1. 65

    This blogpost is a good example of fragmented, hobbyist security maximalism (sprinkled with some personal grudges based on the tone).

    Expecting Signal to protect anyone specifically targeted by a nation-state is a huge misunderstanding of the threat models involved.

    Talking about threat models, it’s important to start from them and that explains most of the misconceptions in the post.

    • Usable security for the most people possible. The vast majority people on the planet use iOS and Android phones, so while it is theoretically true that Google or Apple could be forced to subvert their OSs, it’s outside the threat model and something like that would be highly visible, a nuclear option so to speak.
    • Alternative distribution mechanisms are not used by 99%+ of the existing phone userbases, providing an APK is indeed correctly viewed as harm reduction.
    • Centralization is a feature. Moxie created a protocol and a service used by billions and millions of people respectively that provides real, measureable security for a lot of people. The fact is that doing all this in a decentralized way is something we don’t yet know how to do or doing invites tradeoffs that we shouldn’t make. Federation atm either leads to insecurity or leads to the ossification of the ecosystem, which in turn leads to a useless system for real users. We’ve had IRC from the 1990s, ever wonder why Slack ever became a thing? Ossification of a decentralized protocol. Ever wonder why openpgp isn’t more widespread? Noone cares about security in a system where usability is low and design is fragile. Ever tried to do key rotation in gpg? Even cryptographers gave up on that. Signal has that built into the protocol.

    Were tradeoffs made? Yes. Have they been carefully considered? Yes. Signal isn’t perfect, but it’s usable, high-level security for a lot of people. I don’t say I fully trust Signal, but I trust everything else less. Turns out things are complicated when it’s about real systems and not fantasy escapism and wishes.

    1. 34

      Expecting Signal to protect anyone specifically targeted by a nation-state is a huge misunderstanding of the threat models involved.

      In this article, resistance to governments constantly comes up as a theme of his work. He also pushed for his tech to be used to help resist police states like with the Arab Spring example. Although he mainly increased the baseline, the tool has been pushed for resisting governments and articles like that could increase perception that it was secure against governments.

      This nation-state angle didn’t come out of thin air from paranoid, security people: it’s the kind of thing Moxie talks about. In one talk, he even started with a picture of two, activist friends jailed in Iran in part to show the evils that motivate him. Stuff like that only made the stuff Drew complains about on centralization, control, and dependence on cooperating with surveillance organization stand out even more due to the inconsistency. I’d have thought he’d make signed packages for things like F-Droid sooner if he’s so worried about that stuff.

      1. 5

        A problem with the “nation-state” rhetoric that might be useful to dispel is the idea that it is somehow a God-tier where suddenly all other rules becomes defunct. The five-eyes are indeed “nation state” and has capabilities that are profound; like the DJB talk speculating about how many RSA-1024 keys that they’d likely be able to factor in a year given such and such developments and what you can do with that capability. That’s scary stuff. On the other hand, this is not the “nation state” that is Iceland or Syria. Just looking at the leaks from the “Hacking Team” thing, there are a lot of “nation states” forced to rely on some really low quality stuff.

        I think Greg Conti in his “On Cyber” setup depicts it rather well (sorry, don’t have a copy of the section in question) and that a more reasonable threat model of capable actors you do need to care about is that of Organized Crime Syndicates - which seems more approachable. Nation State is something you are afraid of if you are political actor or in conflict with your government, where the “we can also waterboard you to compliance” factors into your threat model, Organized Crime hits much more broadly. That’s Ivan with his botnet from internet facing XBMC^H Kodi installations.

        I’d say the “Hobbyist, Fragmented Maximalist” line is pretty spot on - with a dash of “Confused”. The ‘threats’ of Google Play Store (test it, write some malware and see how long it survives - they are doing things there …) - the odds of any other app store; Fdroid, the ones from Samsung, HTC, Sony et al. - being completely owned by much less capable actors is way, way higher. Signal (perhaps a Signal-To-Threat ratio?) perform an good enough job in making reasonable threat actors much less potent. Perhaps not worthy of “trust”, but worthy of day to day business.

      2. 18

        Expecting Signal to protect anyone specifically targeted by a nation-state is a huge misunderstanding of the threat models involved.

        And yet, Signal is advertising with the face of Snowden and Laura Poitras, and quotes from them recommending it.

        What kind of impression of the threat models involved do you think does this create?

        1. 5

          Who should be the faces recommending signal that people will recognize and listen to?

          1. 7

            Whichever ones are normally on the media for information security saying the least amount of bullshit. We can start with Schneier given he already does a lot of interviews and writes books laypeople buy.

            1. 3

              What does Schneier say about signal?

              1. 10

                He encourages use of stuff like that to increase baseline but not for stopping nation states. He adds also constantly blogged about the attacks and legal methods they used to bypass technical measures. So, his reporting was mostly accurate.

                We counterpoint him here or there but his incentives and reo are tied to delivering accurate info. Moxie’s incentives would, if he’s selfish, lead to locked-in to questionable platforms.

        2. 18

          We’ve had IRC from the 1990s, ever wonder why Slack ever became a thing? Ossification of a decentralized protocol.

          I’m sorry, but this is plain incorrect. There are many expansions on IRC that have happened, including the most recent effort, IRCv3: a collectoin of extensions to IRC to add notifications, etc. Not to mention the killer point: “All of the IRCv3 extensions are backwards-compatible with older IRC clients, and older IRC servers.”

          If you actually look at the protocols? Slack is a clear case of Not Invented Here syndrome. Slack’s interface is not only slower, but does some downright crazy things (Such as transliterating a subset of emojis to plain-text – which results in batshit crazy edge-cases).

          If you have a free month, try writing a slack client. Enlightenment will follow :P

          1. 9

            I’m sorry, but this is plain incorrect. There are many expansions on IRC that have happened, including the most recent effort, IRCv3: a collectoin of extensions to IRC to add notifications, etc. Not to mention the killer point: “All of the IRCv3 extensions are backwards-compatible with older IRC clients, and older IRC servers.”

            Per IRCv3 people I’ve talked to, IRCv3 blew up massively on the runway, and will never take off due to infighting.

            1. 12

              And yet everyone is using Slack.

              1. 14

                There are swathes of people still using Windows XP.

                The primary complaint of people who use Electron-based programs is that they take up half a gigabyte of RAM to idle, and yet they are in common usage.

                The fact that people are using something tells you nothing about how Good that thing is.

                At the end of the day, if you slap a pretty interface on something, of course it’s going to sell. Then you add in that sweet, sweet Enterprise Support, and the Hip and Cool factors of using Something New, and most people will be fooled into using it.

                At the end of the day, Slack works just well enough Not To Suck, is Hip and Cool, and has persistent history (Something that the IRCv3 group are working on: https://ircv3.net/specs/extensions/batch/chathistory-3.3.html)

                1. 9

                  At the end of the day, Slack works just well enough Not To Suck, is Hip and Cool, and has persistent history (Something that the IRCv3 group are working on […])

                  The time for the IRC group to be working on a solution to persistent history was a decade ago. It strikes me as willful ignorance to disregard the success of Slack et al over open alternatives as mere fashion in the face of many meaningful functionality differences. For business use-cases, Slack is a better product than IRC full-stop. That’s not to say it’s perfect or that I think it’s better than IRC on all axes.

                  To the extent that Slack did succeed because it was hip and cool, why is that a negative? Why can’t IRC be hip and cool? But imagine being a UX designer and wanting to help make some native open-source IRC client fun and easy to use for a novice. “Sisyphean” is the word that comes to mind.

                  If we want open solutions to succeed we have to start thinking of them as products for non-savvy end users and start being honest about the cases where closed products have superior usability.

                  1. 5

                    IRC isn’t hip and cool because people can’t make money off of it. Technologies don’t get investment because they are good, they get good because of investment. The reason that Slack is hip/cool and popular and not IRC is because the investment class decided that.

                    It also shows that our industry is just a pop culture and can give a shit about good tech .

                    1. 4

                      There were companies making money off chat and IRC. They just didn’t create something like Slack. We can’t just blame the investors when they were backing companies making chat solutions whose management stayed on what didn’t work in long-term or for huge audience.

                      1. 1

                        IRC happened before the privatization of the internet. So the standard didn’t lend itself well for companies to make good money off of it. Things like slack are designed for investor optimization, vs things like IRC being designed for use and openness.

                        1. 2

                          My point was there were companies selling chat software, including IRC clients. None pulled off what Slack did. Even those doing IRC with money or making money off it didn’t accomplish what Slack did for some reason. It would help to understand why that happened. Then, the IRC-based alternative can try to address that from features to business model. I don’t see anything like that when most people that like FOSS talk Slack alternatives. Then, they’re not Slack alternatives if lacking what Slack customers demand.

                          1. 1

                            Thanks for clarifying. My point can be restated as… There is no business model for federated and decentralized software (until recently , see cryptocurrencies). Note most open and decentralized tech of the past was government funded and therefore didn’t face business pressures. This freed designets to optimise other concerns instead of business onrs like slack does.

                    2. 4

                      To the extent that Slack did succeed because it was hip and cool, why is that a negative? Why can’t IRC be hip and cool?

                      The argument being made is that the vast majority of Slack’s appeal is the “hip-and-cool” factor, not any meaningful additions to functionality.

                      1. 6

                        Right, as I said I think it’s important for proponents of open tech to look at successful products like Slack and try to understand why they succeeded. If you really think there is no meaningful difference then I think you’re totally disconnected from the needs/context of the average organization or computer user.

                        1. 3

                          That’s all well and good, I just don’t see why we can’t build those systems on top of existing open protocols like IRC. I mean: of course I understand, it’s about the money. My opinion is that it doesn’t make much sense to insist that opaque, closed ecosystems are the way to go. We can have the “hip-and-cool” factor, and all the amenities provided by services like Slack, without abandoning the important precedent we’ve set for ourselves with protocols like IRC and XMPP. I’m just disappointed that everyone’s seeing this as an “either-or” situation.

                          1. 2

                            I definitely don’t see it as an either-or situation, I just think that the open source community typically has the wrong mindset for competing with closed products and that most projects are unapproachable by UX or design-minded people.

                    3. 3

                      Open, standard chat tech has had persistent history and much more for decades in the form of XMPP. Comparing to the older IRC on features isn’t really fair.

                      1. 2

                        The fact that people are using something tells you nothing about how Good that thing is.

                        I have to disagree here. It shows that it is good enough to solve a problem for them.

                        1. 1

                          I don’t see how Good and “good enough to solve a problem” are related here. The first is a metric of quality, the second is the literal bare minimum of that metric.

                  2. 1

                    Alternative distribution mechanisms are not used by 99%+ of the existing phone userbases, providing an APK is indeed correctly viewed as harm reduction.

                    I’d dispute that. People who become interested in Signal seem much more prone to be using F-Droid than, say, WhatsApp users. Signal tries to be an app accessible to the common person, but few people really use it or see the need… and often they are free software enthusiasts or people who are fed up with Google and surveillance.

                    1. 1

                      More likely sure, but that doesn’t mean that many of them reach the threshold of effort that they do.

                    2. 0

                      Ossification of a decentralized protocol.

                      IRC isn’t decentralised… it’s not even federated

                      1. 3

                        Sure it is, it’s just that there are multiple federations.

                    1. 1

                      And lets not forget Buck, Pants, Blaze, Please, Amazon’s interal one (I forget the name)…

                      Buck is the best for mobile.

                      Please is already written in Go.

                      1. 6

                        What are the actual benefits of compiling to wasm rather than JS? One drawback is that, at least for the near future, a wasm module has its own heap rather than participating in the garbage-collected heap of the JS engine. It’s also likely that wasm means a larger runtime footprint.

                        1. 3

                          Betting on future states of technology maybe?

                          1. 1

                            Garbage collection

                            1. 1

                              How is that a benefit? I would agree if compilation to WebAssembly avoids GC, but Grain seems to require GC anyway.

                              1. 1

                                Yes, but you get to pick and ship the GC for your application.

                            2. 1

                              Fun? Experimentation?

                              1. 0

                                I see no benefit. I said the same thing for Go WebAssembly backend; there is already GopherJS.

                              1. 3

                                KeePass XC with the password file stored in Google Drive / Dropbox / OneDrive. There is an open-source client for iOS too.

                                1. 4

                                  You aren’t forced to use the new c++ features. You can continue to write as you have always written. I think the core complaint is that OTHER people are now writing c++ that looks like - HORROR! - Python. If this was the 1980s and the only way to learn C++ was to pore over a book from end-to-end, ok. But it’s the 21st century! We have the internet! There are online references which have example code snippets to go with each C++ concept or standard library class. A quick web search will get you any concept that you like.

                                  Taking the example used in the article, I LOVE the range based for loops. It makes it less text to read. Don’t like auto, fine, use explicit typing. A modern IDE will still do code intelligence for you on auto variables, don’t forget and the compiler, of course, will keep you on the straight. You may worry about unfortunate implicit conversions, and then, yes, you should be explicit.

                                  I’m not convinced all this griping about the size of C++ and all these “modern” features is not a bit of conservatism run amuck. Especially with the new memory features which allow us to avoid bare pointers.

                                  Sorry for my wall of text. Just a long time C++ fan here who’s a big fan of the new standard.

                                  A side note on the lego pictures

                                  1. It’s probably a result of what I’m used to, or some pleasant memories of childhood, but I too miss the “ugly” blocks of my childhood. It wasn’t ugly, because in my imagination all those knobs weren’t making my spaceship ugly - they were potentials for expanding my spaceship even more.
                                  2. That new spaceship looks like a rebuild of the “Voyager” set (6929) and I find it awesome to see that old computer block unchanged in the new set
                                  1. 5

                                    The new C++ features are execllent. The problem is the legacy of bad defaults and backward compatibility at all costs. This is probably the right decision overall, but it makes for an uglier language. I would also point out that you do pay for features that you do not use. Why? Well it might be used by code that you call, triggering weird behavour (e.g. const casts) and it makes tooling considerably hard to build (see Clang’s code complexity).

                                    1. 3

                                      I have three comments:

                                      1. I think it’s natural for any language to eventually buckle under the weight of Amdahl’s law, which in this case is making common idioms faster to write and recognize.

                                      2. The author seems to simultaneously criticize modern C++ for having too many ways to do something (as in the vector insert example), but also criticizes modern C++ for attempting to make idioms that guide you towards a few ways to do something. In that sense, I’m not sure which he’s arguing for/against.

                                      3. I agree having too many syntactical features/sugars can create cognitive overhead (one of my pain points with learning Haskell), and I assume that’s why the community has rallied behind guidelines like: https://github.com/isocpp/CppCoreGuidelines

                                    1. 11

                                      I also like the converse: If you’re writing a program, use a programming language!

                                      1. 6

                                        The contrapositive is even better. If you are not using a programming language then you are not writing a program.

                                        1. 1

                                          I think you flipped an “ought” to an “is” when you took the contrapositive.

                                          1. 1

                                            Is my language incorrect?

                                            Okay will this then be more clear?

                                            If not using prog. Lang. => not writing program

                                            1. 2

                                              The original statements say how things ought to be, your statements are about how the world is. The proper contrapositive would be “if you aren’t using a programming language, it isn’t true that you should be writing a program.” “if it’s not the case that you should be using a programming language, you aren’t writing a program.”

                                          2. 0

                                            Not true for what most people think of as “programming languages” (or, if you prefer, many programming languages are not obviously so).

                                        1. 39

                                          I don’t understand the author’s objection to Outreachy. As far as I can tell, they want to fund some interns from marginalized groups so that they can work on open-source. They are not preventing the author from working on open-source. They are not preventing the author from funding interns he approves of from working on open-source. What is the problem?

                                          1. 23

                                            Outreachy funds members of specific minority groups and would not fund a cisgender white guy’s internship. He decries this as discrimination.

                                            On this topic, the term discrimination has differing interpretations and it’s very easy for folks to talk past each other when it comes up. It sounds he’s using it in a way that means disfavoring people based on the sex or race they belong to. Another popular definition is that it only applies to actions taken against groups that have been historically discriminated against. This use gets really strong pushback from people who disagree with the aims or means of projects like Outreachy as begging the question, making an assumption that precludes meaningful discussion of related issues.

                                            1. 4

                                              It’s not only that Outreachy would not fund a cisgender white guy’s internship. Outreachy also would not fund Asian minority’s internship. Asian minority is a group that has been historically discriminated against. Outreachy is discriminating against specific minority. In summary, Outreachy is simply discriminating, it is not using alternative definition of discrimination.

                                              (Might be relevant: I am Asian.)

                                              1. 7

                                                I asked Karen Sandler. This is the reason for the selection of groups:

                                                <karenesq> JordiGH: I saw the lobsters thread. the expansion within the US to the non-gender related criteria was based on the publication by multiple tech companies of their own diversity statistics. We just expanded our criteria to the groups who were by far the least represented.

                                                1. 2

                                                  Thanks a lot for clarifying this with Karen Sandler!

                                                  I think this proves beyond any shade of doubt that Outreachy is concerned with not historical injustice, but present disparity.

                                                2. 3

                                                  He had a pretty fair description of where the disputes were coming from. Far as what you’re saying on Outreachy, the Asian part still fits into it as even cultural diversity classes I’ve seen say the stereotypes around Asians are positive for stuff like being smart or educated. Overly positive to the point that suicide due to pressure to achieve was a bit higher according to those sources. There’s lots of Asians brought into tech sector due to a mix of stereotypes and H1-B. The commonness of white males and Asians in software development might be why they were excluded with the white males. That makes sense to me if I look at it through the view they likely have of who is privileged in tech.

                                                  1. 3

                                                    Yes, it makes sense that way, but it does not make sense in “historical discrimination” sense pushcx argued. I believe this is an evidence that these organizations are concerned with the present disparity, not with the history. Therefore, I believe they should cease to (dishonestly, I think) argue history argument.

                                                  2. 2

                                                    Well, if you were a woman or identified as one they would accept you, regardless if you were Asian or not. I do wonder why they picked to outreach to the particular groups they picked.

                                                    And you have to pick some groups. If you pick none/all, then you’re not doing anything different than GSoC, and there already is a GSoC, so there would be no point for Outreachy.

                                                    1. 1

                                                      You can pick groups that have been historically discriminated against, as pushcx suggested. Outreachy chose otherwise.

                                                      1. 2

                                                        To nitpick, I was talking about the term “discrimination” because I’ve seen it as a source of people talking past each other, not advocating for an action or even a particular definition of the term. Advocating my politics would’ve compromised my ability to effectively moderate, though incorrect assumptions were still made about the politics of the post I removed and that I did so out of disagreement, so… shrug

                                                3. 49

                                                  For those who are used to privilege, equality feels like discrimination.

                                                  1. 18

                                                    I think the author’s point is that offering an internship for only specific groups is discrimination. From a certain point of view, I understand how people see it that way. I also understand how it’s seen as fair. Whether that’s really discrimination or not is up for debate.

                                                    What’s not up for debate is that companies or people should be able to give their money however they feel like it. It’s their money. If a company wants to only give their money to Black Africans from Phuthaditjhaba, that’s their choice! Fine by me!

                                                    Edit: trying to make it clear I don’t want to debate, but make the money point.

                                                    1. 19

                                                      It is discrimination, that’s what discrimination means. But that doesn’t automatically make it unfair or net wrong.

                                                      1. 12

                                                        The alternative is inclusive supply plus random selection. You identify the various groups that exist. Go out of your way to bring in potential candidates of a certain number in each one. The selection process is blind. Whoever is selected gets the help. Maybe auditable process on top of that. This is a fair process that boosts minorities on average to whatever ratio you’re doing the invite. It helps whites and males, too.

                                                        That’s the kind of thing I push. Plus, different ways to improve the blindness of the evaluation processes. That is worth a lot of research given how much politics factors into performance evaluations in workplaces. It affects everyone but minority members even more per the data. Those methods, an equal pull among various categories, and blind select are about as fair as it gets. Although I don’t know exact methods, I did see GapJumpers describing something that sounds closer to this with positive results. So, the less-discriminating way of correcting imbalances still achieves that goal. The others aren’t strictly necessary.

                                                        The next scenario is specific categories getting pulled in more than everyone with organizations helping people in the other ones exclusively to boost them. That’s what’s going on here. Given the circumstances, I’m not going to knock them even if not as fair as other method. They’re still helping. It looks less discriminatory if one views it at a high level where each group addresses those they’re biased for. I did want to show the alternative since it rarely gets mentioned, though.

                                                        1. 13

                                                          I really agree with this. I was with a company who did a teenage code academy. I have a masters, and did a lot of work tutoring undergrads and really want to get back into teaching/academia.

                                                          I wanted to teach, but was actually pushed down the list because they wanted to give teaching positions to female staff first. I was told I could take a support role. The company also did a lot of promotion specifically to all girls schools and to try to pull women in. They had males in the classes too, but the promotion was pretty bias.

                                                          Also I want to point out that I had a stronger teaching background/qualifications than some of the other people put in those positions.

                                                          I’m for fairness and giving people opportunity, but I feel as if efforts to stop discrimination just lead to more discrimination. The thing is, we’re scientists and engineers. We know the maths. We can come up with better ways to pull in good random distributions of minorities/non-minorities and don’t have to resort to workshops that promote just another equal but opposite mono-culture. If anything you do potential developers a disservice by having workshops that are only women instead of half-and-half. You get a really one sided narrative.

                                                          1. 9

                                                            I appreciate you sharing that example. It mirrors some that have happened to me. Your case is a good example of sexism against a man that might be more qualified than a women being hired based on gender. I’ll also note that so-called “token hires” are often treated poorly once they get in. I’ve seen small organizations where that’s not true since the leadership just really believed in being good to people and bringing in different folks. They’re rare. Most seem to be environments people won’t want to be in since conflict or resentment increases.

                                                            In your case and most of those, random + blind selection might have solved the problem over time without further discrimination or resentment. If process is auditable, everyone knows the race or gender part gave everyone a fair shot. From there, it was performance. That’s a meaningful improvement to me in reducing the negative effects that can kick in when correcting imbalances. What I will say, though, is I don’t think we can always do this since performance in some jobs is highly face-to-face, based on how groups perceive the performer, etc. I’m still uncertain if something other than quotas can help with those.

                                                            Most jobs I see people apply for can be measured, though. If it can be measured, it can sometimes already be blinded or may be measured blindly if we develop techniques for that.

                                                            1. 3

                                                              I agree with these comments, plus, thanks for sharing a real life example. We are definitely fighting discrimination with more discrimination doing things the current way. For a bit I’ve thought that a blind evaluation process would be best. It may not be perfect, but it seems like a step in a better direction. It’s encouraging to see other people talking about it.

                                                              One other thought- I think we as society are handling race, gender, age, etc problems wrong. Often, it’s how a certain group ‘A’ has persecuted another group ‘B’. However, this isn’t really fair for the people in group ‘A’ that having nothing to do with what the other people are doing. Because they share the same gender/race/whatever, they are lumped in. Part of this seems to be human nature, and it’s not always wrong. But maybe fighting these battles in more specific cases would help.

                                                            2. 5

                                                              I think the problem here is that whites and males don’t need extra help. They already get enough help from their position in society. Sure, equal distribution sounds great, but adding an equal amount to everyone doesn’t make them equal; it doesn’t nullify the discrepancy that was there before. Is it good to do so? Yes, of course, but it would be better served and better for society to focus on helping those without built-in privilege to counteract the advantage that white males have.

                                                              1. 9

                                                                There are lots of people in bad situations who are white and male. Saying someones race and gender determines how much help someone has had in life seems both racist and sexist.

                                                                1. 2

                                                                  I’m not saying that it applies in all circumstances. But I am saying that they have a much larger support structure available to them, even if they didn’t get started on the same footing as other examples.

                                                                  It’s not directly because of their race and sex, it’s because of their privilege. That’s the fundamental difference.

                                                                  1. 6

                                                                    I don’t even know how much it matters if it was true. Especially in rural or poor areas of white people. Their support structure is usually some close friends, family, people they live with, and so on. Often food stamps, too. Their transportation or Internet might be unreliable. Few jobs close to them. They have to pack up and leave putting themselves or their family into the unknown with about no money to save for both the move and higher cost of living many areas with more jobs will entail. Lots of drug abuse and suicide among these groups relative to whites in general. Most just hope they get a decent job where management isn’t too abusive and the lowish wages cover the bills. Then, you talk about how they have “a much larger support structure available to them” “because of their privilege.” They’d just stare at you blinking wondering what you’re talking about.

                                                                    Put Your Solutions Where Your Ideology Is

                                                                    Since you talk about advantages of privilege and support structures, I’m curious what you’d recommend to a few laypeople in my white family who will work, have basic to good people skills, and are non-technical. They each have a job in area where there aren’t lots of good jobs. They make enough money to make rent. I often have trouble contacting them because they “have no minutes” on their phones. The areas they’re in have no wired Internet directly to renters (i.e. pay extra for crap), satellite, spotty connections, or they can’t afford it. Some have transportation, others lost theirs as it died with four digit repairs eclipsing 1-2 digits of surplus money. All their bosses exploit them to whatever extent possible. All the bosses underschedule them where the work couldn’t get done then try to work them to death to do it. The schedules they demand are horrible with at least two of us having schedules that shift anywhere from morning to evening to graveyard shift in mid-week. It kills people slowly over time. Meanwhile, mentally drains them in a way that prevents them learning deep stuff that could get them in good jobs. Most of them and their friends feel like zombies due to scheduling with them just watching TV, chilling with friends/family, or something otherwise comfortable on off days. This is more prevalent as companies like Khronos push their optimizations into big businesses with smaller ones following suit. Although not among current family now, many of them in the past worked 2-3 jobs with about no time to sleep or have fun just to survive. Gets worse when they have an infant or kids.

                                                                    This is the kind of stuff common among poor and working classes throughout America, including white people. Is this the average situation of you, your friends, and/or most white males or females you know of? These people “don’t need help?” I’m stretching my brain to try to figure out how what you’re saying fits their situation. In my view, they don’t have help so much as an endless supply of obstacles ranging from not affording bills to their evil bosses whose references they may depend on to police or government punishing them with utility bill-sized tickets for being poor. What is your specific recommendation for white people without any surplus of money, spotty Internet, unreliable transportation, and heavily-disrupted sleep?

                                                                    Think quickly, too, because white people in these situations aren’t allowed much time to think between their stressful jobs (often multiple) and families to attend to. Gotta come up with solutions about on instinct. Just take the few minutes of clarity a poor, white person might have to solve a problem while in the bathroom or waiting in line at a store. It’s gotta work with almost no thought, energy, savings, or credit score. What you got? I’ll pass it on to see if they think it’s hopeful or contributes to the entertainment for the day. Hope and entertainment is about the most I can give to the person I’m visiting Saturday since their “privilege” hasn’t brought them much of anything else.

                                                                    1. 2

                                                                      I’m not saying that it’s applicable in every situation; I am specifically talking about the tech industry. I don’t think it’s about prejudice in this case. I think it’s about fixing the tech culture, which white males have an advantage in, regardless of their economic background. White males don’t always have privilege, that would be a preposterous claim. But it’s pretty lopsided in their favor.

                                                                      1. 2

                                                                        I am specifically talking about the tech industry.

                                                                        It’s probably true if narrowed to tech industry. It seems to favor white and Asian males at least in bottom roles. Gets whiter as it goes up. Unfortunately, they also discriminate more heavily on age, background, etc. They want us in there for the lower-paying stuff but block us from there in a lot of areas. It’s why I recommend young people considering tech avoid it if they’re worried about age discrimination or try to move into management at some point. Seems to reduce the risk a bit.

                                                                      2. 2

                                                                        Your comment is a great illustration of the danger of generalizing things on the basis of racis or gender, mistakenly classifying a lot of people as “privileged”. Ideally, the goal of a charity should be to help unprivileged people in general, for whatever reason they are unprivileged, not because of their race or gender.

                                                                      3. 4

                                                                        “It’s not directly because of their race and sex, it’s because of their privilege. That’s the fundamental difference.”

                                                                        But that’s not a difference to other racist/sexist/discriminatory thinking at all. Racists generally don’t dislike black people because they’re black. They think they’re on average less intelligent, undisciplined, whatever, and that this justifies discriminating against the entirety of black people, treating individuals primarily as a product of their group membership.

                                                                        You’re doing the exact same thing, only you think “white people are privileged, they don’t need extra help” instead of “black people are dumb, they shouldn’t get good jobs”. In both cases the vast individual differences are ignored in favor of the superficial criteria of group membership. That is exactly what discrimination is.

                                                                        1. 2

                                                                          You’re right in that I did assume most white males are well off, and it is a good point that they need help too. However, I still think that the ideas of diversifying the tech industry are a worthy goal, and I think that having a dedicated organization that focuses on only the underrepresented groups is valuable. I just don’t think that white males have the same kind of cultural bias against them in participating in this industry that the demographics that Outreachy have, and counteracting that is Outreachy’s goal. Yes, they are excluding groups, but trying to help a demographic or collection of demographics necessarily excludes the other demographic. How could it work otherwise?

                                                                    2. 1

                                                                      Why exclude Asians then? Do Asians also already get enough help from their position in society?

                                                                      1. 5

                                                                        Asians are heavily overrepresented in tech. To be fair, the reason we are overrepresented in tech (as in medicine) is likely because software development (like medicine) is an endeavour that requires expertise in challenging technical knowledge to be successful, which means that (unlike Hollywood) you can’t just stick with white people because there simply aren’t enough of them available to do all the work. So Asians who were shut out of other industries (like theatre) flocked to Tech. Black men are similarly overrepresented in the NBA but unfortunately the market for pro basketball players is a bit smaller than the market for software developers.

                                                                        1. 2

                                                                          Do they exclude Asians? I must have missed that one. I don’t think excluding that demographic is justified.

                                                                          1. 2

                                                                            Do they exclude Asians?

                                                                            Yes they do. Quoting Outreachy Eligibility Rules:

                                                                            You live in the United States or you are a U.S. national or permanent resident living aboard, AND you are a person of any gender who is Black/African American, Hispanic/Latin@, Native American/American Indian, Alaska Native, Native Hawaiian, or Pacific Islander

                                                                            In my opinion, this is carefully worded to exclude Asians without mentioning Asians, even going so far as mentioning Pacific Islander.

                                                                    3. 4

                                                                      It’s a simple calculus of opprotunity. Allowing those who already have ample opprotunity (i.e. white, cis, males) into Outreachy’s funding defeats the point of specifically targeting those who don’t have as much opprotunity. It wouldn’t do anything to help balance the amount of opprotunity in the world, which is Outreachy’s end goal here.

                                                                      It’s the author’s idea that they deserve opprotunity which is the problem. It’s very entitled, and it betrays that the author can’t understand that they are in a priviledged position that prevents them from receiving aid. It’s the same reason the wealthy don’t need tax cuts.

                                                                      1. 1

                                                                        Outreachy’s end goal seems to be balancing the amount of opportunity in the world for all, except for Asian minority.

                                                                        1. 4

                                                                          Each of us gets to choose between doing good and doing best. The x is the enemy of the y. If Outreachy settles for acting against the worst imbalance (in its view) and leaving the rest that’s just their choosing good over best.

                                                                          You’re also confusing their present action with their end goals. Those who choose “best” work directly towards their end goal, but Outreachy is in the “good” camp. By picking a worst part of the problem and working on that part, they implicitly say that their current work might be done and there’ll still be work to do before reaching the end goal.

                                                                      2. 4

                                                                        What’s not up for debate is that companies or people should be able to give their money however they feel like it.

                                                                        That is debatable. But, I too think Outreachy is well within their rights.

                                                                      3. 6

                                                                        I’m not going to complain about discrimination in that organization since they’re a focused group helping people. It’s debatable whether it should be done differently. I’m glad they’re helping people. I will note that what you just said applies to minority members, too. Quick example.

                                                                        While doing mass-market, customer service (First World slavery), I ran an experiment treating everyone in a slightly-positive way with no differences in speech or action based on common events instead of treating them way better than they deserved like we normally did. I operated off a script rotating lines so it wasn’t obvious what I was doing. I did this with different customers in new environment for months. Rather than appreciation, I got more claims of racism, sexism, and ageism then than I ever did at that company. It was clear they didn’t know what equal treatment or meritocracy felt like. So many individuals or companies must have spoiled them that experiencing equality once made them “know” people they interacted with were racist, sexist, etc. There were irritated people among white males but they just demanded better service based on brand. This happened with coworkers in some environments, too, when I came in not being overly selfless. The whites and males just considered me slightly selfish trading favors where a number of non-whites or women suspected it was because they were (insert category here). They stopped thinking that after I started treating them better than other people did and doing more of the work myself. So, it was only “equal” when the white male was doing more of the work, giving more service in one-way relationships, etc.

                                                                        I’d love to see a larger study done on that kind of thing to remove any personal or local biases that might have been going on. My current guess is that their beliefs about what racism or sexism are shifted their perceptions to mis-label the events. Unlike me, they clearly don’t go out of their way to look for more possibilities for such things. I can tell you they often did in the general case for other topics. They were smart or open-minded people. Enter politics or religion, the mind becomes more narrow showing people what they want to see. I spent most of my life in that same mental trap. It’s a constant fight to re-examine those beliefs looking at life experiences in different ways.

                                                                        So, I’m skeptical when minority members tell me something was about their status because I’ve personally witnessed them miscategorizing so many situations. They did it by default actually any time they encountered provable equality or meritocracy. Truth told, though, most things do mix forms of politics and merit leaning toward politics. I saw them react to a lot of that, too. I’m still skeptical since those situations usually have more political biases going on than just race or gender. I can’t tell without being there or seeing some data eliminating variables what caused whatever they tell me.

                                                                        1. 17

                                                                          So, in your anecdotal experience, other people’s anecdotal experience is unreliable? 😘

                                                                          1. 5

                                                                            You got jokes lol. :) More like I’m collecting this data on many views from each group to test my hypotheses whereas many of my opponents are suppressing alternative views in data collection, in interpretation, and in enforcement. Actually, it seems to be default on all sides to do something like that. Any moderate listening closely to those that disagree looking for evidence of their points is an outlier. Something wrong with that at a fundamental level.

                                                                            So, I then brought in my anecdotes to illustrate it given I never see them in opponents’ data or models. They might be wrong with their anecdotes right. I just think their model should include the dissent in their arguments along with reasons it does or doesn’t matter. The existence of dissent by non-haters in minority categories should be a real thing that’s considered.

                                                                          2. 3

                                                                            I think that the information asymmetry that you had with your anecdotes affected some of the reactions you got. For one, if someone considers your actions negative in some way, they are conditioned by society to assume that you were being prejudiced. If your workplace was one that had more of a negative connotation (perhaps a debt collection service or what have you) that goes double. That’s a reason for the percieved negativity that your white male colleagues didn’t even have to consider, and they concluded that you were just being moderately nice. Notice that you didn’t have to be specifically discriminatory, nor was it necessarily fair. It’s just one more negative thing that happens because prejudice does exist. I would imagine that you would not have so many negative reactions if you explained exactly what you were doing vis-a-vis the randomization of greetings and such. I think I would discount percieved discrimination if someone did that to me.

                                                                        2. 14

                                                                          Yes, it’s a ludicrous hissy fit. Especially considering that LLVM began at UIUC which, like many (most? all?) universities, has scholarships which are only awarded to members of underrepresented groups–so he’d have never joined the project in the first place if this were truly a principled stand and not just an excuse to whine about “the social injustice movement.” (I bet this guy thinks it’s really clever to spell Microsoft with a $, too.)

                                                                          1. 7

                                                                            That jab “Microsoft with a $” was really uncalled for. You have no evidnece of this. Please stop.

                                                                            1. 6

                                                                              The point is a bit bluntly made, but it’s for a reason. There’s a certain kind of internet posting style which uses techniques like changing “social justice movement” to “social injustice movement” to frame the author’s point of view. Once upon a time “Micro$oft” was common in this posting style.

                                                                              For extreme cases of this, see RMS’ writing (Kindle=Swindle, etc).

                                                                              (The problem with these techniques, IMO, is that they’re never as clever and convincing as the person writing them thinks that they are. Maybe they appeal to some people who already agree with that point of view, but they can turn off anyone else…)

                                                                              1. 2

                                                                                I think there is a difference here. “Microsoft” is not framing any point of view. “social justice movement”, on the other hand, is already framing certain point of view. I think “social injustice movement” is an acceptable alternative to “so-called social justice movement”, because prefixing “so-called” every time is inconvenient.

                                                                          2. 0

                                                                            Without more info it seems persecution complex.

                                                                          1. 1

                                                                            This sounds too good to be true!

                                                                            1. 5

                                                                              I am not a Haskell programmer but I did not find the Haskell version ugly. F# gives you functional programming and classes.

                                                                              1. 18

                                                                                When ad-blocking was obscure, we could free-load off of the majority who fund services by viewing ads… now Apple is taking my free lunch! :/

                                                                                1. 18

                                                                                  I clicked on the article. It came up and I started reading it. I didn’t get very far when the window turned black, and said I had to rotate the screen to view it “properly” on my phone. First, I’m not on a phone, thank you very much. Second, I’m on an iPad, using it in landscape mode because I’m using it as a laptop [1].

                                                                                  Fine, I turn the iPad to portrait mode. Page loads with this #@%@#$@$ vertical ad, covering the article, with no way to dismiss it. Thank you so very much. Thank you so very much that I’m not going to read your sob story about how blocking ads will destroy the Internet.

                                                                                  [1] No power. Using iPhone as hot spot. Still waiting for power company to restore power after Hurricane Irma.

                                                                                  1. 5

                                                                                    Upvoted for your honesty. That’s exactly what ad-blocking is. The malware reduction argument some respond with is bogus. If they were about paying for what they consume and didn’t like malware, they’d just not use the ad-supported services. Free shit rocks, though, right? ;)

                                                                                    1. [Comment removed by author]

                                                                                      1. 21

                                                                                        I worked at a streaming media company. A lot of our ads were supplied by brokers like Google. They were mostly harmless. Frequently, however, we’d get custom ads for special events (launch events for movies, TV shows, and games).

                                                                                        The code in the special-event ads was a disaster. If I could, I’d clean it up so that it still worked. Problem mostly mitigated.

                                                                                        However, in many of the embed snippets we’d receive the code was a script that would pull the real ad from the advertising company’s servers. Complete crap. Almost all of them would engage in some kind of DOM manipulation. If you didn’t isolate the ads they would break the layout.

                                                                                        The ad code would often try to include its own trackers for unique-visit tracking. Flash ads were very popular. So the companies would try page-takeover techniques to block everything and force you to view 15 seconds of crap. (And let’s not forget pop-over and pop-under ads.)

                                                                                        Very few companies were content with a simple image and an anchor tag to let the user follow-up for further information.

                                                                                        And that’s the chief problem with online ads. They try to be way too smart. Many want to interact with the user, or worse, “demand” you pay attention. Advertisers frequently have an attitude of “I paid for this, you’re going to give me some time.” They’ll say they just want to inform the public. But no. They want ROI.

                                                                                        And these are the “legit” advertisers. After that there are the skeezy “b” players (remember “X10”) who aren’t trying to rob you but are more like the used car salesman of the internet. Then there are the porn advertisers and lastly the purveyors of drive-by malware. This last group doesn’t even pay for ad space. They steal it.

                                                                                        And don’t forget the ad networks and information aggregators who want to build detailed dossiers about everyone (Google and Facebook are the most public of these). Who do you think invented persistent cookies?

                                                                                        No. Being suspicious of online advertising isn’t a sign of paranoia. It’s sensible.

                                                                                        1. 4

                                                                                          Why aren’t ads just regular websites served in an iframe? That way, their shitty code couldn’t break anything about your website. Each site could have their own ID, sent in a query parameter in the iframe URL, to track which websites provide impressions. The ad could still be as flashy and interactive as it wants. The ad’s code could be as shitty as it wanted, and it wouldn’t have a negative impact on any users.

                                                                                          1. 9

                                                                                            That would make sense, but many ad networks ban displaying ads in iframes because they can’t check the contextuality of the ad to the page the user sees. The ban also helps mitigate fraud. If the ad could only “see” the iframe around it, it would make it easy to load the ad via techniques as simple as using curl, to more sophisticated uses of multiple javascript xhr requests.

                                                                                            Google still ban it today (AdSense Policy FAQ). Common phrasing for this is “posting on a non-content page”.

                                                                                            The online advertising industry created the cesspool and now they’re whining that Apple, Google, Mozilla, and dozens of ad-blocking companies are trying to force them to clean-up.

                                                                                            On a related note, it might seem weird that Google would try to force better practices with Chrome when they make their money on advertising. But for the most part, Google run a pretty tight ship and force advertisers to adhere to some reasonable standards.

                                                                                            Weeding out the worst players keeps the ecosystem sustainable. The last thing Google want to see is an end to online advertising. And it doesn’t hurt their chances of winning more advertising dollars from the gap left by their departure.

                                                                                            1. 6

                                                                                              because they can’t check the contextuality of the ad to the page the user sees.

                                                                                              Well they can: IFrame “busters” have been available for a long time, and since the ad network is usually more trustworthy than the publisher (to the Advertiser anyway) they could provide an interface to look up the page the user is on well before location.ancestorOrigins (and generate errors if parent!=top).

                                                                                              Indeed most of the display networks used to do this – all of them except Google, and now AdSense has edged everyone who wants to do impressions out.

                                                                                              On a related note, it might seem weird that Google would try to force better practices with Chrome when they make their money on advertising. But for the most part, Google run a pretty tight ship and force advertisers to adhere to some reasonable standards.

                                                                                              Google is probably the worst thing to come to advertising and is responsible for more ad fraud and the rise of blocking crap JavaScript than any other single force.

                                                                                              Google will let you serve whatever you want as long as their offshore “ad quality team” sees an ad. Everyone just rotates it out after 100 impressions and Google doesn’t care because they like money.

                                                                                              Google still lets you serve a page as an iframe – even if it has ten ads on it. Buy one ad, sell ten. Easy arbitrage. Even better if you can get video to load (or at least the tracking to fire). This has been trivial to stop for a long time, but hey, Google likes money.

                                                                                              Googles advertising tools are amongst the worst in the world (slow, buggy, etc) and make it difficult to block robots, datacentres, businesses, etc. using basic functionality that other tools support.

                                                                                              What’s amazing is Google’s PR. So many people love Android, good search, that quirky movie about an Intern, the promise of self-driving cars, and so on, that they don’t educate themselves about how Google actually makes their money out of fleecing advertisers and pinching publishers.

                                                                                              1. 1

                                                                                                Iframe busting is a technique for content in the iframe to “bust out” and replace the page with itself. It’s primarily used for ad-takeover and to prevent clickjacking. It’s not a technique for accessing the DOM of the parent. Browser bugs aside, accessing the DOM of the parent requires the child have the same origin as the parent (or other assistance).

                                                                                                location.ancestorOrigins might not give the ad network or advertiser the contextual information they want if the page the user is viewing varies by status (guest, authenticated user, basic membership, premium membership).

                                                                                                It’s easier (and better for data gathering) for ad networks to demand they’re on the same page the user is viewing. Whether that’s a good thing for the end user probably doesn’t matter to many content providers as long as the ad network isn’t serving up malware (or causing other issues that might hurt the provider/user relationship).

                                                                                                In short, you want to monetize your site, you find a way to convince users to pay, or you get advertising which means you play by the ad-networks’ rules.

                                                                                                Google definitely has issues, but they’ve made it easy enough and, compared to their competitors, less problematic such that many content providers accept it.

                                                                                                1. 1

                                                                                                  Iframe busting is a technique for content in the iframe to “bust out” and replace the page with itself. It’s primarily used for ad-takeover and to prevent clickjacking. It’s not a technique for accessing the DOM of the parent.

                                                                                                  The same API ad servers provide to iframes for doing these rich media operations, also carry other capabilities, e.g. EyeBlaster’s _defaultDisplayPageLocation

                                                                                                  Since (hypothetically) the ad network is more trustworthy than the publisher, this could have been used to trivially unmask naughty publishers.

                                                                                                  The only reason I can come up with for the sell-side platforms not doing this is that they like money.

                                                                                                  Google definitely has issues, but they’ve made it easy enough and, compared to their competitors, less problematic such that many content providers accept it.

                                                                                                  They don’t really have any display/impression competitors for small sites anymore… although I’ve been thinking about making one.

                                                                                        2. 4

                                                                                          Well, I respect you for trying to avoid freeloading. I should also add I think it’s ethical for people to use ad blockers for security who otherwise avoid ad-supported site. Just trying to stop any sneaky stuff.

                                                                                          1. [Comment removed by author]

                                                                                            1. 2

                                                                                              That’s reasonable. Similar to AdBlocks Acceptable Ads where being obnoxious or sneaky is unacceptable but ads themselves are OK.

                                                                                        3. 5

                                                                                          I disagree with that viewpoint. It’s right up there with, “Our service would be secure if people would just stop requesting these specific URLs.”

                                                                                          I just don’t see ad-blocking as freeloading. It doesn’t make any sense to pay for something when there’s an equally good free alternative.

                                                                                          I’m a happy paying customer of GitHub, Fastmail, SmugMug, Amazon Prime, Flickr, Netflix, and probably some services I’m forgetting. At the same time, I’m not stupid, and I’m not going to be annoyed and look at ads.

                                                                                          1. 1

                                                                                            ““Our service would be secure if people would just stop requesting these specific URLs.””

                                                                                            It’s certainly not. Managing the risk your product or service has for consumers is totally different than getting a good you know is ad-supported, has ads built-in by default, and stripping the benefit to the other party while enjoying the content. They’ve put work into something you enjoyed and a way to be compensated for it. You only put work into removing the compensation.

                                                                                            “ It doesn’t make any sense to pay for something when there’s an equally good free alternative.”

                                                                                            I agree. I then make the distinction of whether I’m doing it in a way that benefits the author (ads, patreonage, even a positive comment or thanks) or just me at their expense since they didn’t legally stop me. I’m usually a pirate like most of the Internet in that I surf the web with an ad blocker. I’m against ad markets and I.P. law, too broke to donate regularly, and favor paid/privacy-preserving alternatives where possible (i.e. my Swiss email). When I get past financial issues, I’ll be using donations for stuff where possible. I still do that occasionally. Meanwhile, you won’t catch me pretending like I’m not freeloading off the surveillance profiles of others on top of whatever they have on me.

                                                                                            1. 6

                                                                                              These anti-adblock sentiments seem to always assume the content creator will get paid if I don’t block the ads. But that assumes that either (1) they get paid by impression – which is vanishingly rare or (2) I would click on ads, which I won’t blocked or not.

                                                                                              1. 1

                                                                                                Now that’s a good counter worth thinking about. It still fits into my overall claim of freeloading, though.

                                                                                          2. 2

                                                                                            Mostly it doesn’t which is why most of the time I don’t bother to look for ways to pay for it. But setting aside vast majority of websites where I might visit only once or twice why should I go out of my way to avoid sites that don’t offer any (to me) reasonable way of paying for them?

                                                                                            From practical point of view using ad-blocker I don’t even know about most websites approach to monetisation if there is one. I do bail on those that notify me about my ad-blocking which I guess is ethical in your book?

                                                                                            For what is worth I do pay for a bunch of online services, few patrons and sponsor/subscribe to a couple of news media organisations.

                                                                                            1. 2

                                                                                              why should I go out of my way to avoid sites that don’t offer any (to me) reasonable way of paying for them?

                                                                                              A good point. The authors concerned with money should at least have something set up to receive easy payments with a credit card or something. If they make it hard to pay them, the fault is partly on them when they don’t get paid.

                                                                                          3. 3

                                                                                            While I agree content needs to be paid for in some manner - network ads use a not insignificant amount of bandwidth which I pay for on my mobile data allowance and at home through my ISP. The infrastructure costs of advertising, and spam email are not all bourne by the producers of that content. From my perspective the advertisers are not funding the content that I want…

                                                                                            1. 1

                                                                                              Well, that’s interesting. I can relate on trying to keep the mobile bill down. It still falls in with freeloading where you don’t agree to offer back what they expect in return for their content. Yet, it’s a valid gripe which might justify advertisers choosing between getting ads blocked or something like progressive enhancement for ads. They offer text, a pic, and/or video with what people see determined by whether a browser setting indicates they have slow or expensive Internet. So, they always serve something but less bandwidth is used when less is available.

                                                                                          1. 4

                                                                                            So I’ve only spent like two minutes looking, but I think you can also do pattern matching with switch(variant.index()) if you like.

                                                                                            1. 6

                                                                                              That would be non-exhaustive at compile-time

                                                                                              1. 3

                                                                                                What the author’s going for is selecting an alternative and getting the value out should be the same operation, so you can’t hit a runtime type error between checking the alternative and unboxing it.

                                                                                                1. 1

                                                                                                  A guarantee that the type won’t change in a concurrent environment is going to require a lot more machinery I think. There’s accessors to get pointers to the value. And in other cases, the value itself may be a pointer. If the type can change at any time, those pointers will invalidated. If you want the borrow checker, it’s over there I guess, but I didn’t really get the sense that the author wants atomic selectors.

                                                                                                  1. 3

                                                                                                    I was unclear there. By “the same operation,” I just mean that selecting and unboxing shouldn’t be separate points in the code. I’m not about to argue that variant needs to be concurrent.

                                                                                                    What I mean is just that in

                                                                                                    select (boink.index()) {
                                                                                                    case 0: int val = get<0>(boink); 
                                                                                                        ...
                                                                                                    }
                                                                                                    

                                                                                                    you’re mentioning the index twice, and if you mistype one or the other you’ll only find out at runtime.

                                                                                                    1. 1

                                                                                                      Oh, I see. Yeah, you could do switch ((idx = boink.index())) (always another workaround) but it is backtreading.

                                                                                                2. 2

                                                                                                  Then you’re writing exactly the same code as you would with a tagged union, except it’s actually worse because you don’t get -Wswitch. (warning: enumeration value ‘ASDF’ not handled in switch [-Wswitch])

                                                                                                  1. 2

                                                                                                    Well, it’s solve the problem that the tag and the value diverge because you forget to update one. Guess you get to choose which is worse. It seems the return type of index could be an enum (though obviously they didn’t do that). Not sure how much more difficult that would have been.

                                                                                                1. 2

                                                                                                  I would appreciate some thoughts on why people still use C in 2017. Why not use a higher level language that is capable of producing an excellent C API? Obvious candidates are C++ 17 and Rust.

                                                                                                  1. 23

                                                                                                    Well, for one thing, I don’t know any Rust and haven’t written a line of C++ in probably a decade, whereas I’ve got twenty-something years of C experience and write new code every day. :)

                                                                                                    There’s an awful lot of legacy C code out there that needs to be maintained.

                                                                                                    C is very stable: it’s changed very little over the years. I regularly work with C code that’s 30+ years old and it still compiles on modern systems with only minimal changes. Moreover, it’s relatively easy to write code today that a compiler from 30 years ago would accept. Many of the changes in subsequent C standards are aimed at increasing portability, not adding features. C++ (and Rust?) change drastically with every version, adding tons of new features.

                                                                                                    C is very simple: I can keep all of the semantics and all of the standard library in my head at once. Compare this to C++, where the old adage is “everyone knows about 70% of C++…it’s just that nobody knows the same 70%.” Rust and C++ are just insanely complex and huge by comparison.

                                                                                                    C is a “universal assembly language”: most higher level languages can easily interface with libraries written in C. You can write stuff in C++ that has a C layer on top, but things get somewhat hairier. I don’t know Rust, but I’d imagine the same sort of considerations arise there. Yes it’s “easy” to account for these things, but they still have to be accounted for.

                                                                                                    C is extremely portable: C compilers exist for just about any platform. This is critical when you write embedded code or code for obscure platforms.

                                                                                                    C has minimal runtime requirements. Yes you can write C++ (or Rust?) that targets the bare metal, but you’re going to spend at least some time on getting your runtime up.

                                                                                                    And finally, for me, there’s less…cognitive burden…writing C code. The fact that it’s a small language, with a small standard library helps greatly. The fact that there’s only one paradigm to consider is surprisingly helpful too. I’ve written code in C++ that needed to use stuff that couldn’t be done in an object-oriented manner and it felt…weird…because half the time I was decomposing things into classes and then half the time I wasn’t.

                                                                                                    (Yes I know C++ is not limited to OOP.)

                                                                                                    So when I write code, the general rule is I write it in Python if it’s neither low-level nor performance-critical nor needs to work standalone, and the rest I write in C. Seems to have worked well for me thus far.

                                                                                                    (Other tools in my toolbox include Lua, for when you need to embed a scripting language, Bourne shell because it’s everywhere and works well, make, awk, etc.)

                                                                                                    1. 6

                                                                                                      This is all very good and true; a few small comments about Rust since you don’t know it well:

                                                                                                      You can write stuff in C++ that has a C layer on top, but things get somewhat hairier. I don’t know Rust, but I’d imagine the same sort of considerations arise there.

                                                                                                      Yup, you write #[no_mangle] extern fn instead of fn and you get a C ABI. Then usually you end up checking invariants, etc. It’s basically an FFI, so while it has zero cost at runtime, there’s still some work to do to write it in the first place.

                                                                                                      C is extremely portable: C compilers exist for just about any platform. This is critical when you write embedded code or code for obscure platforms.

                                                                                                      Rust uses LLVM, so we run into the same issues as clang there; GCC supports more platforms.

                                                                                                      C has minimal runtime requirements. Yes you can write C++ (or Rust?) that targets the bare metal, but you’re going to spend at least some time on getting your runtime up.

                                                                                                      Rust has basically the same amount of runtime as C does, if you want to write bare-metal code, you don’t need to do any work to get a runtime going, you say #[no_std] to turn off the standard library, and that’s pretty much it. (There is one other function you need to stub out, but hopefully you won’t even need to do that soon, and you don’t need to give a real implementation, only define the symbol.)

                                                                                                      1. 2

                                                                                                        Rust uses LLVM, so we run into the same issues as clang there; GCC supports more platforms.

                                                                                                        I was under the impression, at least from this page, that the platforms Rust supports are a subset of those supported by LLVM, not the full set.

                                                                                                        1. 4

                                                                                                          Last paragraph.

                                                                                                          But those aren’t the only platforms Rust can compile to! Those are the ones with built-in target definitions and/or standard library support.

                                                                                                          1. 1

                                                                                                            Rust is vastly over-stating its support. This statement is saying “if you work for several days, you can compile to a target!”, might as well tell me “the sky is the limit, just add a LLVM target!”.

                                                                                                            I know one of the tier 2/3 targets insta-crashed if you ran anything for a long time.

                                                                                                          2. 2

                                                                                                            It’s true that support is not automatic, but @myfreeweb’s post does also apply too.

                                                                                                            Regardless, I meant it more as an upper bound than anything else.

                                                                                                      2. 12

                                                                                                        I would appreciate some thoughts on why people still use C in 2017.

                                                                                                        C is simple, mature, everywhere, and easy to get things done with. It doesn’t get in the way.

                                                                                                        Rust and C++ in particular are ridiculously complex by comparison. Both are moving targets. There are lots of platforms Rust doesn’t run on. It’s not obvious at all why such languages should be considered obvious candidates. It’s not obvious at all that my code would meaningfully improve or that coding and maintaining it became nicer if I used Rust or C++ instead of C. I guess I could use C++ mostly as though I were writing C, but then what’s the point? It only adds more complications to deal with.

                                                                                                        1. 5

                                                                                                          I would appreciate some thoughts on why people still use C in 2017.

                                                                                                          It’s the devil we know. Any problem you might have with it, it’s been already encountered, studied and fixed or the workarounds are documented.

                                                                                                          1. 7

                                                                                                            Many great comments here showing why people use C. I’m responding to this one since the point is understated. Even in high-assurance stuff at places like NASA, the developers will often choose C even if they could acquire and train on something like Ada/SPARK. The reason is there’s a tool, guide, or method to deal with about every conceivable problem. Experienced C developers will have encountered many themselves with avoidance or detection being ingrained habits. Those developers combined with that supporting ecosystem can produce more robust, efficient code than the same developers using unfamiliar language with less supporting information and tools available.

                                                                                                            Now, the argument changes if they’ve had time to learn and experiment with the other language, see how it handles situations they read up on in C, and if the 80/20 rule has kicked in on tooling side where just enough exists to wipe out lots of problems. Ada is long past that point, esp if one can pay for tools. C has a FOSS advantage there. Safety-critical Java with minimal or real-time runtimes is probably next due to all the Java experience and bug-hunting tools. And, finally, Rust knocks out lots of problems with more tools and components coming online all the time. Give it a few years and tooling might be a lot better like what happened with safety-critical Java.

                                                                                                          2. 5

                                                                                                            Rust’s compiler is quite slow and the type system complex, C++ is the Perl of static languages. The main problems with C is the lack of safety for memory and concurrency, both of which can be mitigated by libraries and tools. I’m still using C and intend to continue doing so because it’s a simple language that lets me get close to the metal – but I only create small programs in C, otherwise the language makes it really hard to maintain the code. I admire the kernel’s developers for that.

                                                                                                            1. 3

                                                                                                              C++ is the Perl of static languages

                                                                                                              This made me laugh aloud. ?

                                                                                                            2. 3

                                                                                                              In the embedded world – and it’s a pretty big world – C and assembler are the only choices right now. (Rust may have a shot, but it’s not there yet.)

                                                                                                              This is mainly because of code size concerns. You need tight control over the size of the executable code and C gives you a pretty good idea of how much object code you’re going to end up with when looking at just source code. A lot of things also need careful control over the linker since, in some cases, that’s where all the work gets done. (If you’re targetting an 8-bit machine, sometimes you do all optimization in the linker, for example.)

                                                                                                              There are also things like writing or placing things are precise memory locations that C facilitates without much friction.

                                                                                                              1. 1

                                                                                                                I find C++‘s syntax unintelligible. there’s so many single characters for higher level abstractions I don’t understand. Rust seems similar.

                                                                                                              1. 4

                                                                                                                Bizarre, but I love it!

                                                                                                                1. 2

                                                                                                                  Everyone keeps referencing Buck and Bazel. How do they compare to Meson, which GTK just switched to?

                                                                                                                  1. 3

                                                                                                                    My understanding (which is based only on reading Meson docs, not actually using it) is that Meson is more similar to CMake, which is all about integrating with things present in your system environment for building system software.

                                                                                                                    Buck and Bazel take a different approach: they’re all about fully encapsulated builds that depend on nothing outside the project directory. This is great for people who are building software for deployment with big teams (nothing depends on a given engineer’s machine config, mostly) but not great for packagers who are building software for binary distribution to desktop machines, who want integration with system-installed packages.

                                                                                                                    Meson is to Bazel as Debian packaging is to Docker; one tries to be a nicer way to integrate with systems we’ve had for a long time, while the other throws its arms up in the air and says “fuck it, the rest of this machine might as well not exist”.

                                                                                                                    1. 1

                                                                                                                      Reading very quickly, it looks like the input to meson is very similar to Buck and Bazel, but it generates ninja files instead of trying to do everything, and it actually contains the tools you need to do the usual install steps.

                                                                                                                      Buck definitely had nothing similar to make install, and the last time I looked at it, it couldn’t even use third party libraries installed on your system – you had to put them into your build directory.

                                                                                                                      1. 1

                                                                                                                        Buck definitely had nothing similar to make install, and the last time I looked at it, it couldn’t even use third party libraries installed on your system – you had to put them into your build directory.

                                                                                                                        This is by design. Buck builds should be reproducible.

                                                                                                                        Regarding install, Buck + Bazel are for building code, rather than installing packages. The idea is that your build scripts reproducibly create binaries which can then be packaged as .deb etc.

                                                                                                                        1. 1

                                                                                                                          This is by design. Buck builds should be reproducible.

                                                                                                                          It’s also completely useless for the vast majority of software software, which wants to use installed libraries.

                                                                                                                    1. 0

                                                                                                                      Make leans too heavily on Bash to make maintainable builds possible. Sure, it’s fine if you are just compiling a few files, but for anything larger please use something declarative like Buck, Bazel and co.

                                                                                                                      1. 2

                                                                                                                        Make leans heavily on Bash specifically, or /bin/sh ?

                                                                                                                        The first would be a definite issue. The second - not so much. Posix shell scripting concepts are well defined.

                                                                                                                        When involved as /bin/sh is in posix compatibility mode, and on Debian & derivatives, /bin/sh is Dash, not Bash.

                                                                                                                        1. 1

                                                                                                                          There are many, many different versions of make, and not all of them depend on bash. I’ll give you that they all depend on a sh-compatible shell, though, by way of it’s use of system(3).

                                                                                                                          edit: of course, this is often customizable in implementations, e.g. Via .ONESHELL, or other mechanisms, so maybe splitting hairs.

                                                                                                                          1. 3

                                                                                                                            It’s not just about the Bash dependency, it’s also about having semantic information in the target graph. For example, in Buck you can declare a C++ library without writing code up-front that decides how it should link, which compiler to use, which flags, etc. Yes, you could implement this in Make using Bash + Clang, but it would be tedious and error-prone. I find that it’s just easier to use a build system that understands my code!

                                                                                                                            If you choose not to use the language-specific features, Buck and Bazel are just a better Make (hashes not timestamps, non-recursive, better syntax, etc. ). https://buckbuild.com/rule/genrule.html

                                                                                                                            1. 3

                                                                                                                              My fault with your point was that make doesn’t really rely on anything–it’s dumb. A programmer setting up a build system with make, as you state, has a lot of hoops to jump through, possibly by using bash, or other utilities. Basically, I agree with you, but was splitting hairs about the wording.

                                                                                                                              To address your other, more important point, though. I think the reason that people still suffer through all the hurdles to make make work, is because it’s readily available everywhere. Scons, which was a nice system, never saw critical mass because (among other things) it was an extra dependency, and as a result an extra step and hassle for everyone. We need important, high profile projects (like GTK switching to Meson), to switch to a tool, and have that tool emerge as the new make before this problem will get better. I fear that the fact we have more and more tools emerging will just lead people back to make, though.

                                                                                                                              1. 1

                                                                                                                                Yes, I think we basically agree. I just wanted to emphasis how Make in practice requires you to call lots of tools. Upvoted :)

                                                                                                                        1. 12

                                                                                                                          A great decision - third-party social networks don’t belong in the OS.

                                                                                                                          1. 2

                                                                                                                            Agree, Apple finally moving the right way.