not plain exactly, C with classes and virtual functions. I guess, OpenBSD folks didn't like virtual functions...

</comment><comment><USER19> It'd probably be too much to hope that this catches on and becomes a trend.

</comment><comment><USER20> So they replaced a generic roff system with a specialized man page viewer? Why? I mean, if you're rewriting everything _and_ include a bevvy of output formats, why not make it a proper replacement? Would be quite a bit more unix-y. Yes, maybe a bit more work in the end, but you could always have "oroff 0.1" which only supports a -man subset evolve into a full-fledged implementation. Going from mandoc to "oroff" seems less likely.

(Or I'm just the only one who still occasionally uses ms/tbl/pic…)

<comment><USER4> The main reasons for replacing groff were:

1\. Groff is buggy

2\. Groff is slow to compile & execute

3\. Groff is not BSD licensed

mandoc has none of these problems. If you want a "generic" roff system, groff is available as a package.

According to <http://mdocml.bsd.lv/>

> groff amounts to over 5 MB of source code, most of which is C++ and all of > which is GPL. It runs slowly, produces uncertain output, and varies in > operation from system to system. mdocml strives to fix this (respectively > small, C, ISC-licensed, fast and regular).

<comment><USER20> Those are reason why you wouldn't use groff, it still doesn't explain why – if you're taking the effort – you're not building a proper roff replacement, but some subset bastard program. And then hack stuff like tbl into the main executable. (Never mind that there's Plan 9 roff or the heirloom version)

I get it, nobody really seems to use non-man roff anymore. Still, subsetting and reinventing the wheel (partially) seems a odd solution for this.

<comment><USER17> Resources, need, and code audits are the reason to build a simple tool that does the job you want.

</comment></comment></comment></comment><comment><USER21> I'm curious if someone can elaborate more on this. Is C++ in general _that_ much more time-consuming to compile than C code? Or is it just an issue with gcc vs g++? Or is this issue unique to Groff?

<comment><USER22> C++, especially template heavy code, is orders of magnitude slower in compiling.

Clang and LLVM is faster but not that much faster.</comment></comment>


Ask HN: Used Dell Poweredge C6100 servers + colo or AWS? - <AUTHOR> I am a solo bootstrapper and I am trying  to figure out whether I should get 4 x  c6100 servers ( 2 x Intel Xeon L5639 + 96GB per  + 250gb SSD  - per node , 4 nodes per server)  for about US$7k +approximately  $4k for annual colo charges or scale up using AWS. The Dell servers are from ebay and their longevity/reliability is questionable. I will also be using a managed hub  ( still deciding brand -- but will buy used from ebay)
 I plan to buy four of those for redundancy. The colo would be within driving distance of my home.
My environment  has Mongo , Redis, NGINX , beanstalkd and glassfish app servers  and I expect to do a lot of video transcoding  using FFMpeg ( If I manage to get traction). With dell c6100, I am getting a lot of CPU cores and memory and SSD that I could never afford on AWS. I probably don't need this kind of capacity in the first few months of my launch but I am hopeful that my business would grow.
Could HNers with more wisdom and experience in these decisions please share their experience with this decision. Also feel free to critique this idea. Thanks! <comment><USER2> I bought a similar setup for a similar purpose a long time ago and unless you want to offer custom ffmpeg encoding beyond what Zencoder / AWS / TransloadIt offer my advice would be to use them instead.

If you really want to; I still have a 4x 3GHz Xeon server with 48Gb of memory and 8 450Gb 3k-RPM SAS drives in RAID-6 running in a colo. You're more than welcome to take it off my hands. I don't think it's load ever got above a few % :)

<comment><AUTHOR> Awesome I would love to take this off your hands. Could I email you later on at your email address in HN profile ?

</comment></comment><comment><USER3> I would suggest you look at just leasing an ordinary dedicated through these guys, who I used for ~3 years.

[https://hivelocity.net/dedicated-servers/intel-xeon- lynnfiel...](https://hivelocity.net/dedicated-servers/intel-xeon-lynnfield/)

Dual e5 2620 + 96gb ram + 480gb ssd for $493/month, and in 6 to 12 months you'll be able to shift to a bigger server at a lower price.

Benefits are:

\- the physical server and network are always their problem

\- you don't have to slap $7k down now

<comment><AUTHOR> I will book mark this. However, the problem I see with something like this is redundancy -- I would need atleast 2 servers and that would add up to USD 12k per annum.

<comment><USER3> Yeah redundancy is going to be expensive. Was your $7k+4k per server or was that for a pair?

It wouldn't hurt to use AWS as a backup though - if you're unexpectedly offline for 24 hours just fire up a big server that is affordable for a short burst.

<comment><AUTHOR> Each Dell Peoweredge c6100 is around USD$ 1500 -- each server contains 4 nodes . Each node is a dual CPU server with its own RAID ,network port and IPMI port.I think only the power supply is shared with all 4 nodes. have 2 or 3 of these kind of gives a lot of redundancy. The CPU is kinda dated and slow though.

<comment><USER3> I think I would try just one plus AWS-for-emergencies first.

Or possibly [http://zencoder.com/en/](http://zencoder.com/en/) until the expense justifies investing in your own hardware.

</comment></comment></comment></comment></comment><comment><AUTHOR> There are several forums discussing Dell poweredge C6100. This is a review I can point to : [http://www.servethehome.com/Server-detail/dell- poweredge-c61...](http://www.servethehome.com/Server-detail/dell- poweredge-c6100-xs23-ty3-cloud-server-2u-4-node-8-sockets/). There may be others. I have not come across any glaring issues with this so far .</comment>


Have Disney Strike Star Wars Episode VIII from the Official Canon - <AUTHOR> https://www.change.org/p/the-walt-disney-company-have-disney-strike-star-wars-episode-viii-from-the-official-canon <comment><USER2> The author of this petition regrets posting it. At the end of the page, his comment begins with:

> I put this petition up because I was upset and I was on strong pain > medication. Last December I was in a vehicle accident and am still trying to > get the surgery and such, it really messed up my knee and leg and put me in > a wheelchair. If I sit up for a long time it really starts hurting.

> So after spending the time to get to the movie, watch it, and get back I was > in ridiculous pain. I was frustrated and medicated. So, I made this > petition. It was a bad idea at the time and I feel that we are pooling our > efforts in not a healthy direction.

</comment><comment><USER3> Good luck with that. All Disney films are really just advertising so that Disney can make a fortune selling merchandise. The 'Star Wars' franchise is one of the best-known and successful merchandising franchises, which is why Disney wanted it badly.</comment>


Windows 10 Fall Creators Update: the 10 best new features - <AUTHOR> https://www.theverge.com/2017/10/17/16487760/microsoft-windows-10-fall-creators-update-features-review <comment><USER2> I really dislike the weird "named update" thing Microsoft is doing here. There are now two "Creators Updates" and searching for info on them is problematic as they only differ by one word. I much prefer a simple "Service Pack N" or something like it. Also, it's difficult to know at a glance which came first. Also, what does it have to do with "Creators"? I'm not a Creator on my Windows machine, I just game on it. Is there going to be a "Consumer Update" later?

Also, I'd be remiss to not bemoan the ridiculous fact that as a Windows 10 user I am not able to avoid updates if I so choose. These updates that are forced upon me routinely break my games until drivers/games are updated and I'd very much like the ability to only apply them when and if I choose.

Oh, how I wish gaming on other platforms was viable. Sadly, I don't think that's ever going to happen with Apple not taking Mac gaming seriously and Linux gaming having been "almost there" for a decade.

edit: typo and update to first paragraph

<comment><USER3> >Also, I'd be remiss to not bemoan the ridiculous fact that as a Windows 10 user I am not able to avoid updates if I so choose. These updates that are forced upon me routinely break my games until drivers/games are updated and I'd very much like the ability to only apply them when and if I choose.

You actually can (partially) do that by simply disabling the Windows Update service. The only downside I've experienced thus far is that it also breaks the Windows Store. Apart from that you obviously need to reenable the service when you want to apply the updates. It's not quite ideal since you cannot apply individual (e.g. security) updates, but it works very well to avoid the random updates & included reboots.

<comment><USER4> I set network connections as "metered" since updates are disabled over metered connections.

When I'm ready to update, I switch to a non-metered connection.

<comment><USER5> This is really the only sane workaround. Unfortunately you have to set wired connections as metered through regedit (afaik).

</comment></comment></comment></comment><comment><USER6> Here are my 10 fantasy features:

1 Improved Cortana: you can now remove it in one click

2 Improved OneDrive: you can now remove it in one click

3 Improved resistance to featuritis: you cannot install anything AR or VR

4 Improved UI - will not freeze entire laptop for 3 secs by clicking the battery icon

5 Better Edge - downloads Chrome/Firefox 20% faster

6 Emojis - auto-bans contacts who use non-text emojis

7 Replaces Task Manager with much better MS Process Explorer that already has GPU stats

8 Does not try and gather all my contacts emails under the pretext of "People Integration" whatever that means

9 One button to turn off all the tracking/telemetry

10 Improved UI - Clicking on start does not result in times' square popping up.

Windows 10 fall creators update: No one asked for any of this but here it is anyway.

Windows 10 fall creators update: You should've seen the features we cut!

</comment><comment><USER7> I must say I am rather disappointed with most changes discussed here. They all seem very superficial changes and I wish they would solve/improve other things. Some examples include:

1\. Bring the "power plan" (balanced/presentation/high performance) switching into the tray battery icon next to "Battery saver", which is independent of the "battery saver" power plan. This seems (!) like an easy change which many users would adore.

2\. Finally unifying settings into one and only one place instead of having a "Settings" app only to find that every other thing you want to change eventually leads to the old setting window which hasn't changed since at least Windows XP.

3\. Fix the occassionally horrific Start search, which will do things like find "Word 2016" as "Best match" when having pressed "wo", but once another "r" is pressed to make the search string "wor", the "Best match" changes to "Wordpad". Way too often does it happen, that you notice the best match as you're typing and then hit Enter only to find that by the time another letter was pressed (still the right one considering the current "Best match"!!), the "Best match" changed to something else.

That's in the cases where the Search only finds programs installed to a specific date and is not able to find anything newer, which has already happened on two computers I've seen. Not even mentioning that the "best match" gets updated with time even when no new keys are pressed. So the same can happen just due to the "Best match" changing between you start and finish the movement to hit "Enter".

4\. Finish improving the horrific thing that is looking up a network drive/device using explorer.exe, leading to freezes and delayed error popups that feel very Windows 95ish.

5\. Maybe change that a window of Explorer becomes unresponsive if waiting for a HDD to spin up. This happens regularly if your system is on an SSD and you have a second disk (HDD) mounted on another letter (D:\\). When you haven't clicked that disk for a while, everything freezes between you clicking on it and it spinning up to start reading.

But hey, let's add another presumably more sexy and unifying look to the uppermost layers of the system.

Edit: Maybe they did other under-the-hood changes that are just not being discussed. If so, where would one find them?

<comment><USER8> > Maybe they did other under-the-hood changes that are just not being > discussed. If so, where would one find them?

Yeah the article here is explicitly "10 Best New Features" and so doesn't explicitly include improvements to old features, and clearly doesn't represent the breadth of changes in the Windows release.

The easiest way to find hints about just about every change made in the update is probably to browse through the Windows Insider blogs. They are quite detailed and rather intimate looks into the changelog of Windows over time. I don't know if anyone is building a good summary of everything that changes. Some of the area-specific blogs will do summary posts just before the release of everything going into the release; in particular I'm thinking about summary posts I've seen from the Windows Subsystem for Linux team (biggest tl;dr: multiple distro support, side-by-side distro-support, no need for Developer Mode anymore, just download distro(s) of your choice from Windows Store) and Windows CLI/CMD.exe team.

As with each previous update, more Settings have incrementally moved to the modern Settings app, per your point 2. That likely will remain a slower process than everyone would like (there are a lot of Windows settings), but they continue to work on it.

I can't speak to most of your other points as they've not been personal pain points for me; I don't do most of them often enough to notice.

<comment><USER7> Thank you for the nice reply. I will try to look into the changelogs/blogposts and keep hoping that someone someday will address my pain points.

</comment></comment></comment><comment><USER9> While I am overall pretty positive about Windows 10; has anyone else been having ongoing issues with this large "upgrade" updates?

For example my work machine is outright refusing to install the last one, and Googling suggests the only way to get around it is a manual install via USB. A family member's home machine also got corrupted during an install, and I had to wipe it to recover (since it couldn't roll back or complete the installation).

I like the concept of these "big bang" updates with new features, but there's something wrong with how they're delivered.

<comment><USER10> Also, is there a reason they take so long to install? I've had to wait a solid 15 minutes involving multiple reboots and multiple cycles of it showing 0 to 100% progress where you think it's done but it just keeps going.

<comment><USER8> My lay understanding is the big updates like this include a full Windows image rather than a delta, and basically replace the existing Windows image entirely, then replay the registry and settings into the new image.

It's somewhat akin to provisioning an entire new VM template and then replaying an automated install script to bring it up to date.

As someone that remembers how long in-place upgrades of that sort used to take (something like 98-ish to XP I recall taking hours), it's amazing they've got it down to "just" 15 minutes and a couple reboots.

(It feels like most Insider Preview builds get installed in this full image in-place upgrade system, too, and it's fascinating to see it happen sometimes two or three times in a week.)

</comment></comment></comment><comment><USER11> Best new feature - Task Manager locks the system up completely for about five minutes when I go to launch it to see why another process is behaving sluggishly...

</comment><comment><USER12> I find the Windows 10 Task Manager very useful. Good to see GPUs will be listed as well now.

</comment><comment><USER13> The Windows Fall Creators Update, which they are calling the Autumn Creators Update outside of North America, including in the southern hemisphere where Spring is in the air. No apostrophe. Marketing fail on so many levels.

</comment><comment><USER14> It'd be nice if the reviewer were familiar with other OSs. A lot of these best new features are stuff that other proprietary desktop OS had for some time now.</comment>


ULA Chooses Rocketdyne Over Blue Origin for Upper Stage - <AUTHOR> http://www.orlandosentinel.com/news/space/go-for-launch/os-united-launch-alliance-rocket-aerodyne-vulcan-20180511-story.html <comment><AUTHOR> I think the more interesting bit here is the ULA promo video that runs at the beginning. Clearly ULA and SpaceX are mortal enemies when it comes to market share for US launches, and ULA is saying that there special sauce is going to be 'indefinite' on orbit operations. They even include their on-orbit refueling pitch there.

The tactical advantage over SpaceX would be a 'launch any time' re-fuel and then change your orbital plane as needed. This would make waiting for a launch window less of a problem.

<comment><USER2> By the time ACES is supposed to fly -- 2024 -- SpaceX is planning on having BFR, which has in-orbit refueling and long-term in-orbit operations. No doubt SpaceX will be late, but they could still beat ACES to orbit.

Blue Origin is also planning on-orbit refueling at some point, maybe also before ACES flies.

ACES is a lot better than business-as-usual for ULA, great for them. But it doesn't fix their bread-and-butter problem of being the most expensive possible ride to orbit.

<comment><AUTHOR> I don't disagree with this assessment but I am encouraged how the current competition for launch capacity and capability over the last 16 years has done more to increase the US space capability than the previous 32 years.

<comment><USER2> Oh, we're definitely in an era of innovation! New production rockets include F9, FH, Rocket Lab's Electron, and OrbitalATK's Antares. And development is underway for BFR, SLS, Vulcan, Omega, and Blue Origin.</comment></comment></comment></comment>


Show HN: Gravity Doc, text editing meets physics simulation - <AUTHOR> https://gravity-doc.com/ <comment><USER2> Vaguely reminds me of some of the sillier and more useless features of 90's kid tool Microsoft Creative Writer. Just needs wacky sound effects.

[https://en.wikipedia.org/wiki/Creative_Writer](https://en.wikipedia.org/wiki/Creative_Writer)

</comment><comment><USER3> Is it just me or does that only work on desktop? The keyboard on my phone won't appear, even when clicking...

<comment><AUTHOR> As of now there is no mobile support. Definitely looking to figure something out for future updates though.

<comment><USER4> If you make a phone version, make the gravity linked to the gyro. It can work now on android with hackers keyboard, as it can be started from the notification draw.

</comment></comment></comment><comment><USER5> I don't get it.. Why?</comment>


A Logic Named Joe (1946) - <AUTHOR> http://www.baen.com/chapters/W200506/0743499107___2.htm <comment><USER2> There was also a pretty good radio play adaptation on NBC's _X Minus One_ , available at archive.org [0].

[0] [https://archive.org/details/XMinusOne55122831ALogicNamedJoe](https://archive.org/details/XMinusOne55122831ALogicNamedJoe)

<comment><USER3> I loved that episode - but X Minus One was an amazingly prescient sci-fi series.

</comment></comment><comment><USER4> It predicted the internet, much as it is today: [http://www.troynovant.com/Franson/Leinster/Logic-Named- Joe.h...](http://www.troynovant.com/Franson/Leinster/Logic-Named-Joe.html)

The other, better known prediction, is As We May Think by Vannevar Bush: [http://www.theatlantic.com/magazine/archive/1945/07/as-we- ma...](http://www.theatlantic.com/magazine/archive/1945/07/as-we-may- think/303881/)

</comment><comment><USER5> _" A Logic Named Joe" is a science fiction short story by Murray Leinster that was first published in the March 1946 issue of Astounding Science Fiction. The story actually appeared under Leinster's real name, Will F. Jenkins, since that issue of Astounding also included a story under the Leinster pseudonym called "Adapter"._

[https://en.wikipedia.org/wiki/A_Logic_Named_Joe](https://en.wikipedia.org/wiki/A_Logic_Named_Joe)

</comment><comment><USER6> That's the first appearance in science fiction of Google technology.

<comment><USER7> It is very Google-like. A wonder, then, that we aren't all out robbing banks.

<comment><USER8> Google is like the logics in the story, but hasn't churned out a Joe yet.

<comment><USER9> None of this is anything like Google, not even slightly. I did not read the story and think to myself "gee, Google..."

...at least not until I came back here, and read these comments.

What's with these weird statements?</comment></comment></comment></comment>


H-1B battle to take center stage in Senate on Tuesday - <AUTHOR> http://www.computerworld.com/article/2897208/h-1b-battle-to-take-center-stage-in-senate-on-tuesday.html

<comment><USER2> Lets hope they raise the cap so that I have some chance of getting into California for some years of work . Last year the chance of getting a H-1B was 1/3 .</comment>


CHICKEN Scheme - <AUTHOR> https://www.call-cc.org/ <comment><USER2> This well-known implementation has been discussed many times on HN, including a major recent thread: [https://news.ycombinator.com/item?id=18402567](https://news.ycombinator.com/item?id=18402567).

Before posting something like this, it would be good to check that there haven't been major recent discussions: [https://hn.algolia.com/?query=Chicken%20Scheme&sort=byDate&d...](https://hn.algolia.com/?query=Chicken%20Scheme&sort=byDate&dateRange=all&type=story&storyText=false&prefix=false&page=0). The cutoff point for dupes on HN is about a year, as [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html) explains.</comment>


An alternative to alert() - <AUTHOR> http://github.hubspot.com/messenger/ <comment><USER2> Not modal, not dismissable, not necessarily working depending on browser.

That's not an alternative to alert, that's just one more notification popup thing out of a billion or two.

<comment><AUTHOR> It's dismissible, try showCloseButton.

It's an alternative to alert in the sense that you can use it to provide a better experience than {error: alert}. It's not a great option for modal alerts.

What browser does it not work on? We'll file an issue.

<comment><USER3> Most people only use alert() for debugging. It blocks the thread of execution until dismissed which is a nice feature. However, alert() is almost never used to display user-visible messages, which one definitely would use your nice looking plugin for. The concept is called "flash messages" and there are some other plugins that also implement them, but they are not as sophisticated as yours.

<comment><USER4> They are also known as Toasts. I believe that's what the Android SDK refers to that concept as, as well as many other libraries.

<comment><USER5> I remember this as a Microsoft term, based on notifications from Outlook and MSN Messenger. The analogy is that it pops up like toast from a toaster.

</comment></comment></comment></comment></comment><comment><USER6> Super nice, but TWO dependencies? jQuery I guess is okay, since it's already, well, everywhere - but backbone?

Don't get me wrong, the first thing I thought was "Gotta use this somewhere", but if I need Backbone (a great library for where it fits!) just to make alerts prettier, then no thanks.

<comment><AUTHOR> It would be nice to get rid of Backbone. The chief dependency is the event parsing piggybacks on Backbone's, but it shouldn't be too hard to pull that code out and include it directly.

<comment><USER6> Ping me (tomaz[at]codeable[dot]io) if you do that (getting rid of Backbone dependency), I'll be more than happy to include it in our product, since we're just in the middle of implementing a notification system.

<comment><AUTHOR> Wilco: <https://github.com/HubSpot/messenger/issues/9>

<comment><USER6> Excellent, and while you're at it, make it a proper jQuery plugin then advertise it like one. Review sites and bloggers will be more than happy to put it in their "Top X jQuery plugins" posts, giving you a wider reach.

</comment></comment></comment></comment></comment><comment><USER7> Personally, I found this a breath of fresh air from the modal-based alert dialogs out there, although I wouldn't call it an alert per se. Alerts (as others have mentioned) block the UI and prevent the user from interacting with it until the message has been dismissed. This is more of a low-key notification element.

First of all, I'm not crazy about the other themes, but Future (the one enabled by default in the demo) is gorgeous. Maybe I'm just a fan of circular progress bars, but check out the demo involving "Error destroying alien planet." This is really pretty!

The stated use case for this is "transactional messages in your app." For that I think it fits pretty well. It might work as a debugging utility, similar to how we used alert() before we had console.log(), but it seems like the intended use case is for an end-user-facing interface.

Two minor gripes: 1) Backbone as a dependency for a UI element is kind of overkill. 2) This is more of a pet peeve, but why is the demo written in Coffeescript? I love Coffeescript and use it all the time, but I think it makes more sense for something like this to be demoed in Javascript. People who know Coffeescript are a subset of people who know Javascript, so you cater to a larger demographic this way.

That out of the way, great job on this. I'll have to find a project to use this in :)

</comment><comment><USER8> I think it's pretty clear that the intention of this tool is to provide alerts/notifications to users. Not sure what all the clamoring like "It doesn't do this" or "It doesn't work exactly like alert() in this way" are all about.

Anyway...Nice work, zackbloom. The notifications look and work great.

<comment><USER9> I'm going to guess it's due to being billed as "an alternative to alert()", while alert() is rarely used to display messages to the user.

</comment></comment><comment><USER10> I love the action buttons and the countdown timer. Very useful, though I might suggest optionally pausing the timer when the user mouseovers; that way if they want to take an action things are suspended. On the whole, it's a bit rough around the edges (close button is not always in the right spot on Chrome on Ubuntu; overlaps with the scrollbar, etc.) and I wouldn't use it in production just yet. But it's a great contribution.

</comment><comment><USER11> alert() and confirm() have one feature that no other alert system can match -- the execution of the surrounding script blocks at the calling location.

<comment><USER12> Indeed, it can be abused as a sort of primitive step-by-step debugging tool.

<comment><AUTHOR> I remember the days before the "Don't allow this site to show more alerts" checkbox when, if you accidentally left an alert in a loop, your only option was Ctrl-Alt-Delete.

<comment><USER13> Weird how you had JavaScript support but no process killing. I imagine you must have used DOS. What browser? Arachne didn't have JavaScript support...

<comment><USER14> Ctrl-Alt-Del is one of the ways to access the task manager in Windows, with which you can kill a process.

</comment></comment></comment></comment></comment><comment><USER15> I tried it out on an app I'm building. A few notes:

1\. The documentation is pretty lacking IMO. I would really like to see a unified "This is every option available to you" section. I have to dig through the code to figure out what is and isn't available.

2\. Please do the docs in Javascript, otherwise it is very difficult to notice that you're actually passing TWO objects to $.globalMessenger.do().

3\. A few of the code examples don't run, and a few don't look like they're meant to run. These should be in a separate 'notes' section (along with the options!)

4\. Just an FYI, to get this to work with Backbone.LayoutManager I had to add manage:false to the Messenger and Message classes.

5\. Why is the counter hidden in the future theme?

All in all a pretty solid library! Clearer documentation would do wonders but I am enjoying it so far. I really like the delay implementation, especially.

<comment><AUTHOR> Thanks. I created a few gh issues to track these.

Re the counter, it is planned that the spinner would take the place of the countdown in the future theme. The messenger-retry-soon and messenger-retry- later classes are in there to make it possible, it just has to be wired up.

Any thoughts on #4, do you think it makes sense to always include {manage: false}?

<comment><USER15> I was thinking about that. While one part of me thinks that the library shouldn't have to specifically support libraries like LayoutManager, the reality is that there is no way to make it work without transplanting that code into GlobalMessenger. Considering it doesn't affect non-LayoutManager installations, it may as well be in there.

Just a quick question - the $._messengerDefaults hash allows me to set a couple simple defaults across the app, but it appears that it can't set other defaults (e.g. showCloseButton). Is there an official way of setting this app- wide or do I need to just hack it in?

<comment><AUTHOR> I'll merge in a branch in a bit which gives you the ability to set $._messengerDefaults.messageDefaults

edit: merged!

<comment><USER15> Great, thanks!

</comment></comment></comment></comment></comment><comment><USER16> Got to give you props on the demo website, I like the layout you used where you have all the code with the RUN link right next to it. Very clean

<comment><AUTHOR> If it can be of help: <https://github.com/HubSpot/executr>

</comment></comment><comment><USER17> The X to close messages doesn't respond on ipad (running in chrome for IOS but I think safari does the same)

Also, in the change location thing, can you show what the current setting is (make the corresponding box darker).

<comment><AUTHOR> We'll take a look at it on an iPad, thanks!

</comment></comment><comment><USER18> Nobody's mentioned Blackbird JS yet, so: <http://www.gscottolson.com/blackbirdjs/>

Filterable log messages, closable and easy to stub out when you go into production.

</comment><comment><USER19> This is more a purr/growl replacement than a alert() replacement.

</comment><comment><USER20> This would be a true alternative to alert in older browsers if it provided what alert() doesn't: object inspection.

<comment><AUTHOR> Something like?

        prettyAlert = function(obj){
          alert(JSON.stringify(obj, null, 4));
        }

<comment><USER20> No, I'd like to see the same as used in Firebug, a sort of expandable tree that gets updated as the object is modified.

</comment></comment></comment><comment><USER21> Looks useful. Not having click to dismiss/a close button by _default_ is sheer madness though. Users expect to be able to close popups and having it just sit there is frustrating.

Also quite of few of the examples fail for me on Iceweasel, throwing reference errors for "msg" etc.

<comment><AUTHOR> Yep, not all the demos are 'runnable' on their own (they shouldn't look like they are). They try to use 'msg', even though its not defined in their scope [each example runs with it's own scope].

<comment><USER21> > (they shouldn't look like they are)

In that case I'd suggest not putting a big "run" button next to them and mixing them in with ones that are "runnable".

Or if you mean "they should look like they will cause a reference error" that would also be wrong - "each example runs with it's own scope" is not obvious.

Keep code that is purely "example code" and code that is intended for functionality demonstration separate. If you need to give example code as part of your explanation of the functionality it should appear with the explanation not in the same box as the demo code.

</comment></comment></comment><comment><USER22> It would be nice if we were able to run the edited code for viewing purposes. Kinda like what they did here <http://pinesframework.org/pnotify/#demos- simple>

</comment><comment><USER23> If you're going to build an alternative to something, it should be easier to use.

        alert("Your request has succeded!");

is way easier than

        $.globalMessenger().post "Your request has succeded!"

<comment><AUTHOR> Would

        alert = $.globalMessenger().post

help?

Each time you call globalMessenger() it gets a chance to do some checking to make sure it's at the right place on the page and has the right classes, but if you're not doing anything fancy (like injecting it into a page which keeps getting rewritten), this should be fine.

<comment><USER23> My main concern is the amount of typing especially when I'm just wanting to debug something with alert or console.log().

It seems like overkill for a function that's (mainly) used to debugging.

<comment><AUTHOR> That's a miscommunication then. It's mainly for providing feedback to the user, e.g. "Document saved", "Error deleting user", "Can't connect to the server, retrying in 4", etc.

For debugging, you should probably use console.log.

<comment><USER23> True, I think it was my stupidity. Sorry about that.

<comment><AUTHOR> Not at all, it wasn't the best title. Thanks for pointing out the confusion. We (HubSpot) are all talking about writing an actual alert replacement now :).

</comment></comment></comment></comment></comment></comment><comment><USER24> Very nice, but you really chose the wrong title. My initial reaction was "how is a replacement for alert() interesting in any way?" Glad I clicked anyway.

</comment><comment><USER25> I was actually hoping for an alternative to using alert() in IE7, as that's the only place I still use it for debugging purposes

<comment><USER26> If you use jquery, I wrote this really simple snippet that I use for quick down and dirty debugging.

var logit = function(x){$('body').append('

');$('#logit').css({'background':'#000','position':'fixed','bottom':0,'right':0,'color':'#fff','padding':5,'font- family':'arial','font- size':'9px','z-index':9999});$('#logit').append(x+'
');};

It could very easily be adjusted for non-jquery too.

Then just call it like: logit(whateverYouWantToDisplay);

</comment></comment><comment><USER27> What happened to console.log() ?

</comment><comment><USER28> How about accessibility? Is there any story, or any plan for that?

<comment><AUTHOR> It's a good question, we'd love to get any experience you have on the topic. I created an issue to track it if you can weigh in: <https://github.com/HubSpot/messenger/issues/10>.

<comment><USER28> Sweet, thanks very much!

</comment></comment></comment><comment><USER29> Slick design. My gripe is backbone being a dependency.

</comment><comment><USER30> Is there any demo page?

<comment><AUTHOR> There was a bug with the rendering on firefox which caused the run buttons to not appear. Should be fixed!

</comment></comment><comment><USER31> Rock on Zack!</comment>


How the Sausage Gets Made: The Hidden Work of Content - <AUTHOR> https://alistapart.com/article/the-hidden-work-of-content <comment><USER2> Note that in this article, content is defined as "scraping, scrubbing, copying, or pasting". It's about content _curation_ , not so much content _creation_.

That said, it's a good article on the work that goes into curation, and API frustrations leading to manual workflows.

<comment><USER3> > _It 's about content curation, not so much content creation._

That covers 90% of the content out there on the web today...

</comment></comment><comment><USER4> Article does not mention rights clearance, which is surprising, since the content wasn't created for that site.

</comment><comment><USER5> The article plays a bit fast and loose with a well known reference and apparently chose it in part because a critical detail of the award winning work was keeping dick pics out of the food feed. _Sausage_ works decently here as an analogy for grinding up the "meat" of content, adding some spice, cooking it and getting it to work as a cohesive whole when it is really a bunch of cobbled together parts.

I can relate to her description of _automagically_. When I had a corporate job, they introduced a means to fast track your file by submitting it online instead of by fax. They promised a faster turn around time for online files.

I worked on that team for a bit. The back-end experience, where real people scrambled to review the files and make this online submission magic happen, reminded me of the scene in _Men in Black 2_ where they open up an automatic mail sorting machine and inside is a guy with multiple arms sorting the mail at high speed.

Rode: What looks like _The Jetsons_ on the outside often resembles _The Flintstones_ if you open it up and peer inside.

</comment><comment><USER6> I thought the story headline would draw from the famous quote misattributed to Bismarck:

"Laws are like sausages. It is better not to see them being made."

Perhaps the same applies sometimes to Web content.

<comment><USER7> It basically applies to anything.

<comment><USER8> If our clients saw how much googling we do...</comment></comment></comment>


Silicon Valley salaries: developers make big bank in 2012 (infographic) - <AUTHOR> http://venturebeat.com/2013/02/13/silicon-valley-salaries-developers-make-big-bank-in-2012-infographic/

<comment><USER2> It seems like their sample population is too small to be fully confident in their conclusions. For example, why does the average salary for Java, Ruby, and Python specialists peak 3-5 years into their career and then decline? Why do early career candidates from top schools make less than their counterparts from worse schools? I don't think this can all be explained away with the equity argument and if it can, it probably makes the whole exercise moot.

</comment><comment><USER3> What happen to iOS Engineers? I don't believe this infograph 100%.</comment>


Signs that you're a bad programmer - <AUTHOR> http://sites.google.com/site/yacoset/Home/signs-that-you-re-a-bad-programmer <comment><USER3> I have to say, I really didn't like the document much. Not because of substance. Some of what he says is true.

On style, though, I think the document is trash. Some of what I say is probably even a bit ad hominem.

Most of the good programmers I know don't spend time worrying about bad programmers. They just write good code and cleanup bad code when they see it.

If someone feels compelled to write up an essay about bad programmers, he probably spends a lot of time dealing with bad programmers.

That experience should lead to humility, not arrogance. If you deal with a lot of bad programmers, you might not be as good as you think you are. After all, you work at the same place on the same project as a bunch of bad programmers. They where hired under the same standards as you.

To me, the document just seemed like arrogant posturing. An attempt at crafting a "negative identity" (define a group by vilifying the outsider). The best way to "be", and to be recognized as, a good programmer is to write good code. All the other stuff is just horse shit.

<comment><USER4> >> "They where hired under the same standards as you."

The problem is though the hiring process for programmers is often completely broken. Measuring good programmers is also broken in many companies, so bad programmers tend to just stay there instead of improving, or being fired.

I think being a good programmer isn't too hard if you have the talent, taste, time etc. Being _recognized_ as a good programmer, and rewarded as such is harder.

<comment><USER5> Excellent point. Another to add to the list is that you may easily have been hired under a higher standard as the team lead or "working/programming manager".

I have been fortunate to never work with a bad programmer, but I have worked with inexperienced programmers that were learning as they went. I was not hired under the same standard or for the same reason they were.

</comment></comment></comment><comment><USER6> Google cache for those who hit the "pageview limit exceeded" nonsense:

[http://www.google.com/url?sa=t&source=web&ct=clnk...](http://www.google.com/url?sa=t&source=web&ct=clnk&cd=1&url=http%3A%2F%2F184.108.40.206%2Fsearch%3Fq%3Dcache%3AA7_WaV28LBcJ%3Asites.google.com%2Fsite%2Fyacoset%2FHome%2Fsigns- that-you-re-a-bad- programmer%2Bhttp%3A%2F%2Fsites.google.com%2Fsite%2Fyacoset%2FHome%2Fsigns- that-you-re-a-bad- programmer%26cd%3D1%26hl%3Den%26ct%3Dclnk%26gl%3Dus&ei=G6p7Spq1CovYsgPg8KXvCg&rct=j&q=http%3A%2F%2Fsites.google.com%2Fsite%2Fyacoset%2FHome%2Fsigns- that-you-re-a-bad-programmer&usg=AFQjCNHJJZpSR-zgzZoC-dz6oeOChaPpqA)

<comment><USER7> wow, that's completely ridiculous.

searching through their help center, they won't even tell you what the limit is, but it seems to be pretty low. just. wow.

<comment><USER8> Reminiscent of Geocities, isn't it.

</comment></comment></comment><comment><USER9> Oh man, I wish I had this at my last job half the team had over 50% of these symptoms, one guy had 90%. They believed, and had somehow convinced management, that they were great programmers! Some awesome practical examples from those guys below:

Overheard statement "You know when I was in college I learned C. I just can't get the hang of these objects, so I try to avoid them". The guy who said this is now 34, and has programmed python for 4 years.

A guy who would copy and paste 100 line blocks of code, and then occasionally thing "oh yeah, i need functions", and then finish out the current function by passing 12 parameters of state to current_function_2(). If you combined the func, func_2 and factored out the 100 line blocks it would be reverted with a commit: "stop making this so complicated".

There was one guy who insisted that using templates was only for web frameworks, to use them to write system/config files (done frequently due to 3rd party daemon limitations) was an abuse of the templating system, and we should just use inline prints. The program was to be called with prog > /etc/conffile.

One guy who decided that threads were so tricky, that he was the arbiter of thier use. My idea of a job queue and worker threads was "too abstract and hard to debug", so we stuck with the "tried and true" one thread per job method, all spawned at once.

I could go on, but you're all prolly bored now :)

tl;dr: i worked with the guys the article was written about

<comment><USER10> ouch... I love the 'stop making this so complicated bit'.

While some people really don't get it I'm pretty sure that most people could learn how to program with some competence.

The only metric I've found to measure programmer competence reliably is how big a project you can manage to complete. Some people get stuck at around 100 lines, others in the thousands or tens of thousands, some can keep their rudder straight across 100's of thousands of lines.

The latter takes extreme self discipline and organization.

<comment><USER11> LOC is a horrible metric for this, given the degree to which morons can get comfortable with copy-paste and IDE-generated boilerplate.

Gzip-bytes of source FTW.

<comment><USER12> "you can manage to _complete_ "

Implicit in the notion of completing a project is the certainty that the project manager will change their mind, usually after you have written 95% of it. If you copied & pasted those hundred thousand lines, you will have to change something in at least 100 different places. At that point, you'll give up in despair, proclaim the change impossible, and have the PM cancel the project in a fit of frustration. Thus, not complete.

LOC actually sorta makes sense in this context.

</comment></comment></comment></comment><comment><USER13> Funny that he has this under "Signs that you shouldn't be a programmer": "you think the presence of code in a program will affect its runtime behavior, even if it is never invoked".

Anyone who has written code in C can probably cite an anecdote where exactly this was the case, be it from a compiler bug or as fallout from a memory corruption bug.

Maybe we should add "does not understand the von Neumann architecture" to the list of signs that you're a mediocre programmer... On second thought, let's not -- the piece is bad enough to begin with. The "alternative careers" sections are just odious, and the whole thing breathes an air of inconstructiveness.

<comment><USER14> This happens in JVM languages as well. Most optimizing compilers will do things differently depending on what happens elsewhere in a function, even if it's "dead code" (and _especially_ if it's dead code that the compiler is too stupid to _realize_ is dead).

Granted this _usually_ only affects runtime speed, but in some circumstances things can get worse (multithreaded programs are particularly susceptible to such optimizations, especially if they're not written correctly - yes, the _real_ problem may be that you've written your code wrong, but there are very real situations where the presence of dead code can change the optimization path taken enough so that it either works or doesn't, which is a very real effect).

And that's even _before_ we take into account compiler bugs, which just make things worse.

</comment></comment><comment><USER15> Here's a flaw which I've seen in several otherwise _good_ programmers - forgetting that sometimes the core purpose of code is to be read and maintained by other human beings. Some of those other human beings may not have had the time to catch up on the latest/greatest language feature or 'trick' and may miss subtleties of your implementation.

I get worried when I see someone take a mainstream language (C#, Java, Python) and try and twist its idioms into whatever their favorite language is (lisp, the ML family, Perl, etc). Or if someone wants to be on the bleeding edge and use the latest language syntax/library trick. This is a pain because

\- Someone new to the codebase may not have as much familiarity with all these nuances of the language. For example, I've seen crazy things done with C++ templates. I don't think there was ever a justifiable reason for doing any of them.

\- The esoteric, cutting edge features often have bugs and/or don't have great tool support. Fact of life is that the more some feature gets used, the more the bugs found and fixed. If you're on the bleeding edge, you're going to hit weird language/runtime bugs which you need not have inflicted on everyone.

\- Debugging. Often, the only thing you have after a weird bug is a crash dump and caffeine. You want to give yourself all the chances you can of tracking down that issue. Esoteric language features rarely lead themselves to great crash dump debugging. I'm not suggesting writing C code but the closer the mapping from code you write to x86/64 code, the easier it is for you

<comment><USER16> Sometimes use of advanced facilities is a way of elevating your status over the uninitiated. Now that you've shown weakness, I'm really going to pour it on!

</comment></comment><comment><USER17> I'm skeptical of these lists because people can work through things. For example, the stuff listed under "Inability to determine the order of program execution" is something that many people will get jammed on eary on as they try to take their brains (which is honed on the syntax of school level maths) into the programing world (where equals is an instruction rather than an assumptions). Another one is "Lisp is opaque to you". It's very sweet for MIT types to make these declarations from mount olympus, but lisp is something that can take time to acquire. If someone isn't a natural programmer but is happy to work at it to overcome hurdles then there's nothing wrong with that.

One of the examples of bad technique is:

        Homebrew "Business Rule Engines"

Can anyone give examples of the sorts of things the author means by this? What sort of systems have people seen, and why is it necessarily a bad thing?

<comment><USER18> "It's very sweet for MIT types to make these declarations from mount olympus, but lisp is something that can take time to acquire."

Don't worry. In the Valley, people from MIT don't have a good reputation as great programmers. For some reason, their education is a lot of 'theory' and less practice.

Apart from Standford\Caltech, Some of the best schools that produce great programmers are your average state school.

I have a theory behind this, which may be correct. Learning to be a great programmer takes years, and school is just the start. People that do well enough go to something like MIT, think they are already very smart, and don't try hard when they come out.

But if you are hungry, and smart, and just happen to go to your average state school, you probably will do better, as you probably are humbler to begin with.

It seems when the rubber meets the street, in startups, building products, that's where the great programmers are made, and lisp is not a requirement to know to be a great programmer, or actually build great products. Having an idea of what functional languages are is a must, knowing them is not.

<comment><USER19> nope not the case, I know a bunch of people at these various schools, and the crux of the problem is that theres a huge culture at MIT (and moreso than many peer schools) of celebrating herculean last minute efforts that get the grade. This is great for experimental hacking on a weekend, and "good enough" for research, but it does not encourage an incremental design sensibility, owing to its last minute nature.

This is not to say that any of these people are bad at what they do, they just have bad habits that they need to walk off, but first someone needs to tell them!

<comment><USER20> _the crux of the problem is that theres a huge culture at MIT (and moreso than many peer schools) of celebrating herculean last minute efforts that get the grade_

That's a very astute observation. I work and have worked with many MIT people, and even TA'd an MIT course. The "all nighter" hazing ritual culture was very prevalent. To this day, my friends who went to MIT prefer to work 24 hour shifts, late nights, and on weekends - even though they've been out of school for a decade. In addition, MIT had a culture of boot-camp style negative reinforcement. "You suck, are not smart enough and are lazy, work harder" was the driving attitude. (at least it was in the late 1990s)

In contrast, when I moved to the west coast, all the Stanford people I met were more about basking in their obvious awesomeness and mastering time management. Get the project done early, schedule everything around ultimate frisbee team and rock climbing club, go to the outdoor concert on Friday night and still make it up to Tahoe for the weekend.

</comment></comment></comment></comment><comment><USER21> I love the insight that lacking critical thinking "originates in both lazy thinking and egocentric thinking". The latter is very true. I have never met a great programmer who thinks they are at the top of their game. Being aware of the trade offs in any solution requires a degree of humility.

</comment><comment><USER22> Signs that you're a bad web host: "pageview limit exceeded"

If Google can't figure out a way to monetize popular content targeted at a professional technical audience, something's very wrong.

The best idea I've seen for such situations is to let people trying to view the page buy an instant traffic upgrade on the site's behalf; I'd chip in 100x the costs to serve my single hit if I knew it would restore visibility for me and some others.

The help link is also uncharacteristically inept for Google -- it doesn't lead to an explanation of pageview limits, and searching [pageview limit exceeded] in the help area turns up only user questions, no official article on the topic. The third hit is this unanswered gem, from a popular site _with AdSense_ that keeps going down due to the limits:

[http://www.google.com/support/forum/p/sites/thread?tid=08f19...](http://www.google.com/support/forum/p/sites/thread?tid=08f19dca3ab69764&hl=en)

</comment><comment><USER23> This is a very good article, and hits lots of very good points.

However, it seems that there is a little bit of a self-diagnosis problem. For example, if you write "voodo code" (great description), unless there is some one to tell you, how do you know? And if you write voodo code, do you know what idempotent means? There is maybe a bit of the "Blub" effect here.

Perhaps between "Symptoms" and "Remedies" there needs to be "Diagnosis" or some hints at self-evaluation or tools for self-assessment.

</comment><comment><USER11> This is absolutely amazing and comprehensive! I can't think of anything he really left out.

I've seen articles like this before, but they're usually super-parochial, and I've never seen one that offered 'remedies' (much less the hilarious 'alternative careers' in the last section).

</comment><comment><USER24> Signs that you're a bad programmer: 1) You think you're an amazing programmer.

</comment><comment><USER25> Just reading that made me a bad programmer. :/

</comment><comment><USER26> Pageview limit exceeded

We are sorry, but this site has exceeded its page view limit at this time. Please try again later. For more information, see Google Sites help.

<comment><USER27> Does anyone have a mirror for this page?

</comment></comment><comment><USER28> He's missing the third part, signs your a decent programmer, to differentiate the good from the great.

<comment><USER11> That's ridiculously difficult to do at all, much less in pithy universal checklist form.

<comment><USER9> For starters howabout: 1\. you read the bad list and thought "oh crap!" 2\. the oh crap is no longer a problem for you, but remembering the code with that problem makes you wince.

</comment></comment></comment><comment><USER16> That was mostly high quality except for the wannabe "you might be a redneck" (shouldn't be a programmer) section at the end.

> (Functional) Manually caching the results of a deterministic function on ... > Haskell

You still have to explicitly memoize at times in Haskell.

> refactor his old code with the goal of reducing its instruction count by > 10:1 or more

What a loser! I go into my old code with a goal of 10000:1.

> Recursive subroutines that concatenate/sum to a carry-along output variable

This can be justified.

> Using strings/integers for values that have (or could be given) more > appropriate wrapper types in a strongly-typed language

Not always worth it.

> Unit Testing, which you use at design time.

No, I don't.

> You don't use whitespace or indentation

If I'm not using whitespace, what am I supposed to indent with?

</comment><comment><USER29> Seems to be a good source for creating interview questions.

</comment><comment><USER30> It's down, but it sounds like a copy of <http://badprogrammer.infogami.com/>

<comment><AUTHOR> Just moved it to another host. Not like Google was any better >:|

<comment><USER31> I noticed when one of your articles was posted to reddit that there was no signature on it, it's nice to know who is behind them. Do you think you will ever publish these in book form? Your tips are blindingly accurate, it could definitely be a Code Complete III, updated to include functional and declarative programming.

</comment></comment></comment><comment><USER32> "Phase 5: "By letting a constraint solver figure out the mundane details, I can write programs by describing what I want, rather than how to give it to me""

This is one of the best arguments for why anyone should bother to learn Haskell (or likewise language)

</comment><comment><USER33> 1\. (Haskell) Propagating the myth that Haskell would do some automagic caching of function results.

(Haskell simply does call-by-need: square (x+1) evaluates to (x+1)*(x+1), but there's still only one (x+1) that gets evaluated.)

</comment><comment><USER34> Some praise for this article: Identifying a set of patterns for sub-quality programming practise is useful in order to set about correcting those things esp. if you're in a mentoring position. I think it would have been nice to have given these names (like design patterns perhaps) and fleshed out their definitions further.

Yes, the author is more arrogant than desirable in his delivery but don't let that blind you to the good stuff. Some of the teaching analogies, in particular, I thought were good.

</comment><comment><USER35> High cohesion is bad in exactly which programming environment? Functional or procedural?

I've always understood high cohesion to be related to low coupling. Also, writing util classes before you need them (where low cohesion may be necessary) is a nothing more than a time sink. Do something when you need it, not before. You are not omniscient and will not be able to account for everything no matter how hard you try.

</comment><comment><USER36> FTA: "Signs that you shouldn't be a programmer

1\. Inability to determine the order of program execution

Symptoms

a = 5 b = 10 a = b

print a You look at the code above and aren't sure what number gets printed out at the end"

The answer is not always obvious. If the above code were in Java and print a was running in a different thread then it very well print 0, since a or b could be 0. JMM can really bite you if you don't understand within-thread as- if-serial semantics.

<comment><USER34> That's a pretty extreme case don't you think? You're certainly playing devil's advocate here. We all know what the author meant by this.

</comment></comment><comment><USER37> This is spot on:

       5. Lisp is opaque to you

<comment><USER38> I can't learn LISP. I can get reasonable work done in imperative functional/OO languages like Perl, C, Java, etc. and took the time to learn Erlang to get a look at functional programming and I can drop the SQL bomb like nothing else (so I can do declarative too) but every time I've sat down to learn LISP because people say it will make me a better programmer, I've gotten distracted and haven't finished.

I don't think this makes me stupid, or a bad programmer. I think it means I have different tastes and limited time. Learning LISP feels like learning assembly: a great exercise, but there are other things I'm more interested in doing - like building things I enjoy with my limited free time.

That being said, maybe I am stupid, or a bad programmer. I don't think not being into LISP means this is the case. I like building things people use, more than I like writing elegant code for code's sake.

<comment><USER39> I don't think Lisp being _opaque_ has anything to do with your ability to learn a particular PL such as Common Lisp, Scheme, Arc or Clojure. Rather, opacity is usually a term levied at a _syntax_ , when it makes it hard to understand what the underlying semantics of the program are. Lisp has the least "syntax" of any programming language I know of, so if it's opaque to you (e.g., you can't take a guess at what "(+ 2 3)" means), you probably shouldn't be programming.

<comment><USER40> I don't understand the following point you made:

"so if it's opaque to you...,you probably shouldn't be programming"

So your saying that someone should not program if they haven't learned basic lisp ( 5 )?

Or are you suggesting that there should be some time limit... like if you program for X months but don't understand it you are forced to quit.

But.. further... What is the purpose of forcing these people to quit?

And.. What is the purpose of belittling these people?

<comment><USER39> I'm not talking about _learning_ programming. The reference in the article was to people that already _were_ programmers.

To put it another way: if you _call_ yourself a programmer, and _sell your skills_ as a programmer, but can't mentally decompose "(+ 2 3)" into an AST (basically the first, and easiest, step to understanding), _even after Lisp's general syntax is explained to you_ , then you _aren't_ actually a programmer.

<comment><USER40> Above, you said whether they could guess it, not whether they could understand it after explained.

"you can't take a guess at what "(+ 2 3)" means"

I can see your meaning if it was explained to someone and they still didn't grok it. But I would still kinda feel like encouraging them.

</comment></comment></comment></comment></comment></comment><comment> brown9-2 I'd been looking for a name for what the author terms "yo-yo" code. I've often wondered if others have to deal with such head scratchers too.

</comment><comment><USER41> Great doc to make screeners with.

</comment><comment><USER18> After reading it twice, there are many points that are good, but there also some points that are not so clear cut, or plain bad. Maybe I am a bad programmer, but I disagree with some points:

# (OOP) Writing lots of "xxxxxManager" classes that contain all of the methods for manipulating the fields of objects that have little or no methods of their own

I guess they keyword 'lots' make this ok, but having plain objects (scruct like), passed around in the application, and having some managers is fine. eg. if you have an application that passes around contacts, you can have a ContactsManager, taking care of all the messy bussines (local peristence, remote persitence, deleting, etc., while contacts remain simple objects. ActiveRecord pattern goes the other way, where this logic is placed in the objects. Both are fine.

# (Relational) Treating a relational database as an object store and performing all joins and relation enforcement in client code

\--I guess all those programmers in the "NOSql" movements are idiots. (they are not, some of these people are really smart). Don't take this statement too seriously.

# Re-inventing or laboring without basic mechanisms that are built-into the language, such as events-and-handlers or regular expressions

\--I think regular expressions are evil, obscure, and performance is highly depended on the implementation. Practical example, checking if an email address is valid. While some people go all the way crazy with regular expression, All I do is check that there is an '@', or a '+', at least one '.', and minimum/maximum lengths. You don't regular expressions for that, as no matter how smart you think your expression is, there is a great chance somebody that edits it will fuck it up just by changing a character on it.

# Re-inventing classes and functions that are built-into the framework (eg: timers, collections, sorting and searching algorithms) *

Done many times. If you are doing mobile, most of platform implementation (at least in J2ME) just suck ass. You can't rely on them. Heck, in my previous company we did even font rendering, thread worker queues, etc. as the scheduler was unreliable, etc.

#Recursive subroutines that concatenate/sum to a global variable or a carry- along output variable

\--For some problems carry-along variable are needed.

eg, in a binary search tree, trying to print only the nodes in a certain level. printTreeLevel(tree, 2) -- will print only the nodes at level two

print(node, level)

      if level == 0

         print node.data

      else

         printTreeLevel(node.left, level - 1)

         printTreeLevel(node.right, level - 1)

# Writing business-logic functions with tragically compromising side-effects, such as updating a user interface or performing file I/O

\--I guess it depends on the definition of what "business-logic" is. This guy thinks it more as the transactional/model part and not a controller. For some apps, the business logic is the main controller. Plus, "bussines logic" is more of a managerial speak anyways.

#Homebrew "Business Rule Engines"

\-- Maybe I am not old enough, but I had to look it up what a "Business Rule Engine" is. Seems stuff from the Dot Com era/enterprise world.

#Code that tries to prevent an exploit from working by searching for the exploit's signature

\--Haha. That's the whole Antivirus industry. I agree with him, and I don't have antivirus software, but it seems that those companies made millions by breaking this rule.

<comment><USER42>
      Recursive subroutines that concatenate/sum to a global
      variable or a carry-along output variable

Wow...I didn't see this in the article. That is downright boneheaded. Is accumulator-passing style forbidden for a reason? It's a cheap way to make functions tail-recursive---much cheaper than CPS!

<comment><AUTHOR> I'm still looking for a good way to express what was meant by that symptom description.

You know about tail recursion, but I'm trying to get at the uses of accumulators that have nothing to do with tail recursion.

That and I got fed up with listing all of the exceptions to every rule.

</comment></comment></comment><comment><USER43> The author lists the following as a symptom of being "unable to reason about code":

 _"5. 'Bulldozer code' that gives the appearance of refactoring by breaking out chunks into subroutines, but that are impossible to reuse in another context (very high cohesion)"_

I disagree with this. The purpose of breaking out code in to subroutines isn't only for code reuse. If you don't break out code in to subroutines, at some point your code is going to become unwieldy and difficult to read.

I try to stick to the rule of having each subroutine consist of no more than a page of code (so that each subroutine can be seen all at one time, without needing to scroll). Often that leads me to break up the subroutine in to many other subroutines. This improves readability greatly and makes it much easier to reason about the code. If any of the subroutines I break my code out in to happen to be reusable, that's just icing on the cake, not a necessity.

<comment><USER44> Sometimes the (seemingly) simple act of trying to come up with a name for a subroutine helps me reason about what it is I'm trying to do (whether the chunk is re-usable or not).

<comment><USER45> I don't know if you've tried this, but if you write down some pseudocode before you really get started, the logical chunks of the program will take their names straight from the pseudocode.

<comment><USER46> Or do comment-driven development: write the comments for the method first, then convert the (hopefully!) plain English into code, ideally so that no comment is needed.

</comment></comment></comment></comment><comment><USER47> How to avoid (if you're a C programmer) writing utterly terrible code - <USER2> include these WARNINGS in your build step:

WARNINGS := -Wall -W -Wunused-parameter -Wmissing-declarations

WARNINGS += -Wstrict-prototypes -Wmissing-prototypes -Wsign-compare

WARNINGS += -Wconversion -Wshadow -Wcast-align -Wparentheses

WARNINGS += -Wsequence-point -Wdeclaration-after-statement -Wundef

WARNINGS += -Wpointer-arith -Wnested-externs -Wredundant-decls

WARNINGS += -Werror -Wdisabled-optimization -pedantic

CFLAGS += $(WARNINGS)

Note: -pedantic is pretty good if you really wanna learn how to write code that will work properly.

Also: Treating Warnings as Errors is a good thing. You'll learn a lot, and the most important thing will be: handle all warnings. Do not release code until it builds clean.

<comment><USER48> Good advice, but compilers often issue warnings like "x may be used uninitialized" even when it cannot happen.

<comment><USER47> Erm, wut? Not really. If there is a warning, its there for a reason. Fix that.

<comment><USER48> As everyone who has written a C program of sufficient complexity knows, these warnings are _not_ always correct. Google for "spurious warnings uninitialized", e.g:

<http://kerneltrap.org/node/6591>

An unrelated example where gcc (and icc) emit needless warnings about integer types is this:

      int x = foo();
      unsigned y = (x == 0);

Don't get me wrong, I'm in favor of cranking up the warning levels, but there is a reason why not everything is included in -Wall (yes, "uninitialized" is included, I know).

<comment><USER47> As a professional C coder for 20+ years, with well over a million lines of code under my belt, I can tell you that anyone that is ignoring warnings because of a buggy compiler is _using the wrong compiler and should fix that immediately_.

I work on SIL-4 rated systems for life-protection applications. Absolutely _ZERO TOLERANCE_ for warnings is a requirement in this job, and every single time it has been addressed, the warning gave us a clue how to fix something. Whether it was the code that needed fixing, or the compiler - either way, the alert is there. Ignore at your own peril.

</comment></comment></comment></comment></comment><comment><USER49> Oh, you can put it as simple as:

If you think you are good, you are not. If you think you have to improve, chances are you will become _better_.

(Life is baby steps; ask a baby...)</comment>


Dear White People, You Suck at Diversity - <AUTHOR> http://techcrunch.com/2015/12/13/dear-white-people-you-suck-at-diversity/ <comment><USER2> The author complains that some people don't mention all facets of diversity, but so does she.

"On a recent episode of Re/Code Decode, Dick Costolo, in response to Kara Swisher's broad question about diversity, makes zero mention of racial minorities, trans people and gender nonconforming people"

Race, sex and sexual orientation. Is that it? How about nationality? How about economic class? How about education level? How about all these other factors of "diversity" that are constantly ignored in favor of the "magic triplet" race/sex/sexual orientation?</comment>


Amazon to launch a Netflix-like service for books | Front Side Bus - <AUTHOR> http://www.frontsidebus.net/2011/09/11/amazon-to-launch-a-netflix-like-service-for-books/ <comment><USER2> OMG, please please please. If this has a good helping of new fiction all the time, I'm going to be in heaven.

Wait... Do I have time for that? Maybe I want to hope for it NOT to exist?</comment>


PoC or GTFO 15 [pdf] - <AUTHOR> https://www.alchemistowl.org/pocorgtfo/pocorgtfo15.pdf <comment><USER3> > _" Technical Note: This file, pocorgtfo15.pdf, is valid as PDF document and > as a ZIP file of the relevant source code. Those of you who have laser > projection equipment supporting the ILDA standard will find that this issue > can be handily projected by your laser beams."_

So this file is a PDF that's also a ZIP, and the archive contains - <USER2> other things - a song in MP3, and another PDF that's _also_ a Git repo. Oh, and the whole bundle is supposedly laser-projector-compatible (that fact I can't verify - I have no access to such equipment).

I love this <3.

<comment><USER4> Issue 10 is my all-time favorite:

> _The polyglot file pocorgtfo10.pdf is valid as a PDF, as a ZIP file, and as > an LSMV recording of a Tool Assisted Speedrun (TAS) that exploits Pokémon > Red in a Super GameBoy on a Super NES. The result of the exploit is a chat > room that plays the text of PoC‖GTFO 10:3. Run it in LSNES with the Gambatte > plugin, the Japanese version of the Super Game Boy ROM and the USA /Europe > version of Pokémon Red._

<comment><USER5> This is genuinely brilliant. Thanks for sharing.

For anyone who wants to read the back issues: [https://www.alchemistowl.org/pocorgtfo/](https://www.alchemistowl.org/pocorgtfo/)

<comment><USER6> Back issues are always included in the current issue, hence the zip. Keep recursing that way (or use binwalk)

</comment></comment></comment></comment><comment> semi-extrinsic The good pastor Laphroaig preaches:

If the 0day in your familiar pastures dwindles, despair not! Rather, bestir yourself to where programmers are led astray from the sacred Assembly, neither understanding what their programming languages compile to, nor asking to see how their data is stored or transmitted in the true bits of the wire. For those who follow their computation through the layers shall gain 0day and pwn, and those who say "we trust in our APIs, in our proofs, and in our memory models and need not burden ourselves with confusing engineering detail that has no scientific value anyhow" shall surely provide an abundance of 0day and pwnage sufficient for all of us.

</comment><comment><USER7> No Starch Press is taking orders for a limited print edition.

[https://www.nostarch.com/gtfo](https://www.nostarch.com/gtfo)

 _Estimated availability August 2017_

 _Consistent with the journal 's quirky, biblical style, this book comes with all the trimmings: a leatherette cover, ribbon bookmark, bible paper, and gilt-edged pages. The book features more than 80 technical essays from numerous famous hackers_

[https://twitter.com/billpollock/status/874403109677748226](https://twitter.com/billpollock/status/874403109677748226)

<comment><USER8> It seems like a beautiful edition, I'd like to buy it. However, shipping to Europe costs almost as much as the actual book (25$). Are there other sites that sell it? My local Amazon usually has most No Starch books in stock, but I can't find this one.

<comment><USER9> They're distributing at DEFCON if you know anyone going.

<comment><USER10> We'll have the book in wider distribution after Defcon. If we don't sell out of them.

</comment></comment></comment></comment><comment><USER11> From the PDF: "Bitrot will burn libraries with merciless indignity that even Pets Dot Com didn't deserve. Please mirror don't merely link! pocorgtfo15.pdf and our other issues far and wide, so our articles can help fight the coming flame deluge. We like the following mirrors. [https://unpack.debug.su/pocorgtfo/](https://unpack.debug.su/pocorgtfo/) " [https://pocorgtfo.hacke.rs/](https://pocorgtfo.hacke.rs/) [https://www.alchemistowl.org/pocorgtfo/](https://www.alchemistowl.org/pocorgtfo/) [https://www.sultanik.com/pocorgtfo/](https://www.sultanik.com/pocorgtfo/)

</comment><comment><USER12> The server seems to be under fairly heavy load, more download options listed here: [https://archive.org/details/pocorgtfo15](https://archive.org/details/pocorgtfo15) (Try the torrent)

Other mirrors:

[https://www.sultanik.com/pocorgtfo/pocorgtfo15.pdf](https://www.sultanik.com/pocorgtfo/pocorgtfo15.pdf)

<comment><USER13> Also published over IPFS as QmSYPTz9Eg2HyStSzVtiyUzehPDT1J9LEenBqt3TpFLRrD

You can see the filelisting directly in the browser here: [https://ipfs.io/ipfs/QmSYPTz9Eg2HyStSzVtiyUzehPDT1J9LEenBqt3...](https://ipfs.io/ipfs/QmSYPTz9Eg2HyStSzVtiyUzehPDT1J9LEenBqt3TpFLRrD)

Edit: decided to mirror all of them, provided in QmcLWK1R4KK7mDwSDwAm5Ny5gs185vgMpXbnbWbxp44Dvm - [https://ipfs.io/ipfs/QmcLWK1R4KK7mDwSDwAm5Ny5gs185vgMpXbnbWb...](https://ipfs.io/ipfs/QmcLWK1R4KK7mDwSDwAm5Ny5gs185vgMpXbnbWbxp44Dvm)

<comment><USER3> To those who know how to use IPFS - how do I make it so that my computer mirrors those files with this hash?

<comment><USER13> Run this command while the IPFS daemon is running:

$ ipfs pin add QmcLWK1R4KK7mDwSDwAm5Ny5gs185vgMpXbnbWbxp44Dvm

It'll start downloading and then seed about 700 MB of data as long as you have the daemon running.

</comment></comment></comment></comment><comment><USER14> What a wonderful publication. Reminds me of the Internet pre-2000. Fun times, and kudos to you if you are a PoC || GTFO contributor/publisher and reading this.

</comment><comment><USER15> WCoG||GTFO (Working Code on GitHub)

<comment><USER16> Apparently, the PDF is _also_ it's own git repo. (This is normal for POC||GTFO.)

<comment><USER3> Not the main PDF. If you unzip (!) the main PDF, you get the copy of the "Git as PDF" article in its own separate file (PDFGitPolyglot.pdf), and that latter file you can use as a git repo.

      $ git clone PDFGitPolyglot.pdf testrepo
      Cloning into 'testrepo'...
      Receiving objects: 100% (432/432), 622.40 KiB | 0 bytes/s, done.
      Resolving deltas: 100% (270/270), done.

Within the repo you can find the raw PDF, and all the source files for that PDF (including .tex article) and scripts for turning it into a git repo.

<comment><USER17> I've never seen this done before, and I'm in awe.

<comment><USER18> When zellyn said this is normal for PoC||GTFO, they weren't kidding.

[https://www.alchemistowl.org/pocorgtfo/](https://www.alchemistowl.org/pocorgtfo/) (Click "Spoiler" for some of the old ones)

<comment><USER19> If you are interested in polyglot files like this, have a look at the work of [0] (who was probably directly involved in this particular release).

[0] [https://twitter.com/angealbertini](https://twitter.com/angealbertini)

</comment></comment></comment></comment></comment></comment><comment><USER20> (0x15 suggests the 21st or 22nd issue, but the intro says it's only the sixteenth.)

 _edit: title 's been fixed, this is no longer relevant_

<comment><USER21> If there was an issue 0x0, would it be the First issue or the Zeroth issue?

<comment><USER22> [https://www.sultanik.com/pocorgtfo/#0x00](https://www.sultanik.com/pocorgtfo/#0x00)

</comment></comment></comment><comment><USER23> When they thought of the name, I wonder if any thought was given to the alternate reading of PoC as "People of Color"

<comment><USER18> PoC has stood for "Proof of Concept" for a long time, so probably not.

It is amusing to read it as "People of Color || GTFO" as a statement demanding racial equality in companies' hiring practices.

<comment><USER24> There's actually a way to get that. Use work-hire tests.

Work hire tests are anonymous and unbiased. Either candidates can do the work, or they can't.

You have to set it up so that the work-hire test is all that matters, though, which ~nobody does.

<comment><USER25> They're not necessarily unbiased or even anonymous (in a meaningful way). The problem which is set might somehow favour applicants from certain backgrounds. The language used might be unnecessarily complex or use local idioms. The comments and variable names might betray the candidate as a non-native (but perfectly proficient) English speaker. If the candidate uses company hardware, the keyboard may be set to a different layout to what the candidate is used to.

There are lots of ways any test which (ostensibly) aims to test raw ability can be very biased indeed. A lecturer of mine once told a story about a horrible experience he had during an exam trying to whisper an explanation of the rules of Checkers to a student who was from a country where the game was rarely played - the possibility hadn't even crossed his mind.

Declaring the interview style you use as "unbiased" from the start seems like a great way to get complacent and have large amounts of bias creep in unnoticed.

<comment><USER24> What are some ways to counter this effect?

<comment><USER26> Be intimately familiar with, and fully accepting of and comfortable with, every culture that applicants may potentially come from.

Or, explicitly require / assume that all applicants be fully familiar with your culture.

Or, define an industry standard artificial culture - whether implicit or explicit - and require everyone on both sides to be familiar with it. This could include things like suits and golf for execs, hoodies and beer for techies, social justice activism for webdevs, etc...

</comment></comment></comment></comment></comment></comment><comment><USER27> Did anyone else read PoC as point of control? The IT seems to be draining out of my immediate mindset.

edit: added link to what I thought PoC was in this context: [https://marketdelta.com/how-to-plot-and-trade-naked-pocs- poi...](https://marketdelta.com/how-to-plot-and-trade-naked-pocs-point-of- control/)

<comment><USER28> "Trade naked PoCs"... Not sure exactly what it is but it sounds dirty.

;)

<comment><USER27> Naked PoC's mean that if there was a particular price in a stock/future/whatever that had more volume done at it than any other price for the day...it's "naked" the next day until the price returns to it.

EG... if today APPL traded at $105 for more shares than any other price, and tomorrow the price is $106, we would say the naked PoC is $105 until it was revisited.</comment></comment></comment>


Is Tox secure? - <AUTHOR> I just found the app called Tox. Is it secure? How about the anonymity and privacy / encryption?<p>EDIT: I'm asking because I found a few threads here at HackerNews telling us it is not secure to use and we shouldn't using it. <comment><USER2> It is. I've tested, overviewed the code and packet-sniffed several self- claimed anonymous and secure chat apps, tox was in a tie with signal and telegram with security, and first place for me with anonimity. The toxCore philosophy (isolating the protocol tools from the client) is a big plus too, you can create your own client or integrate tox to your app however you like. The sodium crypto library is really trusted and easy-to-use (less control but it's more failproof than openSSL primitives), it's based on the NaCL library written by the creator of Salsa20/Chacha20 encryption Daniel Bernstein.

</comment><comment><USER3> Anonymous developers, no public code audits by renowned security experts. Haha.

</comment><comment><USER2> The encryption is both super-fast and well-tested, stream ciphers are more suitable in the era of internet voice and video calls, where you don't always know the length of the data to be encrypted, and using block ciphers will cause a (I know, negligible but...) latency because you have to wait for X bytes to fill a block.

</comment><comment><AUTHOR> EDIT: I'm asking because I found a few threads here at HackerNews telling us it is not secure to use and we shouldn't using it.

<comment><USER2> Well it is indeed a point that it is yet to be reviewed by an acknowledged security company, and toxcore's last commit was in 2015. I'll search for one of these threads though

<comment><AUTHOR> Thank you. I really do not know if I should use it for sensitive information on a daily basis.</comment></comment></comment>


Ask HN: What if someone builds and uses advanced AI systems unethically? - <AUTHOR> It's not because a technology can be dangerous that it shouldn't be built. I think that's the argument a respectable authority once used for nuclear technology. Thus, what if in the near future, someone manages to build an AI that is intelligent enough to pose a real threat to society?
I'm not talking Skynet yet, but a more realistic scenario where a company or individual would, for example, become able to use machine learning to hack most of any computer, financial, or power grid system.
I'm aware influential companies and individuals have invested in the ethical aspect of machine learning, but how would that help mitigate such unethical use of such technology?
My understanding is that unethical use of nuclear technology is discouraged between countries by deterrence, in which case retaliation could ensure that no side ends up winning, but as far as I understand, it doesn't apply to machine learning, does it? <comment><USER3> I suppose the same laws that are in place for human intelligence would either apply or be adapted to apply to these situations. For example there are people who can currently use computers to do the things you describe, and there are consequences if they get caught. If someone programs AI that subsequently commits these crimes, it is reasonable that the programmer could be held accountable. The gray area comes when someone programs an AI for one purpose and it is later used (or chooses by itself) for another illicit purpose.

</comment><comment><USER4> I don't think your scenario is realistic.

Are there examples of machine learning used to break into a system? I've heard of other machine-supported techniques which seem more effective, like fuzz testing. But not deep learning.

Wouldn't it be more useful to talk about more realistic examples? Like how deep learning methods end up encoding race or gender bias (eg, [https://motherboard.vice.com/en_us/article/nz7798/weve- alrea...](https://motherboard.vice.com/en_us/article/nz7798/weve-already- taught-artificial-intelligence-to-be-racist-sexist) or [http://randomwalker.info/publications/language- bias.pdf](http://randomwalker.info/publications/language-bias.pdf) ) because they are trained on data created by humans with human prejudices?

Or using deep learning to keep people "engaged" with a web site or app with in-app purchases, by making making it more addictive? (eg, [https://boingboing.net/2018/02/07/literal- sociopathy.html](https://boingboing.net/2018/02/07/literal-sociopathy.html) )

<comment><USER3> What about a (theoretical) general AI that could socially engineer passwords and banking info from victims online? Or pretend to be a person to call in a bomb threat?

<comment><USER4> The OP asked about a realistic scenario in the near future.

Your example of a general AI seems to fall outside those constraints.

<comment><USER3> More realistic than SkyNet was the only qualification given, but point taken.

<comment><USER4> Your are right that "more realistic" isn't the same as "realistic". I took it to mean the latter as otherwise we're in movie plot territory.

I regard "what if in the near future" as another qualification.

<comment><USER3> I think we're within 20 years of computers being able to hold a freeform conversation in text or speech to do what I described. To chat someone up on Facebook or the equivalent, talk on the phone and convincingly imitate a real person. For reference, Dr. Sbaitso was created in 1991[1], and look how far we've come since then with Alexa, Google Assistant, Siri, Bixby.

1\. [https://en.m.wikipedia.org/wiki/Dr._Sbaitso](https://en.m.wikipedia.org/wiki/Dr._Sbaitso)

<comment><USER4> Hmm, what you wrote was "socially engineer passwords and banking info from victims online".

According to [https://en.m.wikipedia.org/wiki/Turing_test](https://en.m.wikipedia.org/wiki/Turing_test) :

> In the 21st century, versions of these programs (now known as "chatterbots") > continue to fool people. "CyberLover", a malware program, preys on Internet > users by convincing them to "reveal information about their identities or to > lead them to visit a web site that will deliver malicious content to their > computers".[33] The program has emerged as a "Valentine-risk" flirting with > people "seeking relationships online in order to collect their personal > data".[34]

It may be that a computer with the ability to hold a freeform conversation/"advanced AI" is not necessary to do the social engineering you mentioned earlier.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I assume you mean AI in the sense of powerful machine learning systems - <USER2> would think if we consider a general AI, you might consider rephrasing the question along the lines of 'What if an advanced AI behaves unethically'? (If you get my point there...)

First, I think you need a way to define 'ethics' and 'morals', with a 'ontology' and a 'epistemology' to derive a metaphysic for the system (and for my $.02, aesthetics arises from here). Until we can have a bit of rigor surrounding this, it's a challenge to discuss ethics in the context of an AI, and AI in the context of the metaphysical stance it takes towards the world.

To quickly illustrate - comments below discuss encoding race or gender bias (for example). I think this is a metaphysical problem (application of Wisdom to determine correct action) that we mistake for an epistemic issue (it came from 'bad' encoding).

Next, after we get some rigor surrounding the ethical stances you consider 'good' vs. 'bad' in the context of a metaphysic - you have to consider 'who' is using the system unethically.

Unless you have clarity here, it becomes extremely easy to befuddle, confuse, or mislead (innocently or not) questions regarding 'who'.

\- Who can answer for the 'Scope' or strategic context (CEO, Board of Directors, General Staff, Politburo, etc.)

\- Who in 'Organizational Concepts' or 'Planning' (Division Management, Program Management, Field commanders, etc)

\- Who in 'Architecture' or 'Schematic' (Project Management, Solution Architecture, Company commanders, etc)

\- Who in 'Engineering' or 'Blueprints' (Team Leaders, Chief Engineers, NCO's, etc.)

\- Who in 'Tools' or 'Config' (Individual contributors, Programmers, Soldiers, etc.)

that constructed the AI.

Then you need to ask which person, group, or combination (none dare call it conspiracy!) of these actors used the system in an unethical manner? Might 'enabled for use' be culpable as well - and is that a programmer, or an executive, or both?

What I'm getting at here, is that there is both a lack of rigor in such questions (in general in this entire area - it's not like it is your fault), a challenge in defining ethical stances in context (which I argue requires a metaphysic), and a lack of clarity in understanding how such systems come to creation ('who' is only one interrogative that needs to be answered, after all).

I would say that until and unless we have some sort of structure and standard to answer these questions, it might be beside the point to even ask...

And not being able to ask leads us to some uncomfortable near-term consequences. If someone does use such a system unethically - how can our system of retributive justice determine the particulars of who to hold accountable, what went wrong, how it was accomplished (in a manner hopefully understandable by lawmakers, government/corporate/organizational leadership, other implementers, and one would think - the victims), understand why it could be used this way, and if it could happen again - just for starters.

The sum total of ignorance surrounding such a question points to a serious problem in how society overall - and then down to the individuals creating and using such tech - is dealing (or rather, not dealing) with this vital issue. We need to start talking along these lines in order to stake out the playing field for everyone _NOW_ , so we actually might have time to address these things, before the alien pops right up and runs across the kitchen table.</comment>