Threads for bitrot
-
I’ve worked on systems in statically typed languages, as well as dynamically typed languages, some with REPLs and fancy debugging tools, and some without.
As someone who loves lisps and also languages that are quite different from lisp, there’s a reason why homoiconicity, REPLs, and time-traveling debuggers didn’t take over the world, and it’s not because people are stupider than you.
There just isn’t one true model of computation. There isn’t one development/debugging workflow that’s globally better than all others. Humans are diverse and think and communicate in different ways. Some people are more visual in their thinking; others can fit a tremendous amount of state in their brains and think procedurally.
-
Regular reminder that life hacking one’s consumption habits will not change the world.
We will really buy hardware built in sweatshops, hand all our code to a company that contracts with the state, but the problem is that Microsoft looms at the keyboard shortcuts you use?
-
Microsoft telemetry running on your own computer is a more direct problem for you than sweatshops or Github existing, and you have more ability to change your own consumption habits to directly remove the opportunity for Microsoft to spy on you than to change how Github operates vis a vis a government or the working conditions of hardware factories in foreign countries whose languages and cultures you do not understand.
-
-
Oh yeah, totally, the problem with the internet is not enough “autonomy”. As opposed to having our personas traded by data brokers, brains melted by social media, behaviors modified by targeted advertising and influencer culture.
These techno-libertarian 80s MIT hacker derivative “autonomy” and “freedom” arguments have been such a massive distraction from a material analysis of how power actually uses technology to exploit people for profit. The spectacle of the individual atomizes people and alienates them from common cause.
But if only we were to perfect our APIs and network protocols. Then we would not be exploited by internet companies. We would have autonomy 🙄
-
-
I mean, we already have “autonomy” just layer your protocol on IP and away with you beasties!
-
-
I used to give the same advice, but I completely changed my opinion over the past 10 years or so. I eventually put in the time and learned shell scripting. These days my recommendation is:
- Learn to use the shell. It’s a capable language that can take you very far.
- Use ShellCheck to automatically take care of most of the issues outlined in the article.
I really don’t want to figure out every project’s nodejs/python/ruby/make/procfile abomination of a runner script anymore. Just like wielding regular expressions, knowing shell scripting is a fundamental skill that keeps paying dividends over my entire career.
-
Bingo.
My advice is:
- Always use
#!/usr/bin/env bashat the beginning of your scripts (change if you need something else, don’t rely on a particular path to bash though). - Always add
set -eou pipefailafter that. - Always run shellcheck.
- Always run shfmt.
- Always pay attention to what version of bash you need to support, and don’t go crazy with “new” features unless you can get teammates to upgrade (this is particularly annoying because Apple ships an older version of bash without things like associative arrays).
- Always use the
localstorage qualifier when declaring variables in a function. - As much as possible, declare things in functions and then at the end of your script kick them all off.
- Don’t use bash for heavy-duty hierarchical data munging…at that point consider switching languages.
- Don’t assume that a bashism is more-broadly acceptable. If you need to support vanilla
sh, then do the work.
While some people like the author will cry and piss and moan about how hard bash is to write, it’s really not that bad if you take those steps (which to be fair I wish were more common knowledge).
To the point some folks here have already raised, I’d be okay giving up shell scripting. Unfortunately, in order to do so, a replacement would:
- Have to have relatively reasonable syntax
- Be easily available across all nix-likes
- Be guaranteed to run without additional bullshit (installing deps, configuring stuff, phoning home)
- Be usable with only a single file
- Be optimized for the use case of bodging together other programs and system commands with conditional logic and first-class support for command-line arguments, file descriptors, signals, exit codes, and other nixisms.
- Be free
- Don’t have long compile times
There are basically no programming languages that meet those criteria other than the existing shell languages.
Shell scripting is not the best tool for any given job, but across every job it’ll let you make progress.
(Also, it’s kinda rich having a Python developer tell us to abandon usage of a tool that has been steadily providing the same, albeit imperfect, level of service for decades. The 2 to 3 switch is still a garbage fire in some places, and Python is probably the best single justification for docker that exists.)
-
While some people like the author will cry and piss and moan about how hard bash is to write, it’s really not that bad if you take those steps (which to be fair I wish were more common knowledge).
I think “nine steps” including “always use two third-party tools” and “don’t use any QoL features like associative arrays” does, in fact, make bash hard to write. Maybe Itamar isn’t just “cry and piss and moan”, but actually has experience with bash and still think it has problems?
-
To use any language effectively there are some bits of tribal knowledge…babel/jest/webpack in JS, tokio or whatever in Rust, black and virtualenv in Python, credo and dialyzer in Elixir, and so on and so forth.
Bash has many well-known issues, but maybe clickbait articles by prolific self-pronoters hat don’t offer a path forward also have problems?
-
-
I think there’s merit here in exploring the criticism, though room for tone softening. Every language has some form of “required” tooling that’s communicated through community consensus. What makes Bash worse than other languages that also require lots of tools?
There’s a number of factors that are at play here and I can see where @friendlysock’s frustration comes from. Languages exist on a spectrum between lots of tooling and little tooling. I think something like SML is on the “little tooling” where just compilation is enough to add high assurance to the codebase. Languages like C are on the low assurance part of this spectrum, where copious use of noisy compiler warnings, analyzers, and sanitizers are used to guide development. Most languages live somewhere on this spectrum. What makes Bash’s particular compromises deleterious or not deleterious?
Something to keep in mind is that (in my experience) the Lobsters userbase seems to strongly prefer low-tooling languages like Rust over high-tooling languages like Go, so that may be biasing the discussion and reactions thereof. I think it’s a good path to explore though because I suspect that enumerating the tradeoffs of high-tooling or low-tooling approaches can illuminate problem domains where one fits better than the other.
-
I felt that I sufficiently commented about the article’s thesis on its own merits, and that bringing up the author’s posting history was inside baseball not terribly relevant. When you brought up motive, it became relevant. Happy to continue in DMs if you want.
-
-
-
-
-
Integrating shellcheck and shfmt to my dev process enabled my shell programs to grow probably larger than they should be. One codebase, in particular, is nearing probably like 3,000 SLOC of Bash 5 and I’m only now thinking about how v2.0 should probably be written in something more testable and reuse some existing libraries instead of reimplementing things myself (e.g., this basically has a half-complete shell+curl implementation of the Apache Knox API). The chief maintenance problem is that so few people know shell well so when I write “good” shell like I’ve learned over the years (and
shellcheck --enable=allhas taught me A TON), I’m actively finding trouble finding coworkers to help out or to take it over. The rewrite will have to happen before I leave, whenever that may be.-
I’d be interested in what happens when you run your 3000 lines of Bash 5 under https://www.oilshell.org/ . Oil is the most bash compatible shell – by a mile – and has run thousands of lines of unmodified shell scripts for over 4 years now (e.g. http://www.oilshell.org/blog/2018/01/15.html)
I’ve also made tons of changes in response to use cases just like yours, e.g. https://github.com/oilshell/oil/wiki/The-Biggest-Shell-Programs-in-the-World
Right now your use case is the most compelling one for Oil, although there will be wider appeal in the future. The big caveat now is that it needs to be faster, so I’m actively working on the C++ translation (
oil-nativepassed 156 new tests yesterday).I would imagine your 3000 lines of bash would be at least 10K lines of Python, and take 6-18 months to rewrite, depending on how much fidelity you need.
(FWIW I actually wrote 10K-15K lines of shell as 30K-40K lines of Python early in my career – it took nearly 3 years LOL.)
So if you don’t have 1 year to burn on a rewrite, Oil should be a compelling option. It’s designed as a “gradual upgrade” from bash. Just running
osh myscript.shwill work, or you can change the shebang line, run tests if you have them, etc.There is an
#oil-helpchannel on Zulip, liked from the home page-
Thanks for this nudge. I’ve been following the development of Oil for years but never really had a strong push to try it out. I’ll give it a shot. I’m happy to see that there are oil packages in Alpine testing: we’re deploying the app inside Alpine containers.
Turns out that I was very wrong about the size of the app. It’s only about 600 SLOC of shell :-/ feels a lot larger when you’re working on it!
One thing in my initial quick pass: we’re reliant on bats for testing. bats seemingly only uses bash. Have you found a way to make bats use Oil instead?
-
OK great looks like Alpine does have the latest version: https://repology.org/project/oil-shell/versions
I wouldn’t expect this to be a pain-free experience, however I would say should definitely be less effort than rewriting your whole program in another language!
I have known about bats for a long time, and I think I ran into an obstacle but don’t remember what it was. It’s possible that the obstacle has been removed (e.g. maybe it was extended globs, which we now support)
https://github.com/oilshell/oil/issues/297
In any case, if you have time, I would appreciate running your test suite with OSH and letting me know what happens (on Github or Zulip).
One tricky issue is that shebang lines are often
#!/bin/bash, which you can change to be#!/usr/bin/env osh. However one shortcut I added was OSH_HIJACK_SHEBANG=osh
-
-
-
Yes that has always been the plan, mentioned in the very first post on the blog. But it took awhile to figure out the best approach, and that approach still takes time.
Some FAQs on the status here: http://www.oilshell.org/blog/2021/12/backlog-project.html
Python is an issue for speed, but it’s not an issue for setup.
You can just run
./configure && make && make installand it will work without Python.Oil does NOT depend on Python; it just reuses some of its code. That has been true for nearly 5 years now – actually since the very first Oil 0.0.0. release. Somehow people still have this idea it’s going to be hard to install, when that’s never been the case. It’s also available on several distros like Nix.
-
-
It only works on WSL at the moment … I hope it will be like bash, and somebody will contribute the native Windows port :-) The code is much more modular than bash and all the Unix syscalls are confined to a file or two.
I don’t even know how to use the Windows sycalls – they are quite different than Unix! I’m not sure how you even do fork() on Windows. (I think Cygwin has emulation but there is way to do it without Cygwin)
-
-
-
-
-
-
To the point some folks here have already raised, I’d be okay giving up shell scripting. Unfortunately, in order to do so, a replacement would: […] There are basically no programming languages that meet those criteria other than the existing shell languages.
I believe Tcl fits those requirements. It’s what I usually use for medium-sized scripts. Being based on text, it interfaces well with system commands, but does not have most of bash quirks (argument expansion is a big one), and can handle structured data with ease.
-
Always use #!/usr/bin/env bash at the beginning of your scripts (change if you need something else, don’t rely on a particular path to bash though).
I don’t do this. Because all my scripts are POSIX shell (or at least as POSIX complaint as I can make them). My shebang is always
#!/bin/sh- is it reasonable to assume this path?-
you will miss out on very useful things like
set -o pipefail, and in general you can suffer from plenty of subtle differences between shells and shell versions. sticking to bash is also my preference for this reason.note that the
/usr/bin/envis important to run bash from wherever it is installed, e.g. the homebrew version on osx instead of the ancient one in/bin(which doesn’t support arrays iirc and acts weirdly when it comes across shell scripts using them) -
My shebang is always #!/bin/sh - is it reasonable to assume this path?
Reasonable is very arbitrary at this point. That path is explicitly not mandated by POSIX, so if you want to be portable to any POSIX-compliant system you can’t just assume that it will exist. Instead POSIX says that you can’t rely on any path, and that scripts should instead be modified according to the system standard paths at installation time.
I’d argue that these days POSIX sh isn’t any more portable than bash in any statistically significant sense though.
-
Alpine doesn’t have Bash, just a busybox shell. The annoying thing is if the shebang line fails because there is no bash, the error message is terribly inscrutable. I wasted too much time on it.
-
nixos has /bin/sh and /usr/bin/env, but not /usr/bin/bash. In fact, those are the only two files in those folders.
-
-
https://mkws.sh/pp.html hardcodes
#!/bin/sh. POSIX definitely doesn’t say anything aboutshs location but I really doubt you won’t find ashat/bin/shon any UNIX system. Can anybody name one?
-
-
- Always use
-
-
That’s because the other ones are options and not errors. Yes, typically they are good hygiene but
set -e, for example, is not an unalloyed good, and at least some experts argue against using it. -
Not for lack of trying: https://github.com/koalaman/shellcheck/search?q=set+-e&type=issues
There are tons of pedants holding us back IMO. Yes, “set -e” and other options aren’t perfect, but if you even know what those situations are, you aren’t the target audience of the default settings.
-
-
I eventually put in the time
Yup, that’s how you do it, It’s a good idea to put in the the time to understand shell scripting. Most of the common misconceptions come out of misunderstanding. The shell is neither fragile (it’s been in use for decades, so it’s very stable) nor ugly (I came from JavaScript to learning shell script, and it seemed ugly indeed at first, now I find it very elegant). Keeping things small and simple is the way to do it. When things get complex, create another script, that’s the UNIX way.
It’s the best tool for automating OS tasks. That’s what it was made for.
+1 to using ShellCheck, I usually run it locally as
shellcheck -s shfor POSIX compliance.
I even went as far as generating my static sites with it https://mkws.sh/. You’re using the shell daily for displaying data in the terminal, it’s a great tool for that, why not use the same tool for displaying data publicly.
-
-
I went the opposite direction - I was a shell evangelist during the time that I was learning it, but once I started pushing its limits (e.g. CSV parsing), and seeing how easy it was for other members of my team to write bugs, we immediately switched to Python for writing dev tooling.
There was a small learning curve at first, in terms of teaching idiomatic Python to the rest of the team, but after that we had much fewer bugs (of the type mentioned in the article), much more informative failures, and much more confidence that the scripts were doing things correctly.
I didn’t want to have to deal with package management, so we had a policy of only using the Python stdlib. The only place that caused us minor pain was when we had to interact with AWS services, and the solution we ended up using was just to execute the
awsCLI as a subprocess and ask for JSON output. Fine!-
I tend to take what is, perhaps, a middle road. I write Python or Go for anything that needs to do “real” work, e.g. process data in some well-known format. But then I tie things together with shell scripts. So, for example, if I need to run a program, run another program and collect, and then combine the outputs of the two programs somehow, there’s a Python script that does the combining, and a shell script that runs the three other programs and feeds them their inputs.
I also use shell scripts to automate common dev tasks, but most of these are literally one-ish line, so I don’t think that counts.
-
-
we immediately switched to Python for writing dev tooling.
FWIW when shell runs out of steam for me, I call Python scripts from shell. I would say MOST of my shell scripts call a Python script I wrote.
I don’t understand the “switching” mentality – Shell is designed to be extended with other languages. “Unix philosophy” and all that.
I guess I need to do a blog post about this ? (Ah I remember I have a draft and came up with a title – The Worst Amounts of Shell Are 0% or 100% — https://oilshell.zulipchat.com/#narrow/stream/266575-blog-ideas/topic/The.20Worst.20Amount.20of.20Shell.20is.200.25.20or.20100.25 (requires login)
(Although I will agree that it’s annoying that shell has impoverished flag parsing … So I actually write all the flag parsers in Python, and use the “task file” pattern in shell.)
-
-
It’s basically a shell script (or set of scripts) you put in your repo to automate common things like building, testing, deployment, metrics, etc.
Each shell function corresponds to a task..
I sketched it in this post, calling it “semi-automation”:
http://www.oilshell.org/blog/2020/02/good-parts-sketch.html
and just added a link to:
https://lobste.rs/s/lob0rw/replacing_make_with_shell_script_for
(many code examples from others in that post, also almost every shell script in https://github.com/oilshell/oil is essentially that pattern)
There are a lot of names for it, but many people seem to have converged on the same idea.
I don’t have a link handy not but Github had a standard like this in the early days. All their repos would have a uniform shell interface so that you could get started hacking on it quickly.
-
-
-
-
You should investigate just for task running. It’s simple like
makebut none of the pitfalls of it for task running.
-
Not listed but a really common reason for continuing to use Y over X is when, regardless of the original choice, the cost of switching doesn’t approach justifying any marginal differences.
-
-
I don’t have a problem with hacktivism and calling attention to injustice is generally the right thing to do. But the idea that you can call out war crimes by indiscriminately targeting disk drives of Russian citizens is really missing the point.
-
This morning I would had said you are right, however today I have picked up my children from their preschool where an Ukrainian boy at their age pissed under himself because he saw an unknown male (me), after having spent two days in a darkened evacuation train and having left behind everyone except his mum - and probably much more she would not tell. I have never seen a more scared being in my life. It wasn’t an anxiety, it was a kind of fear I wasn’t aware humans were able to experience. Let’s say I have a problem with that. If this ‘malware’ will stop at least one Russian ammunition train or make one Russian more stand up, the collateral damage(money) it causes is worth much more than the collateral damage(dead kids) that may be caused by the said ammunition. I don’t blame anyone having other opinion, but I understand and would myself do what the author of the module has and had to do.
-
-
If this ‘malware’ will stop at least one Russian ammunition train or make one Russian more stand up, the collateral damage(money) it causes is worth much more than the collateral damage(dead kids) that may be caused by the said ammunition. I don’t blame anyone having other opinion, but I understand and would myself do what the author of the module has and had to do.
I see where you’re coming from. But I don’t see such methods changing the opinions or stance of a previously-indifferent (much less one who is supportive of the regime) Russian. I see frustration and anger, because they almost certainly aren’t thinking of the plight of Ukrainian families fleeing chaos, they’re thinking about their lost files.
-
I am not endorsing either side here, but your comment seems to presuppose that the sides of their target audience (people in Russia) are supports and opposes. I think in the view of the author of this hazardous code the sides are three: supports, opposes, and mildly in favor of the fictitious events pictured in Russian propaganda. If the theory is that the last group is the largest then they would need only small margin over 50% of that group to be pushed into the opposes group in order to justify the operation to themselves. Again, I’m not endorsing either viewpoint here – I’m just trying to highlight how views can shift depending on (mis)understanding of the subgroups and the size of those groups. Personally I don’t think we have very good estimates for these parameters but tbh I haven’t done a lot of research either.
-
-
-
-
This all depends on the broader context in which code is getting written. There’s no discussion of the incentives which lead to debt and guard against fixing it. It would be nice if our industry were to do science on quality, rather than just opinion.
-
Some instance of this rant is posted to this website every day.
-
What an embarrassing thing to publish. What not-strawmen/ real world programmers is DHH referring to?
-
-
I really like your “why should you try Emacs in 2021” list. It rings very true to my experience with emacs (and vim). Back when I used it more regularly, aside from any kool-aid I drank around the efficiency of keyboard-driven editing, if I’m being honest, the main motivation was simply that it was fun. Emacs was cool to me because I saw it as vintage, alternative, customizable, a component and expression of a hacker identity. It was an expression of programming-as-hobby as opposed to programming-as-profession. Of course I genuinely did enjoy the editing experience, and developing a healthy
.emacs. I loved magit, projectile, helm, the clojure packages, etc. But I ended up in a place professionally where ultimately Emacs had no leverage over more specialized tools for what I was working on.
-
I personally don’t think you should be submitting posts from your company blog at all, ideally another community member would organically post it themselves if it’s interesting enough. Or the actual author of the post.
If you feel like you must promote your company blog, then I think you shouldn’t say you authored the post if you didn’t write it but you should also disclose your relationship with the company in a comment. I don’t think what you’re doing right now - saying you authored the post even though didn’t - sufficiently signals to readers the nature of the conflict and that the post is marketing for your company. There’s no need to add new site features for this either, a top-level comment on the story is sufficient.
-
I agree in principle, but if the content is good enough so that I don’t care that it’s on a company blog (this seems to be the case here), posting it (as not-the-author) is fine. So is an extra comment with “my coworker wrote this, happy to answer questions because *knowlede).
-
I see where your coming from but want to offer counterpoint.
Not every person follows every blog. So the assumption that content will get posted if it’s good enough ignores the idea that different people have are tapped into different information networks due to their social experiences, whether it’s a job or an online community.
I don’t see an inherent problem with posting content produced within the poster’s workplace. I don’t believe the stakes are remotely high enough on an aggregator site like this for there to be a conflict of interest. I also believe that on here, there’s no moral issue with a quality post coming from a company vs hobby blog, even considering the poster’s intent. There might be incidental issues, like a company blogging about ethically compromised tech, but that can be easily dealt with on a case by case basis.
-
Hard agree with all of this.
-
-
Personally, I’m excited about the “melting face” emoji, as well as a few of the new gender and skin color variants that will piss off chuds. Also, the Emoji block of Unicode now has not one, but two amulets against the evil eye, which I expect will be extremely valuable for social media.
-
I’m torn between “melting face” and “dotted line face”, I think they’ll replace my usage of 🙃going forwards.
-
The emoji thing is so totally irresponsible. Humanity is never going to replace Unicode. We’re stuck with it until we either go extinct or go Luddite. Adding emoji based on whims is how you end up with things like this sticking around for four thousand years and counting. The Egyptians at least had the excuse that they didn’t know what computers were.
-
-
Adding emoji based on whims is how you end up with things like this sticking around for four thousand years and counting. The Egyptians at least had the excuse that they didn’t know what computers were.
Not sure what the problem is? Ancient Egyptians living thousands of years ago didn’t share your particular cultural taboos and sensitivities, which seems like an entirely valid “excuse” to me.
-
Right, there’s nothing that the Egyptians were doing “wrong”, because when they decided to use a penis as a letter, they had no way of knowing that for the remainder of human civilization we will have to use the penis as a letter, whether it’s culturally taboo or cool or we replace men with artificial sex bots or whatever. We however do know that Unicode is forever, and so the bar to adding a new character should be really fucking high. Like, here is an alphabet that was already in use by a non-trivial amount of people for some length of time. Not, it would be cool to make a new kind of smiley face.
A better system would be to do what is already done with flags. For flags, the flag 🇺🇸 is just
U+1F1FA 🇺 REGIONAL INDICATOR SYMBOL LETTER U U+1F1F8 🇸 REGIONAL INDICATOR SYMBOL LETTER SWe could do the same thing for other ephemera, and not have to burden Unicode with an open ended and endless list of foods that were popular with the Unicode committee in the 21st century.
-
We don’t “have to use the penis as a letter” because it exists in Unicode. It’s just that it is technically representable. I’ll admit there’s nuance here - there are probably some things I’d rather see us avoid in Unicode, i.e. violence. But I’m struggling to see the harm caused in this particular case.
-
Who’s to say that the United States will still be around in 4,000, 1,000, or 200 years? Or that the “US” code won’t be recycled for some other country? Hell, why should our current ISO system of labelling countries even persist? Once you start talking about these kind of timeframes anything is up for grabs really.
“Forever” is a heck of a long time. I don’t think we’re stuck with Unicode for all eternity, there’s all sorts of ways/scenarios we could come up with something new. I think we should just address the issues of the day; there’s no way what the future will be like anyway; all we can do is focus on the foreseeable future.
-
-
That’s the whole point. US won’t mean 🇺🇸 forever. It will naturally change over time and when it does, the old codes will still be decipherable (flag for something called “US”) without needing to be supported anymore.
Tbh, the most likely a scenario is a RoC, PRC thing where two countries claim to be the US, and then the international community will have to pick sides. Anyway, still better than having the flag as a real emoji!
-
I don’t really follow how one scheme is more advantageous over the over; at the end of the day you’re still going have to map some “magic number” to some specific meaning. I suppose you could spell out “happy” or “fireman” in special codepoints, but that just seems the same as mapping specific codepoints to those meaning, but with extra steps (although “fireman” already consists of two codepoints: “man” + “fire engine”, or “person” and “women” for other gender variants).
The reason it’s done with flags probably has more to do that it’s just easier.
-
It’s not just that it’s easier it’s that obsolescence is a built in concept. New countries come and old countries go and ISO adds and removed country codes. Using Slack and GitHub style :name: emojis mean that you can add and drop support for specific emoji without needing to just serve up a �. It is also more forward compatible. When your friend on a new phone texts you :dotted smiley: you won’t just see �, you’ll see words that describe what is missing. Plus you aren’t using up a finite resource.
-
-
-
When your friend on a new phone texts you :dotted smiley: you won’t just see �
Right, that would be useful.
Changing the meaning of specific codepoints or sequences of codepoints over time just seems like a recipe for confusion. “Oh, this 300 year old document renders as such-and-such, but actually, back then it meant something different from today” is not really something that I think will help anyone.
This already exists to some degree; e.g. “Ye olde tarvern” where “Y” is supposed to represent a capital Thorn, which is pronounced as “th”, not as Y (written as þ today, but written quite similar to Y in old-fashioned cursive writing, and early German printing presses didn’t have a Thorn on account of that letter not existing in German so people used Y as a substitute). In this case it’s a small issue of pronunciation, but if things really shift meaning things could become a lot more apt to misunderstandings in meaning.
-
Emoji have already shifted in ways that change their meaning. The gun emoji has become a ray gun due to political correctness and sometimes points left and sometimes right. Shoot me → zap you. The grimace 😬 was a different emotion on Android and iOS for a while. There are other documented examples of this kind of semantic shift in just a short amount of time. I think it’s a bit hopeless to try to pin them down while you keep adding stuff. The use of eggplant and peach for penis and butt is based on their specific portrayal and subject to the visual similarity being lost if they redraw them in different ways. What if President Xi demands a less sexy 🍑? Will it stick around or be a bit of passing vulgar slang from the early twentieth century? Impossible to predict.
-
-
-
-
-
-
-
-
-
-
You’re missing the point. I’m not ashamed of weiners. They are hilarious. The point is that a character can be taboo or not and we’re still stuck with it.
-
-
-
-
My dude, Unicode inherited vertical tab from ASCII. That’s my point. Things are only going to continue to accumulate for now until the collapse of civilization. It will never shrink.
-
-
-
-
It’d be nice to have some actual background on hashing in here instead of just broad generalizations and links to various hash functions. Examples:
- There’s no mention of cyclic redundancy checks and why they are not valid as crypto functions (a mistake some programmers have made).
- There’s no mention of avalanche effects, which is a good way of seeing how “random” a digest scheme is (with some implications for how well the output can be predicted/controlled by an attacker).
- The mentioned attack on JSON hash tables in PHP (if you dig into it) would’ve been a great place to talk about trivial hashes (e.g.,
f(x) =0orf(x)=x) and why they cause problems even in non-hostile environments, but that would’ve required more of an introduction to how hashing works…) - Lots of usage of jargon like “non-invertible”, “collision-resistance”, “preimage attack resistance”, etc. which is probably inaccessible if your audience is programmers who “don’t understand hash functions”.
- There’s not really an explanation about the differences/similarities of crypto-strong hash functions, password hash functions, and key derivation functions, other than a mention that there is some relation but which isn’t elaborated on at all.
- There’s not really any useful information at all about perceptual hashing vs other forms of multimedia digest approaches–there’s just some Apple hate.
- etc.
Programmers might not understand hash functions, but infosec furries may also not understand pedagogy.
(also, can you please cool it with the inflammatory article headlines?)
-
-
Honestly I think it’s a valid concern. One of the biggest problems with the computer security world, as stated repeatedly by leading experts in the field, is communication and teaching.
-
A valid concern would be “infosec experts may not understand pedagogy” but why call out “infosec furries” specifically? Unless we should be concerned about infosec furries in particular vs other infosec experts?
Are these acceptable?
- but infosec gays may also not understand pedagogy
- but infosec women may also not understand pedagogy
- but infosec people of color may also not understand pedagogy
No. So why furries? People need to get over it and quit furry bashing. This isn’t acceptable behavior on Lobste.rs, and I’m tired of it.
-
See elsewhere for the explanation; furry bashing doesn’t enter into it, though I see why you might have read it that way. Furries are internet denizens like the rest of us, with all that entails.
-
-
“Furry” is a kink, not an identity or protected class. And normally you have to get people’s consent before you bring them into your kink.
-
-
The OP’s site has some pretty well reasoned and presented articles on precisely why “furry” cannot reasonably be summarized as “a kink”.
And, no, you do not “normally” have to get someone’s consent to introduce them to the idea of your kink, unless said introduction involves you engaging them in the practice of your kink.
-
-
Sorry, I didn’t realize the “furry” part was what you were opposed to. It sounded like you were upset with the implication that the infosec world is bad at teaching.
-
-
-
Programmers might not understand hash functions, but infosec furries may also not understand pedagogy.
(also, can you please cool it with the inflammatory article headlines?)
-
One of the things he talks about there is testing the hypothesis and seeing which title actually worked. I only clicked this link because I recognized your domain name and knew you had written interesting articles in the past and might legitimately explain something I didn’t know. If not for that, I probably would have bypassed it since the title alone was not interesting at all.
-
Even so, it is still possible to write clickbait titles that aren’t predicated on insulting/demeaning a group.
- “Hash functions: hard or just misunderstood?”
- “Things I wish more programmers knew about hashes”
- “Programmer hashes are not infosec hashes”
- “Are you hashing wrong? It’s more common than you might think”
- “uwu whats this notices ur hash function”
How would you feel if I wrote “Gay furries don’t understand blog posting”? Even if I raise good points, and even if more people would click on it (out of outrage, presumably), it would still probably annoy a gay furry who wrote blogs and they’d go in with their hackles raised.
-
-
The difference between “Programmers don’t understand hash functions” and “Gay furries don’t understand blog posting” is quite obvious to me and I definitely don’t want to engage in whatever Internet flame is going on here. Especially since, uh, I have a preeetty good idea about what the problem here is, and I tend to think it’s about gay furries, not article titles, which is definitely not a problem that I have. (This should probably be obvious but since I’m posting in this particular thread, I wanted to make sure :P).
But I also think this title really is needlessly nasty, independent of how it might be titled if it were about other audiences. It’s a bad generalisation – there are, in fact, plenty of programmers who understand hash functions – and it’s not exactly encouraging to those programmers who want to get into security, or who think their understanding of these matters is insufficient.
I am (or was?) one of them – this was an interest of mine many, many years ago, at a time when I was way too young to understand the advanced math. My career took me elsewhere, and not always where I wanted to go, and I tried to keep an eye on these things in the hope that maybe one day it’ll take me there. Needless to say, there’s only so much you can learn about these topics by spending a couple of evenings once in a blue moon studying them, so I never really got to be any good at it. So I think the explanation is amazing, but it would definitely benefit from not reminding me of my inadequacy.
And I’m in a happy boat, actually, this is only an interest of mine – but there are plenty of people who have to do it as part of their jobs, are not provided with adequate training of any kind, have no time to figure it out on their own, and regularly get yelled at when they get it wrong.
Now, I realise the title is tongue-in-cheek to some degree, the playful furries and the clever humour scattered throughout the post sort of gives it away. If you think about it for a moment it’s pretty clear that this is meant to grab attention, not remind people how much they suck. But it’s worth remembering that, in an age where web syndication is taken for granted to the point where it sounds like a Middle English term, this context isn’t carried everywhere. Case in point, this lobste.rs page includes only the title. Some people might react to it by clicking because you grabbed their attention, but others might just say yeah, thanks for reminding me, I’ll go cry in a corner.
Even if I didn’t realise it was tongue-in-cheek, it probably wouldn’t bother me, partly because I understand how writing “competitively” works (ironically, from around the same time), partly because I’ve developed a thick skin, and partly because, honestly, I’ve kindda given up on it, so I don’t care about it as much as I once did. But I can see why others would not feel the same way at all. You shouldn’t count on your audience having a thick skin or being old enough to have given up on most of their dreams anyway.
I know this is a real struggle because that’s just how blogs and blogging work today. You have to compete for attention to some degree, and this is particularly important when a large part of the technical audience is “confined” to places like HN and lobste.rs, where you have to grab attention through the title because there’s nothing else to grab attention through. But maybe you can find a kinder way to grab it, I dunno, maybe a clever pun? That never hurt anyone. These radical, blunt (supposedly “bluntly honest” but that’s just wishful thinking) headlines are all the rage in “big” Internet media because, just like Internet trolls, they thrive on controversy, us vs. them and a feeling of smugness, but is that really the kind of thing you want to borrow?
(Edit: just to make sure I get the other part of my message across, because I think it’s even more important: title aside, which could be nicer, the article was super bloody amazing: the explanation’s great, and I like the additional pointers, and the humour, and yes, the drawings! Please don’t take any of all that stuff above as a criticism of some sort: I wanted to present a different viewpoint from which the title might read differently than you intended, not that the article is bad. It’s not!)
-
How do you know that you’re punching up?
What if the person encountering your blog is a programmer from an underrepresented background, just barely overcoming imposter syndrome, and now here’s this scary suggestion that they don’t understand hash functions? What if they actually made one of the mistakes in the article, and feel like they’re a complete fraud, and should leave the industry? This is the sort of microaggression/toxicity that everybody talks so much about, if I’m not mistaken.
The point is: you don’t know. You can’t know.
So, err on the side of not adding more negative shit to the world accidentally in the name of pageviews–especially when there are many, many other more positive options in easy reach.
EDIT:
I wouldn’t care if it weren’t for the fact that you’re a smart dude and clearly passionate about your work and that you have good knowledge to share, and that it pains me to see somebody making mistakes I’ve made in the past.
-
I wouldn’t care if it weren’t for the fact that you’re a smart dude and clearly passionate about your work
I’m neither of those things :P
and that you have good knowledge to share, and that it pains me to see somebody making mistakes I’ve made in the past.
I appreciate your compassion on this subject. It’s definitely new territory for me (since forever I’ve been in the “boring headline out of clickbait adversion” territory).
-
Do you actually not see a difference between saying a slightly negative thing about people of a certain profession and how they engage in that profession, and an ad-hominem using sexual orientation? What a weird and bad analogy?
I’m trying to assume good intent here but all your comments make it sound like you’re annoyed at the furry pics and awkwardly trying to use cancel culture to lash out the author.
-
Neither the label of programmers (with which I identify) nor of gay furries (with which the author identifies, according to their writing) is being misapplied. I’m sorry you feel that a plain statement of fact is somehow derogatory–there is nothing wrong with being a proud programmer or a proud gay furry.
My point in giving that example was to critique the used construction of “ is ”. I picked that label because the author identified with it, and I picked the “bad at blogging” because it’s pretty obviously incorrect in its bluntness. If I had picked “lobsters” or “internet randos” the conjured association for the person I was in discussion with may not have had the same impact it that “programmers” had on me, so I went with what seemed reasonable.
-
-
-
-
-
What if the person encountering your blog is a programmer from an underrepresented background, just barely overcoming imposter syndrome, and now here’s this scary suggestion that they don’t understand hash functions?
Or they may read this and think ‘I’m glad it’s not just me!’. As a programmer who probably has a better than average understanding of hash functions, I don’t feel demeaned by this generalisation, if I were worried about my level of understanding I’d feel comforted by the idea that I wasn’t in a minority in my lack of understanding.
What if they actually made one of the mistakes in the article, and feel like they’re a complete fraud, and should leave the industry?
Or they may feel better that this mistake is so common that someone writes about it on a list of mistakes programmers make.
-
-
-
-
My problem with the title isn’t that it’s insulting, but that it’s inaccurate. Clearly some programmers do understand hash functions, even if other programmers do not. If nothing else, @soatok, a programmer, presumably understands hash functions, or why else would he write a blog post purporting to explain the right way to use them?
Programmers don’t understand hash functions, and I can demonstrate this to most of the people that will read this with a single observation:
When you saw the words “hash function” in the title, you might have assumed this was going to be a blog post about password storage.
Specifically is wrong, at least about me, and almost certainly among other programmers as well. I don’t claim to have deep knowledge about cryptography, and I do expect that there’s probably something I could learn from this blog post, which I will read more carefully when I have a chance. But I am aware that the computer science concept of hash functions is useful for a variety of programming problems, and not just storing password-related data.
-
-
I am intrigued by the framing of the Sturm und Drang about the state of the web as being driven, to some significant degree, by politics internal to Google.
-
As I stated earlier this week, promo packets are what’ll do in the web.
I think a lot of developers simply lack the interest in context to process the realpolitik that shapes and distorts the fabric of spacetime for our industry.
If you refuse to understand that Google’s whole business is threatened by adblockers, you probably would be confused at the some of the changes to web extensions webRequest that make that work harder. If you don’t understand the desire to make SEO, crawling, and walled gardens easier AMP probably seemed like a great return to roots.
Other companies do this too, of course. If you didn’t know about OS/2 Warp some of the Windows APIs probably seemed weird. If you don’t know about Facebook trying to own everything you do then the lack of email signup for Oculus probably seems strange. If you invested heavily into XNA you probably got bit when internal shifts at Microsoft killed XNA off. If you don’t know about internal Canonical and RHEL shenanigans, systemd and other things probably are a surprise.
Developers need to pay as much attention to the business dependencies as the technical ones.
-
-
When you’re doing a performance review at Google, you can request a promotion. If you do this, you put together a ‘packet’ including the impactful work you’ve done. New work is rewarded heavily, maintenance less so. For senior engineers, shipping major projects with an industry wide impact is a path to promotion.
-
Which means Google rewards doing something new for the sake of doing something new. It’s tremendously difficult to get promoted by improving older systems. Crucially, you often need to demonstrate impact with metrics. The easiest way to do that is sunset an old system and show the number of users who have migrated to your new system, voluntarily or otherwise.
-
-
-
It is often difficult to pick it apart as it’s rarely a single person or team. What happens in large organizations is that there is a high-level strategy and different tactics spring from that. Then, there are metrics scorecards, often based on a proxy, which support the tactics delivering the strategy. This blurs the picture from the outside and means that rarely one person is to blame, or has singular control over the successes.
I haven’t followed the alert situation very closely, but someone familiar with large organizations can get a good read from the feature blurb. There is a strong hint from the language that they are carrying a metric around security, and possibly one around user experience. This translates to an opportunity for a team to go and fix the issue directed by the metrics since it’s quantifiable. The easiest way to start might be to work back from what moves the metric, but this is a very narrow perspective.
Developers may know what the best things to work on having been a developer in that area for 10 years, but their impact tracks towards those top-level strategies. Management can’t justify promotion because someone else is very focused on metrics that drive the strategy.
In lots of places this is called alignment. Your boss may only support X amount of work on non-aligned projects, if you do at least Y amount of work on Y projects. A classic big company alignment example is a talented person in a support department. If they can fix your biggest problem at the source it’d be best to let them do this. However, metrics incentivize assigning them to solving N support cases per week and other metrics designed for lower-skilled individuals instead of working on fixing root causes. Eventually, they leave unless you have smart management taking calculated risks, manage the metrics at the team level so the team is not noticed working the way it wants, seeking paths for talented people to work on the product, etc.
-
-
-
-
-
-
WHATWG is a consortium of multiple companies so I’m curious why everyone is pointing the finger at Google here, or is the assertion that Google has so much power over the WHATWG and Chrome at this point that there’s no ability for other companies to dissent? (And I mean we all know that the W3C lost and WHATWG won so a consortium of vendors is the web.)
-
The multiple companies are Apple, Google, Microsoft, and Mozilla (https://whatwg.org/sg-agreement#steering-group-member, section 3.1b) Of the three, only Apple develops a browser engine that is not majority funded by Google.
-
I’m pretty sure Apple develops a browser engine that is majority funded by Google: https://www.theverge.com/2020/7/1/21310591/apple-google-search-engine-safari-iphone-deal-billions-regulation-antitrust
-
That’s some pretty weird logic.
The browser engine Apple creates is used for a whole bunch of stuff across their platforms, besides Safari:
Mail, iMessage, Media Store fronts, App Store fronts.. Those last two alone produce revenue about 4x what Google pays Apple to make it the default.
Do I wish they’d get more people using alternatives and pass on the google money? Sure. Is there any realistic chance their ability to fund Safari and/or Webkit would be harmed by not taking the google money? Seems pretty unlikely.
-
-
-
-
-
-
-
-
-
WHATWG was run at inception by a Googler and was created to give Google even more power over the standards process than the hopelessly broken W3C already gave them. That they strong armed Mozilla into adding their name or that Apple (who was using the same browser engine at the time) wanted to be able to give feedback to the org doesn’t change the Googlish nature of its existence, IMO
-
-
-
-
-
A lot of people seem to think that standards work is a bit like being in a university - people do it for the love of it and are generally only interested in doing what’s best for all.
In reality it’s a bunch of wealthy stakeholders who realize that they need to work together for everyone’s best - they’re not a monopoly, yet - but in the meantime it behooves them to grab every advantage they can get.
As mentioned in the post, standards work is hard and time-consuming, and if an organisation can assign a dedicated team to work on standards, that work will get implemented.
-
-
-
-
-
Another nice project with an S3 compatible API is seaweedfs (née weedfs): https://github.com/chrislusf/seaweedfs, inspired by the haystack paper (from FB, when FB had around 1-2K photo uploads per second); we use it in production (albeit not in distributed mode). A lightning talk I did a few month ago: https://github.com/miku/haystack
-
if you do not mind, a question – did you find any solutions that are based on JDK 11+ (Java/clojure/scala, etc) – I am looking for a file store open source lib, but I would like it to be compatible with a JVM ecosystem.
-
-
-
-
Thank you for the follow-ups. I would like the whole service to be packageable and accessible as a JAR that I can incorporate in our ‘uber’ JAR.
The backend I am working on, has one of its ‘features’ – a simple deployment. In the translation, it means a single-jar + PostgresSQL.
The single-jar within it, has about 20 ‘micro-services’, essentially. So a user can start one up just one jar and have everything in ‘one host’ or start the jar with config params telling the JAR which microservices to start on which host. That configuration file is like a ‘static’ service orchestrator. It is the same for all the hosts, but there are sections for each host in the deployment.
One of the microservices (or easier to call them just services) I am going to be enhancing is a ‘content server’. Today the content service basically needs a ‘backend-accessible-directory’.
That service does all the others things: administering the content, acting as IAM Policy Enforcement Point, caching content in a memory-mapped db (if a particular content is determined to be needed ‘often’), a non-trivial hierarchical directory management to ensure that too many files do not end up in ‘one folder’, and so on.
I need to support features where files are in a ‘remote content server’ (rather then in a locally accessible directory). Where the content server is an S3 (or some other standard compatible system) So I would like the ‘content server’ to be included as a 21st service in that single JAR.
Which is why, I am not just looking for a client, but for the actual server – to be compatible with JVMs. Hope the explanation gives more color to the question I asked.
With regards to other comment where folks mention that some organizations like banks – prefer a JVM only code. That’s true to a degree, it is a preference, not an absolute requirement though.
That’s because some of these organizations have built by themselves ‘pre-docker’ deployment infrastructures. Where it is easy to request a ‘production capacity’ as long as the deployed backend is a JAR (because those deployment infrastructures are basically JVM clusters that support migrations, software defined networks, load balancing, password vaults, monitoring, etc)
So when a vendor (or even internal team) comes in and says: for our solution we run on docker, it is OK, but they have invested millions… and now want to continue to get benefits (internal payment basically) for their self-build infrastructure management tools … Which is why there is a preference for JVM-only solutions and, perhaps, will be for some time.
And to be honest, JVM (and JVM based languages) and their tools ecosystem continues to evolve (security, code analysis, performance, etc) — it seems that the decisions back then about investing into managed infrastructure around JVM – were good decisions.
-
-
-
-
Oh, also: whatever approach you choose, you are going to also need to provide an ergonomic, performant animation API.
This is where I died inside. Just no. Animations are one of the most despicable developments of recent UIs. I don’t want to keep either waiting for the computer to do its trivial jobs, or distract me in general altogether. Want to make your phone faster? Disable animations!
You need to support emoji.
Also no, this is a largely pointless complication.
Async You do have nice ergonomic async support, don’t you?
What does this even mean? Win32/X11/Qt/GTK+ are all async by their sheer nature.
He’s describing an opinionated, everything-but-the-kitchen-sink approach. But a decent overview nonetheless.
-
Complaints about animations an emoji sound very much like “old man yells at cloud”.
Emoji (and generally Unicode support for more than BMP) is now an expected feature of modern software.
UI animations can be done well and be helpful, and hint how UI items relate to each other spatially. It’s really weird that even low-end mobile devices have GPUs that can effortlessly animate millions of 3D triangles, but sliding a menu is considered a big effort.
-
I’ve honestly never seen a single helpful UI animation in my life, other than spinning wheels and the likes, indicating that the application/system hasn’t frozen up completely. Instead of “click, click, click, be done”, things tend to shift into “click, have your attention grabbed, click, have your attention grabbed, throw your computer out of the window and go live in the woods”. GNOME Builder and GIMP 3 settings dialogues are spectacular examples of GNOME keeping digging its grave.
One would expect the computer to be a tool, rather than a work of art.
-
Maybe that’s just a failing of GNOME?
For example, macOS has generally well-done animations that don’t get in the way. It tends to animate after an action, but not before. Animations are very quick, unless they’re used to hide loading time. There are also animations to bring your attention to newly created/focused elements. Reordering of elements (menu icons, tabs) is smooth. IMHO they usually add value.
Touchscreen OSes also animate majority of elements that can be swiped or dragged. The animation is not on a fixed timer, but “played” by your finger movements, so you may not think about it as an animation, but technically it is animating positions and sizes of UI elements. Users would think UI is broken if it instantly jumped instead of “sticking” under the finger.
-
Eh, macOS has sort of jumped the gun on animation, too. I’ve activated the “Reduce motion” for it because, by default, the transition between full-screen apps is done by having windows “slide” in and out of view. It’s not just slow (it takes substantially more time to do the transition that in takes to Cmd-Tab between the applications), it legit makes you dizzy if you keep switching back and forth.
I imagine it’s taken verbatim from iPad (last macOS version I used before Big Sur was… Tiger, I think? so I’m not sure…) where it makes some sense, but I can’t for the life of me understand what’s the point of it on a thing that has a keyboard and doesn’t have a touch screen.
-
I can’t for the life of me understand what’s the point of it on a thing that has a keyboard and doesn’t have a touch screen.
Probably because most people will use their MacBook trackpad to swipe between full screen apps/desktops. I only rarely use the Ctrl-arrow shortcuts for that. A lot of macOS decisions make more sense when you assume the use of a trackpad rather than a mouse (which is why I’ve always found it weird they don’t ship a trackpad with iMacs by default)
-
You can still cmd-tab between full-screen applications, which is what a lot of people actually do – a “modern” workplace easily gets you an email client, several Preview windows, a Finder window, and a spreadsheet. Trackpad swiping works great when you have two apps open, not so much when you got a bunch of them.
When you’re on the seventh out of the fifteen invoices you got open, you kindda want to get back to the spreadsheet without seeing seven invoices again.That’s actually a bad example because full-screen windows from the same app are handled very poorly but you get the point: lots of apps, you don’t always want to see all of them before you get to the one you need…
-
-
These animations are helpful, and have been shown to be so. It’s not something some asshole down at Cupertino just cooked up because he thought it would look cool. Cues as to the spatial relations of things (as the desktops have an order and you use left/right gestures to navigate them) are very valuable to a lot of people, and they even let you turn them off, I don’t really see anything worth complaining about.
I mean there’s a lot of questionable things Apple is doing these days, but that’s not one of them.
-
I’m not talking about desktops, but “maximized” applications (i.e. the default, full-screen maximisation you get when you press what used to be the green button).
You get full-screen sliding animations when you Cmd-Tab between apps in this case, even though there’s no spatial relations between them, as the order in which they’re shown in the Cmd-Tab stack has nothing to do with the order in which they’re shown in Mission Control (the former is obviously mutable, since it’s in a stack, the latter is fixed).
In fact, precisely because one’s a stack and the other one isn’t, the visual cue is wrong half the time: you switch to an application to the right of the stack, but the screen slides out to the left.
Animation when transitioning between virtual desktops is a whole other story and yes, it makes every bit of sense there.
and have been shown to be so.
Do you have a study/some data for that? I know of some (I don’t have the papers at hand but I can look it up if you’re curious), but it explicitly expects only occasional use so it doesn’t even attempt to discuss the “what if you use it too much” case. So it’s not even close to applying to the use case of e.g. switching between a spreadsheet and the email client several times a minute.
(Edit: just for the fun of it, I tried to count how often I Cmd-Tab between a terminal window and the reference manual after I ended up ticking the reduce animation box in accessibility options. I didn’t automate it so I gave up after about half an hour, at which point I was already well past 100. Even if this did encode any spatial cues, I think spatial cues are not quite as valuable as not throwing up my guts.)
-
-
-
-
There are many legitimate uses for animations. Yes loading spinners are one of them, unless you think that every single operation can be performed instantly. Sliding and moving elements around on mobile especially is another one. A short animations to reveal new elements after a user action can also improve the UX.
Not everything has to be one extreme or another - it’s not pointless animations everywhere, or no animations at all. When used well they can improve usability.
-
Loading spinners are far from ideal though. A progress bar would be generally better so you have some idea of if it is actually still working and how far is left to go. Or anything else that provides similar information.
I’ve seen so many times when a loading spinner sits there spinning forever because, for example, the wifi disconnected. The animation then is misleading, since it will never complete.
-
That’s an entirely different loading element. You can have animated progress bar. And when progress is indeterminate a spinner makes the most sense. A spinner not stopping on error is a UI bug, not a problem with the concept. If you want to get mad at bad design, how about programming languages and paradigms that don’t make you explicitly handle errors to get in this state.
-
-
The standard way of indicating length is to say so to the user, and possibly add a progress bar, for when progress can be sensibly measured. Like adding a spinner, it needs to be done explicitly. Revealing new elements can be done responsively by improving the design–the standard way is by turning an arrow.
The notion of phones invading GUIs, as x64k hinted at, is interesting here (though not new). Transplanting things that do not belong, just because of familiarity.
Going back to the article, it said I needed to. I don’t. And still, I can make anything I desire with the toolkit, with no real change to the required effort. Except for “modern” IM, when I don’t care to implement pictures as pseudo-characters.
-
-
One would expect the computer to be a tool, rather than a work of art.
The computers I remember most fondly all had some qualities of art in it. Sometimes in the hardware, others in the software, and the ones I like the most had it in both.
Animations are important in devices in which there is mostly visual feedback. Most computers don’t have haptics, and we often get annoyed at audio feedback. Visual cues that an action was performed or that something happened are important. There is a difference between UI animation and a firework explosion in the corner of the app.
-
One would expect the computer to be a tool, rather than a work of art.
You, me, and everybody in this thread is in the top 0.001% of computer power users. What’s important to us is totally different than what’s important to the rest of the population. Most normies I talk to value pleasing UIs. If you want to appeal to them, you’re going to need animations.
-
I’d argue even further that the 0.001% of computer power users also need animations. When done well, animations really effectively convey state changes in a way that speaks to our psychology. A great example is that when I scroll a full page in my web browser, the brief scroll animation shows my brain how where I am now relates to where I was a split second ago. Contrast this to TUIs which scroll by a full page in a single frame. It’s easy to consciously believe that we can do without things like animations, but I’m pretty sure that all the little immediate state changes can add up to a subperceptual bit of cognitive load that nevertheless can be fatiguing.
-
I think good animations are ‘invisible’, but bad ones aren’t. So people remember the bad more than the good.
-
-
-
-
UI animations can be done well
Absolutely. I love the subtle animations in iOS. Like when I long-press on the brightness slider to access more controls like the dark mode toggle. I’m already making an action that takes more time than a simple tap, and the OS responds with a perfectly timed animation to indicate that my action is being processed.
On the other hand, animations can be very easily abused. Plenty of examples, like today’s Grumpy Website post, show animations that hinder accessibility. I think the cases where animation goes wrong are where it was thrown in only because “it’s modern” rather than primarily as a means to convey information.
-
-
I respectfully disagree with your opinion about animations. There are lots of times when I genuinely feel that the animation is important and actually conveys information. For example, the Exposè-style interface in macOS and GNOME is much better since the windows animate from their “physical” locations to their “overview” locations; the animation provides important context about which windows went where, so your eyes get to track the moving objects. It also helps that those animations track your finger movements on the trackpad perfectly, with one pixel of movement per tiny distance travelled across the trackpad (though the animation also has value when triggered using a hotkey IMO).
But there’s definitely a lot of software which over-uses animations. The cardinal sin of a lot of GUI animations is to make the user wait for your flashy effects. A lot of Apple’s and GNOME’s animations do fit this description, as well as arguably most animations in general. So I think a GUI framework needs a robust animation system for when it’s appropriate, but application programmers must show much more discretion about when and how they choose to use animations. For example, I’m currently in Safari on macOS, and when I do the pinch gesture to show an overview of all the tabs, I have to wait far too long for the machine to finish its way too flashy zoom animation until I actually get the information I need in order to interact further.
-
-
-
What does this even mean? Win32/X11/Qt/GTK+ are all async by their sheer nature.
Not really. It is very easy to block the event loop with various other calls (including things like clipboard which like the thing said is async under the hood on X, but qt and gtk don’t present it that way). The gui thing needs to have some way for other operations to hook into the event loop so you can avoid blocking.
Not terribly difficult but still you do need to at least think about it, it isn’t fully automatic. (Even on Windows, where it is heavenly bliss compared to unix, you do still need to call a function in your loop like SleepEx to opt into some additional sync processing.)
-
GTK+ does present clipboard retrieval asynchronously, see https://docs.gtk.org/gtk3/method.Clipboard.request_contents.html which contains a callback argument–that much I remember. Setting clipboard contents can be done blindly, you can have ownership snatched at any moment.
Going the way of recursive event loops requires caution that I would avoid imparting on users as much as possible, in particular because of callbacks vs state hell. Typically, this is reserved for modal dialogues, and the API user knows what they’re dealing with.
There’s also the possibility of processing the event pump selectively, though that’s another thing you don’t want to do to yourself.
-
-
Want to make your phone faster? Disable animations!
This is generally the point of animations as a UX feature - they mask the slow operation of applications with a silly animation to keep you distracted/indicate a process is occurring. Want to notice when your app is using a jpeg to pretend it’s loaded? Disable animations!
-
It’s not only that. The human visual system is very good at tracking movement, much worse at noting that a thing has disappeared and reappeared. If a thing disappears, you’ll typically notice quickly but not immediately be aware of what has disappeared. If you animate movement then there’s lower cognitive load because a part of your brain that evolved to track prey / predators is used rather than anything related to understanding the context of the application.
-
This is it exactly. The human visual system evolved in a world where things don’t instantly flicker out of existence or appear out of nothing.
-
-
I don’t think OP is talking about things like progress bars and spinning indicators, which are pretty legitimate everywhere, but things like “gliding” page transitions between application screens. If a framework is indeed so slow that you notice it rendering widgets, an animation API will help now and then, but won’t make that big a dent. (Edit: also, unless you’re loading things off a network, loading JPEGs cannot be a problem anymore, it hasn’t been a problem in twenty years!)
I do think this piece could’ve been more aptly titled “so you want to write a GUI framework for smartphones”. Animations are important on touch screen driven by gestures (e.g. swiping) – gestures are failure-prone, they need incremental feedback and so on, plus nobody who’s not high on their 2013-era post-PC supply expects efficiency out of phone UIs.
But they are pretty cringy on desktop. E.g. KDE’s Control Center (and many Kirigami apps) has an annoying misfeature, where you click “back” and the page moves out of view as if you’d swiped it. But you didn’t swipe. Regardless of what you think about animation, it’s not even the right animation.
That’s why so many people see them as useless eye candy. If you go all Borg on it and only think in absolute terms, you get a very Borg user experience.
Edit: yes, I know, “a modern GUI toolkit” should have all these things. The point is you can drop a lot of them and still write useful and efficient applications. Just because Google is doing something on Android doesn’t mean everyone has to do it everywhere.
-
It’s funny you mention page transitions. I have my ebook reader set up to do a 200ms-ish animation when I tap the ‘next page’ button where the current page slides off to the left and the next one slides in from the right. It has an option to disable it, but I actually find that disorienting in this vague way I can’t explain. But on my desktop, it’s fine with no animations.
-
-
Empirically, that is not how it’s used. This masking is a minority of use cases, and even then it’s bad. To some people that aren’t me, it might be better described as “eye candy” and “smoothness”.
Being able to disable this irritation is being lucky, e.g. it’s CSS-hardcoded in Firefox and GTK+ (/org/gnome/desktop/interface/enable-animations only works partially).
-
-
What does this even mean? Win32/X11/Qt/GTK+ are all async by their sheer nature.
I think they’re talking about Rust async, since this is all in the context of writing a cross-platform GUI toolkit in Rust. This is more of a problem than it seems because if you’re doing a cross-platform toolkit that uses native widgets, it’s not at all trivial to impedance-match whatever model the native widget toolkit uses behind the scenes with your toolkit, which exposes an async model.
(Edit: there are some additional complications here, too. For example there are toolkits that (generally) async, but still do some operations synchronously. The author mentions the copy-paste API as an example.)
One might conclude that it’s better to not do any of that and instead expose the platform’s intended programming model, as second-guessing thirty year-old code bases tends to backfire spectacularly, but maybe I’m just being grumpy here…
-
-
This basically boils down to good programming and clarifying interface boundaries. Prefer naming things over sprinkling anonymous functions around. The react hooks used in the examples provide no benefit and actually slow the code down.
-
I consider myself somewhat of an outsider to the Racket community, but I was invited to be a speaker at RacketCon 2019. I fondly remember nearly everyone being friendly and accepting, with the exception of Felleisen. There were several discussions about how to make the community more inclusive, but he was dismissive these efforts and kept saying everything’s fine as it is.
-
Just weighing in that I was also at that conference and can confirm.
Also, shortly after, on the Racket mailing list there was a thread about a very different topic (syntax stuff which had been discussed at RacketCon) and I only barely mentioned the word “diversity” in passing but that was enough to seemingly make Matthias upset. I still don’t understand that response… I found it very disturbing, and still do.
Racket is a really amazing community in general with an incredible ecosystem around it. I have also had some pleasant conversations one on one with Matthias; I also respect his contributions to CS (particularly in terms of the work on delimited continuations). However, I know it hasn’t been easy for everyone around him, especially some of his students. I wish that weren’t true… for his students’ sake, for the Racket community’s sake (which again, has otherwise been very wonderful in my experience), and even for Matthias’s sake.
-
-
Also as an outsider - you should read some of the stuff on his personal site. I’ve read a bit, and it looks like he’s a run of the mill US Conservative, bristling at a lack of political and philosophical diversity in big tech.
I think his politics are orthogonal to his behaviour towards Butterick, for which he has apologised.
Worth noting too that the apology seems genuine, and isn’t crouched in “I’m sorry if you took it that way” weasel words.
-
Worth noting, sure, it’s good he apologized. I also note this only happened as a result of a pretty widely circulated blog post. A lot of other people reported the same thing about his behaviour, but they don’t get an apology.
-
Okay, so let’s see if anything changes.
Anecdata for sure, but I’ve seen people in tech leadership make very big, worthwhile changes in their approach to people after receiving feedback like this.
Surely a great outcome here would be a public apology to the public complaint, and a genuine change of behaviour?
It’s way too soon to write that off as a very real possibility.
-
While I’m not holding my breath, I very much wish that would happen.
-
-
-
While there are assholes of all political persuasions there does seem, anecdotally, to be a set of people whose toxic personalities mesh with certain parts of US conservative culture. There’s a focus on the individual rather than the group that has value in many contexts but can be harmful in open source projects.
-
Well, sure, but again that’s completely irrelevant to the conversation at hand.
I might as well observe that, anecdotally, I’ve seen more of the “virtue-signalling purity-testing schism creator” asshole type in US liberal circles.
Also true, also not true of the vast majority of liberals, and also irrelevant to the topic.
-
I know we’re way off on a tangent here, and so in terms of the broader conversation about the racket community and dealing with leaders i mostly agree with you that in this specific instances of bullying described in the blog post, Felleisen’s politics aren’t terribly relevant. But in terms of the anecdote @paroneayea raised, Felleisen’s politics are in scope since he explicitly chose to transform “diversity” into “politics” and then reject politics as off topic… which is a pretty impressive 180 from free-speech trolling his students by posting James Damore’s memo on his office door.
-
-
-
-
-
-
-
-
Lobsters isn’t write-only. Submit other stuff, too, or comment on other people’s submissions.
EDIT: wait a sec, this article is from March. You’ve published ten things since then, and your Lobsters submissions are just in reverse chronological order. Are you just posting your entire archives to Lobsters? Is this just a inbound channel?
EDIT2: From your homepage:
I give you the strategy, technology, and skills to become a trusted brand […] Marketing gurus are a dime a dozen. My approach is different – think of me as a sparring partner who will sharpen your skills and plan your attack. We’ll work together to create a cohesive strategy, technology and tools that inspire long-term connections and fuel sustainable growth. It’s about trust. It’s about reputation. It’s about telling your story in a way that gets results.
-
Lobsters isn’t write-only. Submit other stuff, too, or comment on other people’s submissions.
I don’t understand: why can’t a user submit their own content exclusively, as long as the submissions are of high quality? From my perspective, well-received self-marketing materials are still a contribution to the community, even if the author themself may benefit from the submission.
-
-
Good question. From Mitigating Content Marketing:
We now consistently average over 20k visitors per weekday. Programming is an enormous, growing, lucrative, powerful industry and thus a very expensive demographic to advertise to. A link on our homepage sends traffic that would otherwise cost $15-30k on Twitter, AdWords, or LinkedIn.
When this is sending attention to celebrate someone advancing the state of our understanding or sharing what they’ve created, it’s the internet at its best as gift economy. Unfortunately, some people see the site as a handful of rubes naively standing around a money fountain, so why not try to take a taste?
People who are only submitting their own content exclusively are overwhelmingly (not entirely, but overwhelmingly) bad-faith actors who are just using us for free advertising. People who are commenting or submitting other stuff are at least making an effort to participate in the rest of the community.
I’m being a bit harsher with this comment, because I was more polite with my comment on his previous story:
Welcome to lobsters! Generally we encourage people to post and comment on articles they haven’t written, too, to participate more in the community.
So either he’s not reading comments, which means he’s just spamming, or he read my comment and doesn’t care, in which case he’s bad-faith.
-
Hey, I am verry sorry that my actions were seen as spammy behaviour, that was not my intention at all. I’ve been reading the philosophy section of lobsters for years and just wanted to contribute a few ideas myself.
I’ll try to submit some other interesting links as well in the future and try to be more active with the comments.
Thanks
-
People who are only submitting their own content exclusively are overwhelmingly (not entirely, but overwhelmingly) bad-faith actors who are just using us for free advertising.
Sure, but let’s not confuse heuristics with what those heuristics are trying to detect. This particular case feels suspect to me, since the site features a few CTAs for paid services. But I think it’s important to point out that it’s not inherently a bad faith action to only post articles to your own blog. The issue is when the content is trying to make a sale. There’s clearly grey area between “good faith posting of excellent content that only I have written” and “posting on your forum in order to sell you something”. And since we can’t read minds, I think that:
Submit other stuff, too, or comment on other people’s submissions.
…demanding engagement from someone like this seems unnecessarily hostile, setting a negative tone for newcomers. Why not just flag as spam, provide the feedback, and then let the mods take action if needed? For example, “you seem to only be posting links to your blog which is also trying to sell me services. this isn’t a place for content marketing, and people get banned for it pretty regularly. check out this post for background”
-
For example, “you seem to only be posting links to your blog which is also trying to sell me services. this isn’t a place for content marketing, and people get banned for it pretty regularly. check out this post for background”
Man, that’s much better copy. Strikes the right balance of polite without being too “nice”. Gonna use that instead from now on
-
-
-
-
‘so much code, so many services & engineers. twitter is over-engineered and I could do better’
There is definitely an aspect of Dunning-Kruger to some of the complaints, primarily driven by a lack of understanding of the sheer scale of Twitter, it’s backend (Twitter wasn’t all GCP (mostly analytics data) but largely, especially on the frontend, on-premises data centre hardware) and all of the analytics tools, machine learning crap, axillary code and such that comes with it. Anyone can write a lookalike Twitter frontend, backend given enough time. At the scale of actual Twitter comes a lot of hidden work.