Ask HN: Learning 2 Hack - For the very first time. With a deadline. - <AUTHOR> 	Dear HN, This is a plea for advice. I've recently decided to take the plunge and learn how to code. I have my own startup that I foolishly outsourced, and I've decided that there really is no other way around it then sitting down and learning to hack myself, and then iterating the product once I have a better handle on things.
Items I submit for consideration:
1. I have a site already running (more or less, it will be at least within the week) on rails. I have no idea what is going on, but I'd like to figure it out and be able to change functionalities as I learn about my customers.
2. I have never coded before. Not even once. I still don't understand what a hash is, really. Aside from taking a class, I really don't know the best way to learn. I've been reading books, but reading hasn't been doing much for me, since I'm not really absorbing the material. I want to try 'testing' things out...I don't know if that makes sense, but I feel like if I have exercises to do, I will understand concepts much faster then simply reading.
3. I have availability to take courses. But, I do not know what courses to take. I am based out of the bay area, and am open to suggestions for classes for beginners.
4. I have a self-imposed deadline of four months. Is this enough time to be able to handle simple, workable functions on rails? (The common answer, my guess is, is that it's completely up to me. But I'm just looking for perspective. what can I possibly get accomplished, if I am starting from scratch?)
Also, supplemental 5: Would there be anyone out there who would be willing to learn with me? I think having a partner would help tremendously, but I don't know where to find people in such a situation.
Please let me know your thoughts. <comment><USER2> Just a general bit of advice: You will learn more iterating through "change the code, save the file, execute the code, repeat" than any amount of plain reading. When I learned Python, I sat down with Dive Into Python and the command line.

<comment><USER3> I think Dive into Python is a great book - but I wouldn't recommend it to biz2hack. At least - not yet. (How to Think like a computer scientist) is a better Python intro book - but if you've got a site in Ruby/Rails - start with that.

Completely Agree though on this: "change the code, save the file, execute the code, repeat"

Here's a first step for you - you've got a website somewhere - getting it running on your local machine. It might be worth installing something like VMWare Player and setting up a linux "virtual machine" - you can download pre- configured ones. (To translate - that basically means your windows computer can pretend to be a linux server - and that pretend server can run all of your programs - without changing anything on your own system)

Regardless of how you do it - let me repeat. Set it up locally and play with it. Change. Save. Test. Repeat.

<comment><USER2> I wasn't suggesting Dive into Python to him, he's trying to learn Ruby. I was just drawing upon an example. The VMWare approach, setting up a virtual linux box so that he can configure apache and ruby, might be a little much for a biz2hack, as you put it.

<comment><AUTHOR> Would you happen to know a similar book available for Ruby, if you have any ideas?

<comment><USER4> These two are both good intros to Ruby: <http://pine.fm/LearnToProgram/> <http://mislav.uniqpath.com/poignant-guide/>

</comment></comment></comment></comment></comment><comment><USER5> If you want to get a handle on the basics, especially ruby basics, try out ruby koans.

<http://github.com/edgecase/ruby_koans>

They are simple exercises that you can work through without prior knowledge, its a fast and fun way to get your feet wet. Then its important to read some books and get a good foundation under those wet feet, but we all know books can be boring, try to find one that has an actual project you work on throughout, seeing concepts come to life in front of you can be really helpful.

Then try to look at some code, since you are using rails I would highly suggest railscasts ( <http://railscasts.com/> ) they are short videos, but there are 188 as of this writing that show some cool stuff about rails and get you in the hacker mindset.

<comment><AUTHOR> Thanks for the reply. Do you have any resources you can recommend where I can learn more about programming in general? There seem to be a lot of things that people talk about that just go completely over my head.

<comment><USER6> It really helps to have people to whom you can direct questions as you learn.

Do you have any friends that are developers? People generally enjoy when someone takes a genuine interest in their field. Perhaps ask politely if any of them would mind occasional IMs as you work your way through things.

<comment><AUTHOR> Actually, no...unfortunately. I think while I am at the Hacker dojo, I'll make some more friends as I'm here. But that's a great idea, I just hope to make some friends that will tolerate questions that are rather basic..

<comment><USER7> Alternatively, get your hands on a free IRC client and hang around #ruby and #rubyonrails on irc.freenode.net.

Hit or miss, at times, but being able to chat live with real Ruby and Rails programmers is pretty helpful.

</comment></comment></comment></comment></comment><comment><USER8> Get whoever coded this site for you to explain how to deploy it, in enough detail that you would be very confident re-deploying it several times a day if you wanted to. If the original coder is unavailable, find a hacker friend who can figure the process out for you.

Once you're comfortable deploying, start making _really_ small changes. Don't bother with books or classes yet - they'll round-out your knowledge once you know the basics, but in my experience they're not much use for getting people started. Begin by just editing bits of text on the website. Then progress to really small pieces of functionality. Try to deploy some small positive change to the site at least once a day. Doing this will build your confidence and get you to the point where you can make gradually bigger and bigger changes.

<comment><USER9> I would recommend this advice as well. Deployment for Rails apps isn't as simple as uploading something to a remote server.

Here are some links specific for rails deployment:

<http://www.capify.org> <http://www.modrails.com/>

This is specific to hostingrails (a rails hosting company), but it's the simplest tutorial I've found...

[http://www.hostingrails.com/wiki/1/How-to-deploy-a-Rails- app...](http://www.hostingrails.com/wiki/1/How-to-deploy-a-Rails-application- on-HostingRailscom)

Some other technologies that you may need:

<http://en.wikipedia.org/wiki/Fastcgi> <http://en.wikipedia.org/wiki/Apache_HTTP_Server> <http://en.wikipedia.org/wiki/Mongrel_%28web_server%29>

</comment></comment><comment><USER10> I would start with these books:

[http://www.amazon.com/Beginning-Ruby-Novice- Professional/dp/...](http://www.amazon.com/Beginning-Ruby-Novice- Professional/dp/1590597664/)

[http://pragprog.com/titles/rails3/agile-web-development- with...](http://pragprog.com/titles/rails3/agile-web-development-with-rails- third-edition)

With your deadlines, you're going to have to skip over some CS basics just to get everything going. That's okay though, there is enough to learn to keep you busy for a lifetime. The most important skill set that you need to learn _right now_ is how to determine what's important this second and what can wait until later. Deadlines are a fantastic way to learn that skill :D

</comment><comment><USER11> Here is what you should do:

1\. Get the firebug extension for firefox. It will allow you see changes live on your site, exactly how it appears in your browser.

2\. Hit F12 to launch it.

3\. Start out by learning basic CSS. Find a class to play around with, let's pick something like

       textarea {
       color: #000000;
       font-family: courier;
       font-size: 10pt;
       }

What will happen when you change #000000 to some other color, #ff0000? AHA! that changes the font color for the text box to red. Perfect, let's try another class.

4\. Next you should learn HTML, use the element tool in firebug and select one of the elements. It'll highlight the element in question. And will show you the code for that element. Click edit, and see the full code for that element. Then modify the code and try different options, to see what the changes do.

I'd use Dreamweaver as a suggestion tool, since it shows you all available options. Which comes in handy, if you don't really know HTML like the back of your hand.

Your #1 priority is learning to read other people's code. After you do, you can quickly "borrow" their code for whatever it is you are working on. Especially useful if it's just CSS/HTML.

5\. After your get the hang of HTML and CSS, you can move on to scripting languages and databases. By this point you should be able to read other people's code, which will help you find the code snippets in the code your freelancer wrote for whatever example you are looking for.

</comment><comment><USER12> Hey man, I recently had a similar revelation that I just needed to learn how to code. I picked up ruby a week ago with the intent of learning rails and building web apps. I knew a bit of python/django before, but nothing that could be considered hacker knowledge. If you want to learn together, let me know. It'd probably help the both of us. I have a few ebooks and what not that I could send you that have helped me learn the basics. I'm kyrobeshay on freenode #startups. Email is in my profile.

<comment><USER13> Kyro and biz2hack, I've been thinking it would be fun to get some beginners/novices together to learn the basics of various languages together. At some point we'd probably need to tap some outside wisdom but we could get started together. Interested?

<comment><AUTHOR> 100 percent absolutely. My e-mail is in my profile, and I would be very happy to be a part of this!

<comment><USER14> Hey biz2hack, I'm not seeing your email in your profile. I'm in for joining you guys. I last programmed about 4 years ago, and 4 weeks ago I picked it up again. My email is in my profile, and please keep me in the loop.

<comment><AUTHOR> Ricuarte, sorry about that. We're also going to start an IRC Channel where we can all get together and ask each other questions. My e-mail should be in my profile now.

</comment></comment></comment></comment></comment><comment><USER15> My websites started with someone else asking permission to post something I had written on her site. She made a little subsite on her site for my stuff. I sent more content to add to it occasionally. When she could no longer keep up, she gifted me the templates. My then-husband was pursing a degree in computer science and took a few minutes to explain a few things to me (like what an FTP program was) and I started with a Yahoo account which apparently wasn't very hacker friendly. I later moved my sites to something with more flexibility when I knew more. Initially, I could only copy and paste colors to change backgrounds and copy and paste text to make a new page. The first time I tried to change anything structurally, I messed it all up. The woman who wrote the original templates kind of mentored me for a time and I eventually used some CD's, online sites, and a book or two to learn more coding, supplemented with talking with friends online who knew more than I did. I still tend to look things up "as needed". I do okay these days with my websites. They are in (X)HTML and CSS.

My current goal is to learn a programming language so I can write a game. I have yet to seriously pursue that. I don't have a deadline though. Que sera, sera.

I hope my story is helpful to you and good luck with this.

</comment><comment><USER16> _I've been reading books, but reading hasn't been doing much for me, since I'm not really absorbing the material. I want to try 'testing' things out...I don't know if that makes sense, but I feel like if I have exercises to do, I will understand concepts much faster then simply reading._

IMO, then, you've been reading the wrong books. I went through "Learning Rails" (O'Reilly) and followed the text through, actually doing stuff rather than just reading about it, and it worked great. I do recommend the "Learning (foo)" series by O'Reilly, but I don't have a copy of Learning Rails right here to flip through to see quite how absolute-beginner-friendly it is. The Pragmatic Programmers guides to Ruby on Rails are also quite good. Flip through books in B&N or something to see if you can find something with really appealing worked exercises, do it cover to cover, and then sit down with the guys who did your current site and get them to explain it to you.

Alternatively, set yourself a target small project that isn't maintaining an existing site, e.g. creating a blog. Plenty of screencasts and online tutorials on that sort of thing to follow along with but I would say most of them assume knowledge of programming, whereas books tend not to.

</comment><comment><USER17> > I've been reading books, but reading hasn't been doing much for me, since > I'm not really absorbing the material. I want to try 'testing' things > out...I don't know if that makes sense, but I feel like if I have exercises > to do, I will understand concepts much faster then simply reading.

OMG of course, this is how everyone does it and you leave me amazed at why didn't you try to code something yourself?

</comment><comment><USER9> Hey there, Though I am a little ahead in building a Rails app, I'm essentially in the same position you are in and (more importantly) have the same mindset of building it myself. Shoot me an email and hopefully we can help each other with our projects.

<comment><AUTHOR> Thanks Chris, will do!

</comment></comment><comment><USER18> One thing that will be limiting your motivation is how much you actually like coding if you truly do like it I'm sure you can be competent as to what is happening on your rails site in your time frame but if you absolutely loath programming the goal may be a hard one to reach.

For ruby you probably could do well starting off with Why's (Poignant) Guide to Ruby <http://mislav.uniqpath.com/poignant-guide/> and maybe buy pragprog's ruby book, programming ruby, or the ruby way and move up from there

Just remember to try and change the code yourself, you have to interact more than read the books

</comment><comment><USER19> I would dare to suggest that you create a HN thread for other novices. Better yet, you use this thread to ask your questions, and some folks here will try and answer politely.

Don't worry about the possible flak because of the n00b questions, we ALL were n00bs at one point of time...

As for point 4, you can learn to create a whole site without knowing what's the difference between a function and a closure, so worry about practicing your coding skills hehehe I'm sure you'll nail it if you code regularly.

The best of luck, welcome to our world <insert dark laugh here>

</comment><comment><USER20> Whys Poignant Guide to Ruby is an excellent, gentle introduction to Ruby. If it fits your personality that is. Have a look and decide for yourself.

[http://www.scribd.com/doc/2236084/Whys-Poignant-Guide-to- Rub...](http://www.scribd.com/doc/2236084/Whys-Poignant-Guide-to-Ruby)

Remember that Rails is just a large Ruby program. The best way to understand Rails is to understand Ruby (plus MVC and other general software development theory that Rails uses). If you don't understand Ruby, you'll just be a copy/paste Rails programmer.

</comment><comment><USER21> biz2hack....like everybody else pointed out, the best way to get into it is to jump in with trying small changes, and seeing the effect of those changes. I was in a similar position as you recently, except that I know all the fundamentals of programming - did a BA in Comp Sci :)

However, I have recently taken a liking to Ruby and am committed to learning Rails. I looked at many Ruby books and even tried the poignant Ruby tutorial that other posters have linked to, but I found the best tutorial & accompany book is the 'Learn to Program in Ruby' book by Chris Pine. <http://pine.fm/LearnToProgram/> He started writing a Ruby tutorial online and refined it according to feedback from readers. Then once he had all of that done, he published it in a complete book. But the bulk of the tutorial is still available free at the link I posted above.

Chris does an awesome job of making programming accessible. He assumes you don't have any experience programming, and breaks down everything into 'human- friendly' language. It is hands-down one of the best programming texts/tutorials I have ever seen. The truth is, I have been searching for a similar text for Rails, but haven't found it.

If you start there, I think that would be a good place to start.

Keep us posted on how it all goes.

Good luck!

</comment><comment><USER22> Hey Biz2Hack,

You posted this earlier today and I wrote you a reply, then when I hit 'submit' the page was deleted!

Here is what I wrote:

(1) Well, you certainly have your problems cut out for you.

You won't be lacking in motivation, that's for sure :)

Where to start...

Programming is a method, a way of thinking, it has nothing to do with the actual language that you use to do it in, that's just a means to an end (though judging by the various language wars they are probably more like religious factions). Changing your site is great, but you'll have to set up a development and a production environment, and make sure you run those on two separate databases to make sure that if you do something you end up regretting you can revert back without your users catching any grief.

(2) Pick whatever feels best and easiest to you. That choice seems to have been made for you, since you mention 'rails', but really that's a framework for a language called 'ruby'. So ruby comes first, then rails.

Probably your best bet is to start off with making a list of the terms that you keep coming across (rails, ruby, framework, webapp) and so on, then read the wikipedia page on each of those to give you a feel for the terminology.

A 'hash' is a programmers trick to turn any object (usually a string, but you can apply hashes to just about everything else) into a more or less unique number. That way it becomes easier to find things, hashing is used for many purposes but one of the main applications in programming languages is so allow you to find in a very short time an entry in a list without having to go through all the items in the list one by one.

Your best bet to understand this stuff given the requirements of your situation seems to be to get a book on entry-level ruby, read that until it falls apart making sure that you do and understand all the exercises, then to move on to the rails framework.

You can test things out but I think there are better ways of learning how to program a given framework than messing around with a live website.

(3) As for courses, there are lots of tutorials available online, I would advice you to find a programmer buddy, preferably one that already has experience in the field that you are interested in.

4) could be, depends on how much time you put in there and how much background you already have. It sounds like a tall order to me, but when sufficiently motivated I'm sure you'll amaze yourself in what you can do in three months of really hard work.

(5) I completely agree with you there, hence the tip for a programming buddy. I'd look for that IRL though, and only use online fora as a backup plan if you can't find a live human being.

best of luck with all of this, let us know how you fared!

j.

\-----

<comment><AUTHOR> Thank you so much jacques, and I will absolutely keep you updated. I hope that things will go well. Actually, (2) is the way that I previously learned finance, and it worked incredibly well. Thanks for the advice, and I'll be sure to follow through with that.

Would you have any suggestions for (3)? Someone had also previously mentioned railscasts, and I came across rails tutors, but I was looking for something that could help me get started on the basics.. My dad recommended programming for dummies, but that series usually seems to only cover cursory explanations. (Maybe I'm wrong?)

<comment><USER22> Learning how to program is a lifetime journey, it is not something that you do in a couple of weeks or months, but it is possible to learn enough of a particular environment that you can use to get to a level of being able to do something moderately useful.

There isn't a book so 'dumbed down' that you don't learn anything from the only thing that you will see then is that it will be something that you can go through relatively fast. At worst it will give you the confirmation that you already knew it all :)

I'm not into ruby so I can't tell you what books to look at, but elsewhere in this thread there are some good suggestions and some people that are willing to hook up with you, so I think you'll be alright.

</comment></comment></comment><comment><USER23> What better language for someone like you than my language of choice, Ruby.

Get started here: <http://tryruby.sophrinix.com/>. Now. When you get that done, if you want more goodies, email me (email in my profile) or reply, I'll be glad to help.

Also check out <http://www.htdp.org>

</comment><comment><USER24> My contact information's in my profile. If you have any questions, no matter how general or specific, don't hesitate to bug me.

</comment><comment><USER25> Since you're in the bay area, you should look into regional meetups for people learning/using rails. There's one at Berkeley the third Tuesday of each month (Nov 17 this month)

<http://ruby.meetup.com/81/>

</comment><comment><AUTHOR> Hey everybody, I just wanted to let you know I've created #HNBeginners for those who are just starting out and or those who would like to contribute and help other people out who are just getting started. Please drop by if you can!

</comment><comment><AUTHOR> Thank you all so much! I will definitely keep you updated of my progress, and if there is anyone who would like to e-mail me to get in contact with me, my e-mail is in my profile. Thanks again!

</comment><comment><USER26> Do you have source control set up? Because you will break the code and be unable to fix it and that might cost you 4 months itself. Source control is your #1 priority.

</comment><comment><USER27> Read this: <http://norvig.com/21-days.html>. If you start now you'll be good to go in 2019.

</comment><comment><USER28> Once you get going, you'll want version control to keep track of the editing process.

So what version control software is good for a total novice? (I use git because it is industrial strength, but that may not be the best for biz2hack.)

What version control does: It keeps a record of all the little changes you make as you create your code. If you blow something up, no problem, just revert the latest change. If you want to try a wacky experiment, you can put it in its own little sandbox and ditch it if it doesn't work out. If a bug shows up, you can work back through earlier changes until it disappears: the next change is the one that introduced the bug.</comment>


A Better Javascript Date Picker/Calendar - <AUTHOR> https://github.com/ChiperSoft/Kalendae <comment><USER2> As unfashionable as it may seem, ASP.NET's ill-fated AJAX Toolkit library (before MS realised that jQuery was the way forward) still has the best date picker control: [http://www.asp.net/ajaxLibrary/AjaxControlToolkitSampleSite/...](http://www.asp.net/ajaxLibrary/AjaxControlToolkitSampleSite/Calendar/Calendar.aspx)

The key thing is the ability to click the month/year headings to zoom out.

<comment><USER3> Not very discoverable though, I wonder how many people ever found that one out.

<comment><USER4> More than you might think given that it's a clone of the Windows date picker.

</comment></comment></comment><comment><USER5> Very nice. I've been using this one for a project recently: <http://www.eyecon.ro/datepicker/> and I noticed the other day that the author has begun work on an updated version: [http://www.eyecon.ro/colorpicker-and- datepicker-for-twitter-...](http://www.eyecon.ro/colorpicker-and-datepicker- for-twitter-bootstrap.htm)

<comment><USER6> updated version really looks (and works) nice, thank you!

</comment></comment><comment><USER7> Opening in response to focus and not accepting focus itself means that it can't be controlled by keyboard (or other not pointer related control device) which could be an issue for disability access.

Admittedly a user forced to use a keyboard could just type in the date so nothing is broken for them other than "interface icing" so it isn't a massive issue, and other than that this looks very nice.

(FYI, I've used [http://www.frequency-decoder.com/2011/10/11/unobtrusive- acce...](http://www.frequency-decoder.com/2011/10/11/unobtrusive-accessible- datepicker-widgit-v6) and its predecessor in a couple of projects which is also very nice and is fully non-mouse controllable)

</comment><comment><USER8> It would be good if he explained somewhere why (from a user perspective) this sucks less than the alternatives.

It seems very little different from what Dynarch's calendar offered in 2007 (the new version is still self-contained): www.dynarch.com/projects/calendar

</comment><comment><USER9> No dependencies but uses moment.js ?

What about I18N for months, days and date format parsing ?

<comment><USER10> Yeah i18n and locale support is a must if this wants widespread adoption

</comment></comment><comment><USER11> While it looks nice, it is completely inaccessible for non-mouse/non-visual users.

I recommend that the developer takes influence from the AEGIS/AOL/TPG accessibility demos - <http://hanshillen.github.com/jqtest/#goto_datepicker>

</comment><comment><USER12> Looks nice. Any plans to integrate a time picker?

<comment><USER13> Author here. I do have a time picker in the works but I was planning to have it be a separate project. I suppose it could be a good idea to bundle it with this to avoid duplicating moment.js.

<comment><USER12> Currently I'm using a heavily hacked third party time picker that was patched onto jquery ui datepicker, and half of the advanced datepicker functions don't work or work badly. It took me a day of research and at least two days of hacking to make this work well: <http://imgur.com/87e9g.png> , I'd love to see a replacement that _just works_ without any hacking needed :)

</comment></comment></comment><comment><USER14> This picker seems nice. I'm bookmarking it for any case where a complex datepicker is necessary.

For people looking for keyboard / accessibility support, I personally don't think a datepicker should be attempting to handle those concerns; it's more of a UI polish layer than a primary input method.

On that note, if you're looking for something significantly more lightweight (~8k minified) and easily skinnable, you could check out my own jQuery.minical:

<http://jquery-minical.heroku.com/>

<comment><USER14> (To clarify my own statements: I'm not saying there's never a time to use a highly accessible datepicker, just that a very common use case for a datepicker is just to provide a visual way to quickly input a single date into a form control.)

</comment></comment><comment><USER15> Great that it doesn't have dependencies and no query needed.

But I'd like to see that stylesheet eliminated and loaded only on demand if/when the widget is actually used.

<comment><USER16> oh that's a good idea for load time. You could always use an async loader like $script.js <https://github.com/ded/script.js/>

</comment></comment><comment><USER17> Well done! I would definitely use this on a small project where I only needed a calendar and not the entire jQuery UI library.

</comment><comment><USER18> I saw the screenshots and demos and immediately disliked it. The default should be that the week starts at Monday. The default String representation should not be `m/dd/yyyy` but instead `dd.mm.yyyy`. There could be additional examples that show the date formats that are used in the usa, but not the first and default ones.

<comment><USER19> Ideally you use a localization framework which manages date formated and your back end just deals with date objects.

</comment></comment><comment><USER20> It would be better if clicking in the gaps between day boxes would choose the nearest day box, so that the mouse would not flash between arrow and hand while sliding across it (this is a pretty common UX practice, I think it has a specific name).

</comment><comment><USER21> only thing i notice missing is the ability to select the month/year from dropdowns... like this: <http://jqueryui.com/demos/datepicker/#dropdown-month- year>

<comment><USER22> I agree, if for example you were using this to make date selections far in the past or future there's a LOT of clicking. Unless there's some way to skip years in larger amounts that I just couldn't find in which case there's a discoverability problem.

</comment></comment><comment><USER23> Really nice. Shouldn't be too hard to also support IE7 as it is, will fork!

Two suggestions: an ok button (don't force users to click out just to close it), open on the upper side when at the end of the page.

<comment><USER24> I'd be very interested in ie7 support as well. As our contracts still all support ie7 (is there like an eta on ie7s death?).

But hey, if you fork it, post the repo here! Ill help test it :)

</comment></comment><comment><USER25> Ok now use it without a mouse/trackpad...

</comment><comment><USER26> Click and drag (Google Calendar does it) would be cool. The click-twice-to- select-range isn't necessarily automatically intuitive.

<comment><USER16> it is nice for a phone/tablet though.

</comment></comment><comment><USER27> Definitely like some of the features in this picker.

If anyone's ever looking for a lightweight simple date picker (~4k) you can always check out mine:

<https://github.com/glad/glDatePicker>

:)

<comment><USER6> please remove this annoying animation, and strange effect with mouse cursor on inactive days (for a moment I thought that chrome has crashed)

<comment><USER27> You can actually remove the calls to slideUp(200) and slideDown(200) and replace them with hide() and show() respectively.

As well you can set the -hover class to not alter the looks if you don't want the hover effect.

</comment></comment></comment><comment><USER28> It's good but it's hard to skip large spans i.e. years.</comment>


PatternFly – a web UI framework by RedHat - <AUTHOR> https://www.patternfly.org/ <comment><USER2> I work at Red Hat (part of the CoreOS acquisition) and I have to say that PatternFly has not been useful to the project I work on.[1]

First, PatternFly is big. We were mandated to adopt it, and it tripled our CSS (from 45kB to 145kB). PatternFly also bundles Open Sans web fonts, which (depending on font format) add another 200kB to 4MB to the initial page load.[2]

Second, development is slow. There's a rewrite of PatternFly in the works, and its roadmap predicts a 1.0 release after April of 2019.[3] It's a CSS framework! How can it take over a year to make?! There will be two major releases of React in the same time.

Speaking of React... PatternFly-React has similar shortcomings. Their babel setup doesn't seem to support tree shaking, so if you use any PF-React component you'll have to bundle 2MB of JS. The speed and quality of development leaves much to be desired. For example: It took them five months to merge a TTY component.[4] We wrote a similar component in two days.[5]

1\. [https://github.com/openshift/console](https://github.com/openshift/console)

2\. [https://github.com/openshift/console/pull/3](https://github.com/openshift/console/pull/3)

3\. [https://github.com/patternfly/patternfly- next/milestones?dir...](https://github.com/patternfly/patternfly- next/milestones?direction=asc&sort=title)

4\. [https://github.com/patternfly/patternfly- react/pull/160](https://github.com/patternfly/patternfly-react/pull/160)

5\. [https://github.com/openshift/console/pull/34](https://github.com/openshift/console/pull/34)

<comment><USER3> Why would you shit all over your colleagues' work like that? An announcement post is not a place to air your grievances.

I don't even understand why you'd compare a pattern library to a rendering framework. And comparing development speed for a component in a shared library against that for a single use case is completely unfair.

<comment><USER2> > Why would you shit all over your colleagues' work like that? An announcement > post is not a place to air your grievances.

I know it's unkind to air dirty laundry, but there are no good options. Either I'm disloyal to some of my coworkers, or I let a bunch of developers to run into the same problems I did.

If the positions were reversed and I was considering a library, I'd want employees to chime in with their experience using it. That remains true even if those experiences were negative.

<comment><USER4> > I know it's unkind to air dirty laundry

The term "dirty laundry" implies personal issues or just politics. Your assessment seemed rational and centered around the product itself.

I'm not sure why you got that kind of reaction from OP.

</comment></comment></comment></comment><comment><USER5> I've tried to use PatteryFly a few times, it's actually a pretty terrible system. the biggest drawback is the lack of documentation...as you click through what they call documentation it's full of missing content and 404's. Personally, it's just better to use adminLTE or Twitter Bootstrap.

With the exception of RHEL, it's just like most of Red Hat's products...purchased from someone else, half-baked, and a rather pathetic attempt to stay relevant. It seems that the only support is from internal RH devs and if you look at a lot of Red Hat's other products, even they can't really figure out how to use it (see ManageIQ).

<comment><USER6> > It seems that the only support is from internal RH devs

That's because it's an internal RH framework. Red Hat happens to open source most of their stuff, so they put some effort into marketing PatternFly, but it's still mostly used by themselves.

That being said, the people on their Slack channel are extremely helpful!

</comment></comment><comment><USER7> If you are into bootstrap, [https://bulma.io/](https://bulma.io/) is also worth checkout

<comment><USER8> I highly recommend TailwindCSS as well. Spend an hour with it and you will see significant improvements to the time it takes writing HTML and CSS.

<comment><USER4> Wow, that is an interesting approach they got there.

The Bootstrap/Foundation abstractions are rarely "just right", always requiring you to change/fork/deviate from the norm. I like the idea of building the abstractions myself, exactly as I need them.

Thanks for sharing!

</comment></comment></comment><comment><USER9> The problem with all these frameworks is you end up with a huge mess of markup unrelated to your application, and then have to have another tab open the entire time with documentation making sure you spell every class name right and dont miss a single <div> tag.

Native web components with shadow DOM styling are the way to go forward IMO. Otherwise stuff like this leads to namespace issues and horrible regressions caused when the inevitable need to override something occurs and your only option is to !important a property.

<comment><USER10> > _Native web components with shadow DOM styling are the way to go forward > IMO_

Frameworks like React and Angular are 10x more popular than "native web components".

So if "having to have another tab open the entire time with documentation making sure you spell every class name right and dont miss a single <div> tag" is your concern, it's misplaced. People will be more familiar with those others than with native web components.

</comment></comment><comment><USER11> I've never seen this before, but it looks kind of neat. Right now I use Material UI for React stuff, and it works well enough, but I picked it mostly because I think its API is cleaner than the other frameworks I've worked with. I see that PatternFly has a React library; can anyone speak to how it is to use?

</comment><comment><USER12> I've had PatternFly on my to-do list to investigate a bit more for a while. However I'm at a loss, after reading the website, to understand what it is. Is it a set of styles? Design guidelines? Code for widgets?

 _(Disclaimer: I work for Red Hat, but doing low-level stuff)_

<comment><USER13> At it's core, it's apparently just Bootstrap, an HTML/CSS/JS library. The React version is a whole JS front-end framework.

I'd rather it was built around Bootstrap 4, but I didn't write it, can't be too choosy.

</comment></comment><comment><USER14> What has caused the sudden spike of Web UI frameworks?

<comment><USER15> RedHat lives and dies on value to the enterprise. Their consultants need to find a way to stop enterprise customers from just reaching for whatever FOSS is out there. By giving away their own framework, they can keep their clients in the redhat universe where redhat folks have expertise to offer.

<comment><USER16> I don't think this is true at all. Red Hat needed a web toolkit for their products and presumably decided that the available options weren't suitable for their purposes.

These are more common now because a few years ago a lot of folks drew the same conclusions at around the same time.

For example, PivotalUI[0] was developed in-house to provide a uniform toolkit and look-n-feel for Pivotal's various web interfaces (Pivotal Network, OpsMan, AppsMan, Healthcheck, Metrics etc). Other examples include JetBrains's RingUI[1] or Microsoft's ReactXP[2].

But by no means is PivotalUI intended to lock anyone into anything. To my knowledge our consulting division, Pivotal Labs, has undertaken approximately zero projects using Pivotal UI.

Disclosure: I work for Pivotal. We compete with Red Hat.

[0] [https://styleguide.pivotal.io/](https://styleguide.pivotal.io/)

[1] [https://www.jetbrains.org/ring- ui/index.html](https://www.jetbrains.org/ring-ui/index.html)

[2] [https://microsoft.github.io/reactxp/](https://microsoft.github.io/reactxp/)

<comment><USER17> VMware has something similar in clarity[0], and I guess they decided that bootstrap in a mobile first framework and what they wanted was desktop first, since that what their customers use. I guess what matters more than reactive are wizards, login screens and tables[1]. Incidentally whoever made these examples appears to love pokemon.

[0] [https://github.com/vmware/clarity](https://github.com/vmware/clarity)

[1] [https://imgur.com/a/5j4PaIR](https://imgur.com/a/5j4PaIR)

</comment></comment></comment></comment><comment><USER18> redhat finally went where it truly belongs since decades ago: web rather than OS implementation.

Now, if they would so kind as to exit OS design and implementation, stage right, that would be awesome. The faster the better.

<comment><USER19> What's wrong with Redhat Linux?

<comment><USER18> redhat couldn't _engineer_ an operating system to save their life: systemd is a Windows-like system, they constantly break backwards compatibility, their compiler is purposely castrated to only produce 64-bit code, memory overcommit is still a thing and ships out of the box turned on, they can't get NFS to work correctly and haven't been able to for decades, they can't get fiberchannel to work correctly, they resisted and sabotaged XFS for decades only to now make it a default after having made their customers to suffer with ext2, 3, and 4 for twenty years, they resist ZFS, they've allowed netstat to be deprecated in favor of ss, both GFS and GFS 2 are disasters which they could never get to work correctly, Puppet is a disaster, Saltstack is a disaster, Cobbler is a disaster, Satellite / Spacewalk is a disaster... seriously, what _can_ redhat do correctly?

They spend more time arguing with paying customers on bugzilla.redhat.com than fixing their code because it's easier to argue than to find out where the problem is, or to solve the problem properly.

<comment><USER20> Red Hat break backwards compatibility every 10 years. the LTS approach has been copied by every other Linux distro.

systemd is windows-like in that it replaces a seperate and duplicate code in init, cron, atd, forever, and a billion init scripts with something actually designed.

Red Hat has supported XFS and paid it's maintainers for something like 15 years now.

I could discuss the rest but it honestly seems you're arguing from an emotional viewpoint rather than a technical one.

<comment><USER18> I'm merely answering the "what's wrong with Redhat Linux?" question: it's enough to go to bugzilla.redhat.com and pull the publicly open priority 1 critical bugs, read the exchange between users and redhat and a pattern emerges. Never mind what I wrote and what I suffer through on RHEL every day, let's ignore and discount that; it's the exchanges in the priority 1 bugs that tell the tale for themselves far better than I ever could.

Try building RPM's between .el5, .el6 and .el7, the macro definitions are ripped out and (partially) put back in or modified for more often than every ten years. And that's just one example of many. Starting with .el6 they made their RPM backend scripts bust if -Wl,--build-id isn't used in CXXFLAGS, CFLAGS, and FFLAGS because they modified their castrated compiler to encode that automatically and rely on it instead, so if you roll your own fixed version of the compiler but don't implement that, all your RPM builds are suddenly broken. Now I have to put that work-around in my compilers. Should I go on? I've got plenty of technical details...

So yeah, they should go into web and not touch OS and kernel engineering ever again.

<comment><USER6> Looking at prio 1 bugs for a huge distro like RHEL is not going to paint an accurate picture.

I've had production experience with all the major distros except SUSE, and Red Hat's QA is miles ahead anyone else's. Canonical/Ubuntu do a particularly bad job at it, for instance.

That's not to say there aren't any issues with it, and I've personally experienced a few (the devicemapper Docker driver, for example, caused a lot of trouble for me and I'm glad they did the right thing and built overlayfs), but overall, their engineering is very solid.

<comment><USER18> You've never used a traditional UNIX if you think redhat's engineering is solid, have you?

<comment><USER6> > _There exist no words in any of the languages I speak which can express my > hate of GNU and GNU /Linux._

We might not find much common ground there :-)

I'll bite: I worked with a bunch of HP-UX systems before they got decommissioned a few years ago, so I can attest both to how well-built the operating system is, as well as how painful it was to get anything modern running on them. I also keep an eye on SmartOS/SmartDataCenter.

However, how does this make Red Hat's engineering bad?

<comment><USER18> HP-UX was hard to get started on building software, but once one builds up a base of common libraries, it gets easier and easier, just like it did on Solaris.

hp's engineers never broke backward compatibility. The OS is lightning fast and rock solid. That takes a lot of insight and knowledge.

redhat constantly brakes things, I find things which work yetsterday that break tody, even in the same mainline release. They couldn't even get shutdown to work correctly, a couple of years back when we were working on integrating XFS (and they were still resisting it), the kernel was panicking because they were trying to write to an unmounted filesystem; that was 18 years into Linux's development.

SmartOS engineers would never do such a thing on purpose, as they are guided by the 'empathy is still a core engineering value', put in words in an answer by Keith Wesolowski, and in those very rare cases when they do, they fix it immediately.

With redhat we get constant finger pointing between them and the hardware vendor, they never act responsible for anything although we pay them lots of money. What the hell are we paying them for then? They can't even engineer proper code and drivers for their own OS for the hardware they officially support. That's not engineering, that's hacking!

The worst by far is their lack of architecture. Take Satellite for example, with their concept of channels: unbelievably confusing and complicated. Have you tried integrating your own RPM's into it? The needless complexity!

We had Satellite filling up an Oracle tablespace with irrelevant garbage log information even though we just installed it; I called redhat up and asked them how to lower the amount of information Satellite is generating so that it wouldn't constantly fill up the tablespace. Their support told me that I have to go talk to Oracle because it's an Oracle database problem! Yeah, they are that kind of experts!

<comment><USER20> Solaris had XML config files and wouldn't boot if you had a tab character in vfstab.

<comment><USER18> Only SMF uses XML and SQLite behind the scenes. While that is a poor choice of configuration format, SMF is considered the Golden standard which all others try to re-invent and re-implement (not invented here syndrome), because SMF has been working reliably for more than a decade, and all added capability doesn't break backwards compatibility, so an SMF manifest you wrote ten years ago works without modifications on the latest and greatest nightly build of illumos. That's system engineering as opposed to haphazard hacking. I use drivers in the latest illumos from 1995 and they run without recompilation or modification. I'd like to see GNU/Linux pull that one off.

As for \t not working in vfstab(4), it's simply not true, as all my vfstab(4) files use the [TAB] characters to line up the fields.

<comment><USER20> Yeah they fixed the vfstab problem. It would have bitten you to if you used Solaris back when it mattered.

<comment><USER18> I've been using Solaris since 1993.

I still use it today.

<comment><USER20> Great. You weren't tab-indenting (or space-indenting, I can't remember which one wrecked your machine) your vfstab back on Solaris 8.

<comment><USER18> I most certainly was tab-indenting, since Solaris 2.5.1 in 1993.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Scientists found the perfect way to make pancakes and that has huge implications - <AUTHOR> https://massivesci.com/articles/making-perfect-crepes-simple-scientific-experiment-important-results/ <comment><USER2> I already make perfect pancakes - 12 pretty much perfect tonight. But maybe my definition of perfect would be different from theirs and most likely their perfect would be my disaster - but since my browser does not think it safe to visit it will remain something I will not know.

</comment><comment><USER3> Article doesn't include directions on how to make such a pancake. The closest it gets is referring to the paywalled study.</comment>


Google Code Jam 2012 - <AUTHOR> https://code.google.com/codejam/contest/1460488/dashboard#s=p3

<comment><USER3> I always find out about these things too late. I wish there was a Lanyard for coding contests and the like.

<comment><USER4> It's not too late. There's still 12 hours to do the easy qualification problems.

</comment></comment><comment><USER5> To all saying "Ugh no time!" At this point, there are still 7 and a half hours remaining. You can easily qualify (20 points) in under an hour.

That being said, #4 is the only one that tripped me up - I'm think the solution is very simple and elegant but all I can think in my head is something along the lines of ray-tracing. Back to the drawing board!

<comment><USER6> Thanks for encouraging words, I was not able to solve D (no time left - <USER2> started 2.5 hours before dead-line, and did not exercise before), but got 60 points for other 3, enough for 1st round.

<comment><USER5> Nice job, same boat as me. I'm excited to see Google's write-up of D. Good luck in Round 1!

</comment></comment></comment><comment><USER7> Problem D (the only nontrivial problem) was actually in an ICPC regional a few years ago (south american perhaps?) so a lot of people will have seen this one before.

<comment><USER8> Never seen it, its crazy though. So far around 17 thousand people are participating and less than one thousand have submitted an answer to that problem!

</comment></comment><comment><USER8> To every one who is participating, what language(or languages) are you using? Java here

<comment><USER9> Python for me.

<comment><USER10> Python

<comment> zero-cool Python. All going good, but still stumped in the D. Hall of mirrors :/

</comment></comment></comment></comment><comment><USER11> Why didn't I know about this? agh... I always miss these.

<comment><USER12> you still can participate, there's still enough time to get 20pts which are sufficient to qualify for the next round

<comment><USER11> qualifying would have been easy... the time the other rounds are at are not compatible.

</comment></comment></comment><comment><USER13> did anybody solve problem d by any chance

<comment><USER10> Yes</comment></comment>


The Most Dangerous Man in Cyberspace - <AUTHOR> http://www.rollingstone.com/culture/news/17389/192242

<comment><AUTHOR> Rolling Stone article on Jake Applebaum, hacker (in every sense of the word), founder of Noisebridge hackerspace in San Francisco, and WikiLeaks contributor. Very nice, interesting, funny and intelligent fellow. @ioerror on Twitter.</comment>


Turkopticon - <AUTHOR> https://turkopticon.ucsd.edu/ <comment><USER2> this makes the labor market just a tiny bit fairer but we have a long way to go to fix the information asymmetries that affect every nook and cranny of labor. fairer labor markets mean more stable societies through various mechanisms, not the least of which is the more even distribution of power (social and economic).

</comment><comment><USER3> How much money can one make in an hour as a Turk? Has anyone tried it? I used to click links and made a few dollars back in the day...

<comment><AUTHOR> 97 cents/hour: [https://www.nytimes.com/interactive/2019/11/15/nyregion/amaz...](https://www.nytimes.com/interactive/2019/11/15/nyregion/amazon- mechanical-turk.html?action=click&module=Top%20Stories&pgtype=Homepage)

<comment><USER4> That article is a bit off the mark.

Here's a rebuttal: [https://blog.turkerview.com/writer-who-never-learned-to- driv...](https://blog.turkerview.com/writer-who-never-learned-to-drive-works- for-uber/)

</comment></comment></comment><comment><USER5> This is great. A Glassdoor employer/requester rating hovering scorecard with the possibility to ping the HIT crowd for updates in realtime.

</comment><comment><USER6> I'm curious to hear how ethical people consider MTurk. Between the $1/hr rates and Amazon's union busting nature, this kind of stinks of abuse. That being said, their probably should be a way to fairly hire folk for small "human-in- the-loop" tasks.</comment>


DO Not CLOSE THE ISSUE ASSHOLE - <AUTHOR> https://github.com/ParsePlatform/parse-server/issues/1050 <comment><USER2> Do we really need to discuss every github drama here?

<comment><USER3> You should flag stories like this. Lots of users did, which is what buried it.

If there were fewer comments, the software would have killed it as well (i.e. closed it to comments and made it visible only to users with 'showdead' turned on in their profile). But we don't do that to ongoing active discussions.

</comment></comment><comment><USER4> So much love there! Thanks guys!

We were investigating the issue from another thread. And after, we took the time to contact interested parties (gcloud and Voxer's native crc maintainers). Props to them for their quick responses.

The issue that triggered the rant was closed as it was a clear duplicate from that earlier issue

We've opened another issue to centralize the logs in a civil way. And from investigation, that seems to be an AWS elastic beanstalk toolchain problem when they force an npm rebuild.

So we're kinda stuck there. If anyone has ideas I'm willing to explore!

<comment><USER5> Respect to you man! :bow:

I maintain some open source projects and I do make mistakes sometimes. But if anyone uses foul language, I simply do not respond to them.

</comment></comment><comment><USER6> The collaborators in this issue (@flovilmart and @hramos) have way, way more patience than I would have had. Props to them.

That said, why wouldn't they use a software implementation of CRC32? Is it really that big a bottleneck for them?

<comment><USER7> The CRC32 dep is from Google, not parse.

<comment><USER8> Having a native code dependency in a Node package DOES seem pretty insane to me though, unless absolutely forced. I'm surprised Google would do that.

</comment></comment></comment><comment><USER9> Elitism at it's best. Sheesh. There's about a thousand different ways this guy could have made his complaint known without raging like that.

<comment><USER10> Seriously, who is going to want to become a better coder if that's how the self-proclaimed to programmers inform others?

<comment><USER11> To be honest, encountering this kind of crap at work is making me want to quit the industry. (I've been in it for 15 years)

</comment></comment></comment><comment><USER12> This is about the level of professionalism I'd expect from a guy with a Dragon Ball Z handle.

(Yes, I'm aware of the irony, given my own handle.)

<comment><USER13> And a LoL (I think) victory screen for an avatar. For those who don't play these games LoL has a reputation for being... significantly less kind than even the already low baseline for online games.

</comment></comment><comment><USER14> Despite his rude tone he's got a point, perhaps he'd be taken seriously had he approached it in a civil manner.

<comment><USER15> What is his point exactly, when it's an upstream project (gcloud) that is broken?

</comment></comment><comment><USER16> Yeah, I have to wonder if he was up against a deadline and this was the last straw. Better than putting rounds into coworkers. I respect how gracefully the other guy handled it.

</comment><comment><USER17> Respect for flovilmart for responding like he did. The other guy is clearly having a bad day and flovilmart just keeps his cool.

</comment><comment><USER7> I saw one of the other issues that this user spammed the repo with[0] and it said they'd tweeted the issue. Following that trail I found their twitter account[1] where they just seem to be either a hateful person or someone with a mental illness.

[0] [https://github.com/ParsePlatform/parse- server/issues/1329](https://github.com/ParsePlatform/parse-server/issues/1329) [1] [https://twitter.com/WhyBernieWhy/with_replies](https://twitter.com/WhyBernieWhy/with_replies)

</comment><comment><USER7> Stuff like this drives people away from open source. Abuse and putting people down are not needed when you're not paying for something that you boast you could fix. Pull requests are a thing.

</comment><comment><USER18> Massive respect to the maintainers of this project for staying civil. This guy needs to learn a thing or two about decent human interaction.

</comment><comment><USER19> April ... fools? :|

<comment><USER20> That would make the most sense

</comment></comment><comment><USER21> I can maybe understand rage-posting _once_ , in a momentary weakness, but man, this guy just can't put it down and go for a coffee or a smoke…

<comment><USER22> maybe he's in the middle of giving up the smokes?

<comment><USER21> I believe you've hit the nail on the head.

</comment></comment></comment><comment><USER23> The comments are so abrasive and tone deaf that it almost seems like this is certainly more of an instance of trolling than actual technical discussion.

As much as I wish the above statement was true, I have run into folks on Github and in my professional life who think something like this constitutes intelligent reasoning. This is what scares people away from open source...

</comment><comment><USER11> Unfortunately rude tone and elitism with it like this seems acceptable in some circles as a sign of intelligence.

<comment><USER24> I want more specific explanations on this if you would

<comment><USER25> Well, for some people being right is the only thing that matters. People already mentionned Linus Torvalds, I somehow like reading his rants about devs pushing things after freeze and stuff. If you read the github issue, tenshihan seemed to talk to a wall before yelding to drama (funny thing is, people were more concerned because of the drama)

</comment></comment></comment><comment><USER26> props to flovilmart for trying to take the high road at least.

</comment><comment><USER27> And then the same user created a new duplicate issue: [https://github.com/ParsePlatform/parse- server/issues/1330](https://github.com/ParsePlatform/parse-server/issues/1330)

</comment><comment><USER28> This is the world we live in, always more aggressiveness. Let me put it straight: nothing can justify this kind of verbal assault. This is another human being you're speaking to.

</comment><comment><USER29> Does anyone knows who @tenshihan [1] is ?

1 : [https://github.com/tenshihan](https://github.com/tenshihan)

<comment><USER27> It's a Dragon Ball Z reference, apparently, so you won't have any luck finding the real user.

<comment><USER30> His Twitter account was posted above.

</comment></comment></comment><comment><USER31> Move along, nothing to see here, just an asshole.

</comment><comment><USER32> Linus Torvalds himself has been and remains an asshole and would have responded very similarly. Demanding politeness is a form of censorship. Notice how all the previous commenters mostly ignore the very valid issue raised simply due to the presentation of the idea. The guy raised a huge issue and was not being taken seriously.

<comment><USER33> I don't see anyone "demanding politeness" \- I see people expecting professionalism.

<comment><USER32> "Professionalism" is a way of acting, speaking, and behaving so as to be non- offensive. Professionalism is the definition of the problem here. He was quite the professional coder ( in terms of compentency pointing out the issue) but not his language. Demanding professionalism is a just a way of demanding he self censor.

<comment><USER33> No, it's a condition of continued voluntary cooperation.

If you yell at me and call me an asshole, I'm not going to work with you. That's not censorship, either - it's free association.

</comment></comment></comment></comment><comment><USER34> Is it still April 1st? Another lunatic oss contributor being a total lunatic. Move along...

<comment><USER7> Not even a contributor, just someone who uses the software.</comment></comment>


Using LD_PRELOAD to cheat, inject features and investigate programs (2013) - <AUTHOR> https://rafalcieslak.wordpress.com/2013/04/02/dynamic-linker-tricks-using-ld_preload-to-cheat-inject-features-and-investigate-programs/ <comment><USER2> Interesting projects that employ LD_PRELOAD:

[https://github.com/stewartsmith/libeatmydata](https://github.com/stewartsmith/libeatmydata)

[https://github.com/wolfcw/libfaketime](https://github.com/wolfcw/libfaketime)

[https://cwrap.org/](https://cwrap.org/)

[https://github.com/dex4er/fakechroot](https://github.com/dex4er/fakechroot)

[https://blitiri.com.ar/p/libfiu/](https://blitiri.com.ar/p/libfiu/)

[https://github.com/paultag/tmperamental](https://github.com/paultag/tmperamental)

<comment><USER3> libfaketime can be used for nefarious things such as using software past its trial stage (same with using serials attached to MAC addresses + mac spoofing) or returning future TOTP data. Its generally useful for QA as well. It could've been used by Apple to avoid the reset bug in iOS 11.1.2

fakechroot is used when you build your own *.deb file.

libeatmydata can be used in environments where you'd destroy the data afterwards anyway, or where you don't need logging or keep state after a reboot. You can also mount a bunch of filesystems such as /tmp and /var/log as tmpfs though.

<comment><USER4> libfaketime is also still crucial for reproduceable builds with a lot of compiers embedding compilation date, too, right?

<comment><USER2> At least Debian folks didn't have to resort to using libfaketime. Instead, they patch the embedding tools to use timestamp from environment:

[https://reproducible-builds.org/specs/source-date- epoch/](https://reproducible-builds.org/specs/source-date-epoch/)

</comment></comment></comment></comment><comment><USER5> I actually had to use this trick several months ago in order to install Nessus on my Debian box. The installer was written in C and it called uname() to check if I was running a "supported kernel version" despite not actuality installing any kernel module to the system. It simply refused to install until my fake uname() returned the 3.10.x series kernel in the utsname structure...

<comment><USER6> It sounds like this wasn't the case in this instance, but applications could depend on kernel features without loading any kernel modules. The fact that they required 3.10 is interesting because my first example would be user namespaces, which were completed around that point (I think they were mostly done by 3.8, but IIRC there were some significant features that weren't complete until 3.9-3.10).

Edit - Here's some details about Chromium's dependency on these features: [https://chromium.googlesource.com/chromium/src/+/lkcr/docs/l...](https://chromium.googlesource.com/chromium/src/+/lkcr/docs/linux_sandboxing.md)

<comment><USER7> Yes. "We assume and rely on system call X being implemented" is another common case. In particular, glibc will check your kernel version and won't run if it is too old for what it was built against: [https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/uni...](https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/dl- osinfo.h;h=823cd8224df939134018fbd8f0227e9f501393ab;hb=HEAD#l42) (Comments in that code notwithstanding, I think that the glibc configure will always define a minimum kernel version: [https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/uni...](https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/configure.ac;h=13abda0a51484c5951ffc6d718aa36b72f3a9429;hb=HEAD#l36) and so the check always happens.)

<comment><USER5> The problem for me is that my kernel appeared to be too "new" for Nessus since they set minimum and maximum version ranges. Oddly enough it never impacted function AFAIK.

</comment></comment></comment></comment><comment><USER8> There is a nice list of useful utilities called preeny that can be downloaded here[1].

1\. [https://github.com/zardus/preeny](https://github.com/zardus/preeny)

</comment><comment><USER9> Full sandboxing is not possible with LD_PRELOAD, because the application can still issue raw system calls (syscalls) by using the 'int 0x80' instruction, skipping any library call.

<comment><USER10> In order to wrap system calls, the syscall ptrace can be used: [https://en.m.wikipedia.org/wiki/Ptrace](https://en.m.wikipedia.org/wiki/Ptrace)

<comment><USER11> The proper way to do this is to use seccomp.

<comment><USER12> How exactly does one use seccomp to alter/intercept syscalls instead of simply blocking or allowing them? I can't find anything which uses it like that with a search.

<comment><USER13> GP is misinformed. seccomp is an optimization to ptrace-based syscall interception, when you're only interested in intercepting a subset of a process's syscalls. Instead of getting an event and processing every single syscall a process makes, you can register a seccomp filter that fires a ptrace event in only specific cases (which can be super coarse like "the syscall number is open", or more fine grained like "the syscall number is open and the file is being opened with O_WRONLY or O_RDWR"). Without something like this, ptrace based interception would be almost unusably slow for many cases.

<comment><USER14> although unfortunately it can't do "the syscall number is open and the path is five characters long".

</comment></comment></comment></comment></comment></comment><comment><USER15> As C language teacher assistants in Uni, we used LD_PRELOAD during project defences to replace the lib standard malloc by one of our own in order to be sure that students allocated & freed memory correclty. Never saw so much Segmentation faults in such a short time window.

<comment><USER16> How about libdislocator?

[https://github.com/mirrorer/afl/tree/master/libdislocator](https://github.com/mirrorer/afl/tree/master/libdislocator)

</comment></comment><comment><USER17> We used (and actually still use) this to override hostname lookup in an automated test scenario, where we want to run multiple test suites of the same software (consisting of several processes which all communicate with each other via networking) on the same build server in parallel. We ended up just configuring everything to bind/connect to "localhost", so it runs fine on developer machines, but when executed on the build server - which is a lot more beefier than a dev laptop - the exact same configuration can be run 20 times, executing different test suites in parallel. The trick is that there's one independent loopback network interface for each run on that server, and by overriding the hostname lookup of the software via a small library provided in LD_PRELOAD, we replace the default lookup to 127.0.0.1 with these other loopback devices' IPs.

You could of course achieve the same thing (and even more, like filesystem isolation) in a way more elegant and better-understandable way via Docker containers, but we started doing this in 2011 - there was no Docker back then, so we built our own ultra-low-overhead network virtualization. It'll probably be replaced by Docker someday, but for the moment it's still being used as it "just works" and requires practically no maintenance after being set up once.

<comment><USER18> Couldn't you just bind to different addresses under 127.0.0.1/8 ? eg 127.0.0.1, 127.0.0.2 etc

<comment><USER17> Not if there isn't an interface. If I create one, sure, but then I would have to do that on all dev computers as well and I'd have to forward the address somehow into all server and client configs and/or command-lines of tools started as part of the build process.

Just overriding "localhost" spares me from both (the address to resolve is provided as an env variable, just like LD_PRELOAD itself - and env variables are inherited by child processes, which is great in my scenario).

<comment><USER19> You can't just pass in which interface to bind via an environment variable or parameter?

</comment></comment></comment></comment><comment><USER20> If I'm not mistaken putting DLLs in the same directory as the executable lets you do the same on Windows. Mods and cracks for videogames usually plant a fake DirectX dll in the game folder.

<comment><USER19> Yeah, but UNIX developers love namespace conflicts and hardcoded paths, so something as simple as "look for libs in the directory your binary is in" either never occurred to them or was rejected under various arbitrary concerns.

<comment><USER21> Huh? It has not been rejected -- it is up to compiler/linker what to put in RPATH, and you can totally set RPATH to $ORIGIN. There is a nice tool, chrpath, to do so. For example, java sets it to:

        /usr/bin/java: RPATH=$ORIGIN/../lib/amd64/jli:$ORIGIN/../lib/amd64

I believe the reason it does not happen by default is that binaries go to /usr/bin, and no .so files should appear there. Also it breaks when hardlinks are involved.

<comment><USER19> > I believe the reason it does not happen by default is that binaries go to > /usr/bin, and no .so files should appear there. Also it breaks when > hardlinks are involved.

I other words, nobody uses it. So many conflicts could be easily solved if applications dropped this retarded insistence on spreading files over the hierarchy by type, but they just keep doing it because they mistake tradition for wisdom.

</comment></comment></comment></comment><comment><USER22> This fun local hack is related to binary planting vulnerabilities, where a dynamic resource can be planted on-disk prior to program execution for later loading due to being in the load path.

<comment><USER5> Interestingly, I had an article featured om HN related to how easy this is to exploit: [https://news.ycombinator.com/item?id=14518356](https://news.ycombinator.com/item?id=14518356)

<comment><USER22> I just read through that. Nice debugging.

Binary planting, incidentally, was one of those persistent bugs in all Windows versions, since the local directory in Windows generally is in the beginning of the path. That variant is called DLL planting or a DLL loading vulnerability.

That single design decision to execute from the local folder has caused untold havoc, including half a dozen APIs for how to handle DLL loading.

<comment><USER19> I don't see what the big deal is. That behavior allowed a ton of flexibility at the cost of DLL planting problems iff someone can already drop arbitrary files in the application's directory.

<comment><USER22> > _I don 't see what the big deal is._

Let's say that a Windows user wants to use sandboxie to isolate web components when browsing, until Aug of this year.

You're Pwned: [https://nvd.nist.gov/vuln/detail/CVE-2017-12480](https://nvd.nist.gov/vuln/detail/CVE-2017-12480)

<comment><USER19> I think I'm missing something. It has been a while since I've used Sandboxie, but it seems like this is a behavioral oversight on it's part.

<comment><USER22> > _It has been a while since I 've used Sandboxie, but it seems like this is a > behavioral oversight on it's part._

What do you mean by a behavioral oversight?

The installer loaded a non-existent dll from the temp folder. Any DLL of the same name would get executed upon installation of Sandboxie. That's why DLL hijacking is an issue.

<comment><USER19> The link you gave gives a single line description of the issue. It isn't very helpful in understanding what conditions were required to exploit. Is this a Sandboxie installer issue or all installers?

If the latter, yeah that's a problem, but there are a lot of ways to fix it that don't involve crippling the flexibility.

Edit: ok, read the medium link at the bottom. This is an issue with Sandboxie's installer behavior, for which I think it is unfair to blame the way Windows searches for and loads DLLs.

<comment><USER22> > _The link you gave gives a single line description of the issue. It isn 't > very helpful in understanding what conditions were required to exploit. Is > this a Sandboxie installer issue or all installers?_

The single line description is literally an answer to both of those questions, "Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability via a Trojan horse dwmapi.dll or profapi.dll file in an AppData\Local\Temp directory."

> _Edit: ok, read the medium link at the bottom. This is an issue with > Sandboxie 's installer behavior, for which I think it is unfair to blame the > way Windows searches for and loads DLLs._

The vulnerability is literally caused by the dll load path containing the cwd. That is the subject of this entire thread.

<comment><USER19> If that were true, it'd be applicable to every installer on earth. Sandboxie installer does something it shouldn't.

But hey, fuck it, let's throw the baby out with the bathwater and have namespace conflicts because now all DLLs must be in system32 or some bullshit.

For that matter, let's just not use computers at all! That's where vulnerabilities come from after all.

<comment><USER22> None of that has anything to do with the discussion about binary planting, one variant of which is dll planting due to the cwd directory being used as a path component in microsoft windows versions.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> GDAL has a vsipreload.so which you can preload to replace all the libc file handling functions with ones that understand special filesystem paths, like /vsizip/path/to/zipfile.zip/myfile.csv

We used it for years to do remote inspection of zip files without downloading the whole thing. Now there's a proper API for virtual filesystems in GDAL and we don't have to preload any more.

</comment><comment><USER24> Is this possible when trying to intercept and/or otherwise mess with system calls or stdlib function calls in a language that statically links all/most of its libraries? Are Go binaries affected? Statically-linked Rust binaries? If not, this is (depending on how you look at it) either a security point in favor of those languages or a hindrance to patching/debuggability.

<comment><USER2> If the program was linked statically to libfoo, you won't be able to preempt any libfoo symbols using LD_PRELOAD.

There are other interception techniques that work against any binaries, even fully static ones:

[http://man7.org/linux/man- pages/man2/ptrace.2.html](http://man7.org/linux/man-pages/man2/ptrace.2.html)

[http://man7.org/linux/man- pages/man2/seccomp.2.html](http://man7.org/linux/man- pages/man2/seccomp.2.html)

</comment></comment><comment><USER25> LD_PRELOAD is a pretty decent tool to have in your toolbox when debugging, and you can't fire up lldb/gdb.

I've used it in the past to get an overview of what gets passed to SSL_write, SSL_read: [https://github.com/sebcat/openssl- hook](https://github.com/sebcat/openssl-hook)

</comment><comment><USER26> Colleagues of mine use LD_PRELOAD for roll-you-own profiling. They supply their own `malloc`, for example, that does the same as regular-`malloc` but also writes to a log file that can be analysed later.

<comment><USER25> Massif is a good tool for memory profiling: [http://valgrind.org/docs/manual/ms- manual.html](http://valgrind.org/docs/manual/ms-manual.html)

</comment></comment><comment><USER27> I wrote up a little hack a while ago to work around a limitation in gcov: [https://github.com/Photonios/fgcov](https://github.com/Photonios/fgcov)

It also uses `LD_PRELOAD` to overwrite a function in gcov and hash a filename to prevent exceeding a limit. Even more interesting, it comes with a stand- alone binary. The shared library is copied into the binary and when the binary runs, it extracts the shared library and runs the real gcov and injects the shared library using `LD_PRELOAD`.

I had fun :)

</comment><comment><USER28> This may be a good time to ask since I've been recommended to use LD_PRELOAD but it's always caused issues.

Imagine this, a 'Bootstrap.so' is injected into a process via LD_PRELOAD. This bootstrapper places a jump on the programs entrypoint that jumps to a bootstrap::callback function. This function wants to load other shared libraries though. So when it starts loading another library the bootstrapper gets unloaded and reloaded, which ofcourse breaks execution.

Would anyone know how to properly deal with this?

<comment><USER29> Why is the bootstrap.so being unloaded? It should be loaded into the process pretty permanently. If you have something calling dlopen/dlclose on it, maybe give it an extra dlopen.

<comment><USER28> That's the issue, it shouldn't be unloaded. Yet when bootstrap.so calls dlopen(other.so); bootstrap.so gets unloaded and reloaded. I'll try adding a dlopen(bootstap.so) in the callback to increase the refcount though.

</comment></comment></comment><comment><USER30> Another approach is using LD_PRELOAD with Frida to be able to write the instrumentation logic in JavaScript: [https://www.frida.re/docs/gadget/](https://www.frida.re/docs/gadget/) This also supports monitoring the .js file for changes and reloading the instrumentation logic live, which is great for game tweaks. Just save the file and instantly see the results.

</comment><comment><USER31> [https://nwnx.io/](https://nwnx.io/)

A project that injects via LD_PRELOAD into a game called Neverwinter Nights (now Enhanced Edition). It lets content authors/admins add things like database support, more scripting languages, extensive ruleset changes, and whatever else you want to the game.

</comment><comment><USER32> ~8 years ago I was using LD_PRELOAD to be able to (s)fdisk fixed-size VDI image (VirtualBox Disk Image) outside of virtual machine.

[https://gist.github.com/przemoc/571086](https://gist.github.com/przemoc/571086)

Don't know if it still builds and works flawlessly.

</comment><comment><USER33> I've used LD_PRELOAD to thunk calls to glXSwapBuffers, adding a call to glFinish right afterwards. This keeps the OpenGL driver from getting too far ahead in rendering, since both the buffer swap and command queue are asynchronous, and reduces input lag somewhat.

<comment><USER34> Any chance you have this on Github?

For some reason my card/driver combo creates a huge output lag when it can't keep up with with framerate cap. I'd like to try if something like this would help with it.

On topic of things that use LD_PRELOAD, there's this fps capper (not my work): [https://github.com/torkel104/libstrangle](https://github.com/torkel104/libstrangle)

</comment></comment><comment><USER35> Is there a similar Java centric type override? Would it be as simple as dropping a jar in the right location or is there an environment variable that can be over written? Also it would be neat to know the java code to chain the "open" system call like he did.

<comment><USER36> Probably not with an environment variable, but you can always replace the java executable with another executable that adds an option like -Xbootclasspath.

</comment></comment><comment><USER37> This is both an argument in favour of static linking, and an argument against static linking.

Rust and go programmers will claim this is an attack they are not vulnerable to it, and other people will say this is an useful feature and static linking prevents its use.

</comment><comment><USER38> the state of art here is Microsoft's Detours ([https://www.microsoft.com/en- us/research/project/detours/](https://www.microsoft.com/en- us/research/project/detours/)) . I think it is commercially used by security software, printer interceptors, etc

<comment><USER39> I've used both LD_PRELOAD and Detours and I like LD_PRELOAD so much better. LD_PRELOAD just needs single standard shared library and one environment variable. With Detours you have to: inject code into executable, stop threads, worry about races, protecting/unprotecting memory. The way it's implemented also feels like a big hack. The hooks are injected into first few instructions of hooked methods. Some system functions even deliberately leave blank space there. I'm yet to encounter a use case where all this complexity is useful.

<comment><USER40> That's because ELF allows symbol interposition and PE (Portable Executable) doesn't have a comparable feature. Symbol interposition doesn't come without a price, though, and is often criticized: [https://www.macieira.org/blog/2012/01/sorry-state-of- dynamic...](https://www.macieira.org/blog/2012/01/sorry-state-of-dynamic- libraries-on-linux/) | [https://www.airs.com/blog/archives/307](https://www.airs.com/blog/archives/307) | [https://news.ycombinator.com/item?id=8029564](https://news.ycombinator.com/item?id=8029564)

<comment><USER38> > _The ELF dynamic linking mechanism is designed to emulate static linking. > That 's like designing cars to neigh and occasionally kick people to death > with robot legs that exist only for this purpose._

That comment wins thread.</comment></comment></comment></comment>


Ancient Infant's DNA Reveals New Clues to How the Americas Were Peopled - <AUTHOR> https://www.theatlantic.com/science/archive/2018/01/upward-sun-river-infants-genome-peopling-americas/549572/ <comment><USER2> "peopled"? Really?

<comment><USER3> I got into a very nasty discussion with someone on here over Latin American history once.

As much as I love a lot of things about Hacker News, most users here have never discussed the indigenous histories of the Americas, so remain ignorant as to how to express themselves in such discussions.

To be clear, you should not be downvoted.

And to others oblivious as to why "peopled" is wrong: To people is frowned upon when discussing early histories of the Americas because it connotes that before the arrival of Europeans, aboriginals were not people and there was a lot of "empty space."

There were plenty of people in the Americas. The vast genocides across all of the Americas by the hand of European governments were due to a culture clash and the European immigrant's need for hegemonic power.

After the deaths of most indigenous population, Europeans used rhetoric to convince people that "vast, empty" lands needed to be "peopled." Genocide was used to replace native tribes with European immigrants.

A lot of the lands that were already rich in resources and on their way to healthy growth (prospering) did not need to be "peopled" by European immigrants.

Yes, if you know all this information and still use "peopled," you should be ashamed of yourself.

Here is a map of all the tribes in _just_ North America:

PDF file: [http://www.tribalnationsmaps.com/uploads/1/0/4/5/10451178/pi...](http://www.tribalnationsmaps.com/uploads/1/0/4/5/10451178/pipeline.pdf)

Other maps: [http://www.tribalnationsmaps.com/store/c1/Featured_Products....](http://www.tribalnationsmaps.com/store/c1/Featured_Products.html)

NPR article: [https://www.npr.org/sections/codeswitch/2014/06/24/323665644...](https://www.npr.org/sections/codeswitch/2014/06/24/323665644/the- map-of-native-american-tribes-youve-never-seen-before)

Site of the maker of these maps: [http://www.tribalnationsmaps.com](http://www.tribalnationsmaps.com)

<comment><USER4> What I don't understand about your making this argument here is that the article uses "peopled" exclusively to describe what happened 11,500 years ago. It doesn't use it at all to discuss the much later arrival of Europeans.

Is your argument that the verb "to people" is so poisoned by its misuse for the arrival of Europeans that it shouldn't be used even to describe those who were genuinely among the first Homo sapiens to arrive in the Americas? (I'm aware that "the Americas" is a contentious term, but I'm following your usage here.)

<comment><USER5> We don't know if 11500 years was indeed the first. But I understand your argument.</comment></comment></comment></comment>