1. 4

    While I agree with the premise, I take issue with the proposed solution of practicing puzzle exercises. The problem space is agreed “Sav-Mart needs the ‘repeat previous order’ button on their B2B site by next Tuesday.”

    You can do day-to-day work without ever really understanding a deficiency because a lot of the gaps don’t show up immediately. They show up when you need to modify or debug your code in a year, and without external feedback you may never understand that your class might have been better if you’d structured it differently. It’s entirely possible to continue to get paid, year after year, for sub-par work.

    So what they are saying here is that specifically modifying or fixing code a year later (maintenance) is where deficiencies show up. Then the left turn i.e. puzzle exercises help with that. I don’t agree at all with this. At best, puzzle exercises are fun for some (not me) and make you excel at puzzle exercises. At worst you propagate puzzle exercise type programming into problem spaces that don’t warrant that and increase the difficulty of maintenance.

    1. 2

      I don’t usually comment on my own posts, but I did want to say that exercises are one part of the proposed solution. Reading and review are also part of it. Doing an exercise can help teach you about new data structures, algorithms, and entire approaches to problems. It’s one aspect of an overall approach.

    1. 2

      Had a tooth pulled Tuesday and have been compliant with doc’s instructions of no exercise and soft foods until comfortable chewing on one side of mouth. This weekend I’m eating good food slowly and going for an easy bike ride!

      1. 12

        I’m already disappointed with the level of technical discussion here, for some topics.

        I find it very hypocritical how Google, Microsoft, and Apple, to name three, are given passes on their behaviour so often by some types, but Palantir is a uniquely bad company by helping the government to enforce its immigration laws.

        Google apparently commits more spying than the NSA and is completely unaccountable, but many here use Google services, products, and excuse its behavior. Apple is supposedly one of the good companies because it hasn’t yet decided to switch over to a grotesque level of surveillance as the others have, but is terrible for the environment with its wasteful and purposefully broken hardware.

        Microsoft is unique in that it’s recently pretending to be good and this is commonly used to excuse its behaviour and lack of trust. The 90’s Microsoft is in the past is simply not true.

        Now, I understand that some of you are probably going to point out the age of my account or argue that just because other companies are immoral doesn’t mean one company can’t be singled out. I’m not defending Palantir and I understand that it’s frustrating to have a cause taken by this kind of questioning, but I can’t help but find it hypocritical that, so long as a company espouses certain political views, that somehow makes similar behaviour acceptable.

        I could go on and on, but I won’t.

        1. 7

          I find it very hypocritical how Google, Microsoft, and Apple, to name three, are given passes on their behaviour so often by some types

          I called them out for that specifically in the thread on the Never Again Pledge thread. Google and Facebook particularly were building the kind of profiles on people and databases that a rogue, minority/freedom-hating regime would dream of and find plenty of damaging use for. The NSA was vacuuming up all their stuff at the datacenter connections, too, per Snowden leaks. The Trump Administration must be assumed to have that data with hopefully sharing limitations reducing flow of info to FBI, DHS, and ICE. Some firms were cooperating in secret for mega money and/or due to secret orders with huge penalties for non-compliance. Google has been getting more people in Washington DC. Microsoft and Apple are big on patent suing innovative companies to prevent competition. Microsoft even sells out paying users with ads and privacy invasions. Most of the big firms also had a no-poaching agreement that intentionally suppressed the wages and benefits of those working for them.

          Yet, you don’t see a call out like yesterday’s on every thread involving people working at those firms or contributing to their code bases. Double standards like that motivated some of my counters. I hate double standards. As some on my side said, there’s actually quite a lot of jobs in IT any of these people could aim for which are either inconsequential in society or do fairly good things. On a daily basis, I use a lot of tech to do stuff that mostly benefits society. Someone built it and maintains it. It’s not “Surveillance, Patent/Copyright-trolling, Total Lock-in, or Unemployed” they’re choosing from in between supporting calls for Palantir people to quit their jobs. Maybe the money, perks, and fun work are more important. Some also say they can do good from within but make an exception for firms like Palantir where their employees are assumed evil/damaging no matter what. I just can’t help but notice certain, evil companies are favored and apologized for while others are shamed.

          Note: We do have people trashing Microsoft and Google in threads on stuff like privacy/security, corrupt practices, law, unionization, and so on. More importantly, we have people like the F-Droid thread giving us alternatives. Good for them. :)

          1. 5

            Double standards like that motivated some of my counters. I hate double standards.

            Some also say they can do good from within but make an exception for firms like Palantir where their employees are assumed evil/damaging no matter what. I just can’t help but notice certain, evil companies are favored and apologized for while others are shamed.

            I’m with you on this point about hypocrisy / double-standards. In that thing I posted on the Conjure thread, I was trying to point that out by mentioning some really cool software I use (SQLite and OpenBSD) that has been funded by the US military. We could add Lisp to that list. Theo de Raadt reflections on this: “I try to convince myself that our grant means a half of a cruise missile doesn’t get built.”

            I didn’t intend to derail the technical discussion, and I wasn’t expecting the following discussion to be so polarised. Thank you for your nuanced replies here in those threads.

            Regarding hypocrisy in general: I’m thinking it may perhaps be better to be hypocrite than nihilist (Not that those two are the only possible choices!), the reasoning being that it is better to act against one harmful issue and fail to act on others than not to act at all..?

            1. 1

              “I didn’t intend to derail the technical discussion”

              I know. I mentally made an exception for you after having a civil conversation with you. You’re doing the political actions I’d rather not be done here. Your follow-ups showed you were a reflective person who was about real discussion than the more common folks that only want to push a belief. That was interesting.

              “Regarding hypocrisy in general: I’m thinking it may perhaps be better to be hypocrite than nihilist “

              Better to just not be a hypocrite. ;)

              The real hypocrisy, which I retract in your case, is that the leftist activists on this forum keep calling out specific harms while participating in companies and/or behaving in a such a way that does similar harms. You turned out to be one of rare ones who is actually an activist trying to reduce a specific type of harm that’s close to home, something you do in real life, and with your comment being an extension of what you were already doing.

              So, not hypocritical so far: just something I’d rather not be on a technically-focused forum. :)

          2. 1

            Its very difficult for most to disassociate from Google, Amazon, Microsoft, Apple or Facebook. Its very easy to disassociate one’s self from Palantir since they don’t offer a service for most consumers.

          1. 1

            Venkat Subramaniam. I love his upbeat nature and raw excitement for Java. Got me really interested in practicing with Streams API. Bret Victor as others have mentioned.

            1. 1

              The question of ethics or morals seems to come up occasionally. The smog-gate issue, self driving cars killing people, etc. I’m a programmer so I feel both sides of this issue e.g. While my animal brain wants blood for the programmers that wrote the code for these things, my thoughtful brain would never want to be blamed for something “out of my control.” The banality of evil by Hannah Arendt is a good read, it talks about how normal people do terrible terrible things. While I think you can point to high profile individuals like Uncle Bob, Bret Victor, etc. that would have the luxury of authority and context to be “ethical.” I think your general run of the mill programmer would not. Also this ethical conundrum is not isolated to programming. Other fields that seem to have issues are Medical and Financial off the top of my head.

              At a prior job many years ago, I was shocked at the terrible practices used to “secure” a password. It was some home-grown pseudo hash that was just terrible and trivial to break. After I had updated that code to use industry standard techniques, a request came in from LEO to crack the password of a device used in a case for a drug dealer (drugs are bad, mmmmkay). I happily cracked the password and got a letter of thanks. I was young. Today I would probably refuse on moral grounds but I wonder, given the same situation of negligently bad password securing practices, what I would do.

              1. 3

                “Margin Call” in an underrated film that delas oh-so-briefly, but, speaking from experience, meaningfully and realistically, on issues of ethics and morality, as seen through the lens of the (corporate side) of the Very Large Financial Institution, and is well worth a watch.

                1. 1

                  I’ve seen that one actually, it’s really good! I also really liked a similar German documentary about the ethics behind modern investment banking from the perspective of someone who worked at Deutsche Bank.

              1. 1

                I think one of the reasons people always give simplistic examples of tests is that testing is very difficult to do right. At least as difficult as coding and maybe more so. I have never seen any value to unit testing and it objectively halves (or more) velocity and doubles (or more) the code to maintain. I do feel there is significant value in code review (properly done its the reviewee that finds the bugs not the reviewers), Testing In Production methodologies, Fuzz testing, and BADD

                1. 1

                  I think one of the reasons people always give simplistic examples of tests is that testing is very difficult to do right.

                  While I use testing as my example example, my argument applies to instructive examples in general. See using addition as an example of how Functional Programming is Better.

                  I do feel there is significant value in code review (properly done its the reviewee that finds the bugs not the reviewers), Testing In Production methodologies, Fuzz testing, and BADD

                  While I think unit testing is very useful, I agree that other testing techniques are way underused. I’ve written about oracles before, which is pretty similar to BADD.

                1. 6

                  I had to take my Mac Book into Apple to get the video card repaired. I was so paranoid that someone would look at /copy my HDD (proprietary software and private keys) that I took it out and replaced it with a blank drive. With the new Mac’s the HDD is not removable so aside from the other downsides, no tech is ever going to get something with my private keys on it. My porn is pretty vanilla so I’m not that worried about it, but my keys cause me far more anxiety if any rogue tech got a copy.

                  1. 2

                    no tech is ever going to get something with my private keys on it

                    Full disk encryption?

                    Since you can lose your laptop on the train and someone could use it for identity theft, there is no excuse not to use FDE.

                    1. 4

                      I do use FDE, still not going to open up my HDD to a tech and give it to them.

                  1. 4

                    The thing is, figuring out all the exceptions is not free. And often the exceptional cases are rare enough that the benefit is minimal.

                    unit tests aren’t very helpful in testing a cryptographically secure random number generator.

                    Bollocks. That’s a perfect use case for them.

                    unless you can write a unit test to determine awesomeness.

                    Is that supposed to be hard?

                    1. 4

                      What would a “unit test” for a cryptographically secure random number generator look like? IIRC you run a battery of statistical tests against A LOT of data from the RNG to get a probability that the RNG is good e.g. https://en.wikipedia.org/wiki/Diehard_tests

                      1. 4

                        In my eyes the point of unit testing is a low effort method to catch obvious failures. If you’re only looking for obvious failures in an RNG you don’t need to do huge amounts of work.

                        ITHare has a good article on RNG, and briefly discusses testing.

                      2. 4

                        Bollocks. That’s a perfect use case for them.

                        I see it as not a good use case for them as the length of time you’d have to run it to actually get red/green results is astronomical. What makes you feel so strongly it’s a good case for them?

                        1. 3

                          Don’t forget these are typically pseudo-random number generators.

                          ie. Given a particular seed, you always get exactly the same sequence of bits out of them.

                          Suddenly that makes it really obvious how you could do some tests…

                          Also there are typically several substeps and data structures involved, all of which are very amenable to unit testing.

                          Or let’s consider the traditional “hard” variety.

                          A hardware random number generator.

                          No unit tests for that eh?

                          Here is reference for one of them…. https://software.intel.com/sites/default/files/managed/4d/91/DRNG_Software_Implementation_Guide_2.0.pdf

                          Quite a bit of code in there.

                          How do you unit test it?

                          Well, you create a shim that allows you mock the machine code instructions that actually touch the hardware.

                          And then you control the mock to return every interesting value, or status return and verify your code can handle it.

                          Often your driver has to enable certain lines, and initialize and configure the hardware. Does it?

                          Often it has to load / store certain memory addresses, or use specific instructions? Does it?

                          Sometimes it is suppose reseed after every N pseudo random bits…. Does it?

                          1. 1

                            Well that’s not true at all. There are a ton of statistical tests for judging random number generators, none of which require an “astronomical” amount of time.

                            I personally don’t think that kind of test belongs in a unit test suite, though.

                          2. 1
                          1. 3

                            What did “Can anyone say OpenSSL?” have to do with anything? I was with Zed until that point. Are people glassy eyed about OpenSSL? AFAICT there are forks and other attempts at cleaning things up, and a lot of eyes are on it. But my concern even with Heartbleed is that “with enough eyes all bugs are shallow” doesn’t apply with crypto/SSL/TLS because it takes a very special kind of eyes to do that stuff. Hindsight is always 20/20 but at the end of the day we are all human (I think).

                            That comment seemed out of left field. Can anyone explain?

                            1. 5

                              OpenSSL is usually considered an example of under-designed software where people keep adding layers upon layers of cruft instead of refactoring bad foundations or rethinking strategies that have obviously spiralled out of control.

                            1. 3

                              This sounds a lot like Baseline Acceptance Driven Testing/Development

                              https://medium.com/@tinganho/baseline-acceptance-driven-development-f39f7010a04#.8fqlj5ykh

                              1. 2

                                The implementation also leaves a lot to be desired, as it’s left up to the whims of the site owner to decide what password strength means. One site’s “good” is another site’s “get outta here with that Fisher-Price toy password”. It’s frustrating.

                                So, with Discourse, rather than all that, I decided we’d default on a solid absolute minimum password length of 8 characters, and then verify the password to make sure it is not one of the 10,000 most common known passwords by checking its hash.

                                How is that not equally the whim of the site owner?

                                1. 2

                                  Fewer arbitrary constraints. There’s a very good reason for both constraints listed here (min 8 chars and blacklist of common passwords).

                                1. 4

                                  I FINALLY deployed my reporting application (yay me), am working on getting some packaged stuff up on debian, and learned why my current resume is so devops heavy and why I can’t answer algorithm questions in interviews.

                                  The basics of why the deployment is such a big deal is that I’m so fast with development that stuff piles up. Devops is not my strong suit so it takes longer. I have to research what to do, how to do it, then do it. With development its just a tiny bit of how, then just do it.

                                  I also found a bug that made me feel the same way I feel when faced with algorithm questions in interviews. But this was my bug and I wanted to fix it (unlike interview questions). So the way I approached it was with inputs and tons of trial and error with working code and working tests. I finally got it down. Originally the tests had to be slowed way down to compensate for the bug. Now that its “fixed” its so fast that the testing knocks the server over before knocking the application over.

                                  1. 3

                                    Aside from the lacking of credibility as posted http://blog.easydns.org/2016/02/22/the-us-government-has-no-credibility-to-compel-anybody-to-weaken-security/. There is absolutely no indication that the FBI or any other TLA government institution is either capable or willing to use the information they are collecting to “protect the American public.” With all the data they ARE collecting they are doing a piss poor job of anything. No matter what happens with that phone, those 14 dead are not coming back.

                                    1. 8

                                      There was a study done recently that seemed to indicate that DT languages had more errors statistically than ST languages.

                                      http://www.computerworld.com.pt/media/2014/11/lang_study.pdf

                                      From the conclusion:

                                      The data indicates functional languages are better than procedural languages; it suggests that strong typing is better than weak typing; that static typing is better than dynamic; and that managed memory usage is better than un- managed. Further, that the defect proneness of languages in general is not associated with software domains. Also, languages are more related to individual bug categories than bugs overall.

                                      1. 37

                                        I admit to submitting this primarily because my immediate reaction to it was disbelief and annoyance. That probably means that it’s a good discussion topic, right?

                                        Let’s break it down:

                                        I will not produce harmful code.

                                        “Harmful code” is not always obvious when you write it. If you’re working in a legacy system, you can produce “harmful code” purely by accident.

                                        The code that I produce will always be my best work.

                                        Likewise, impossible. If you’re working on a team with a legacy system, and you have deadlines, you have to do what you have to do in order to get things out: removing side effects and refactoring a vast, sprawling class in decade-old core logic is not usually an option.

                                        I will produce, with each release, a quick, sure, and repeatable proof that every element of the code works as it should…

                                        Er, no you won’t. Tests are not proofs.

                                        I will make frequent, small, releases so that I do not impede the progress of others.

                                        Yes, very important–unless you’re doing a refactor or library upgrade that requires a big-bang release.

                                        I will fearlessly and relentlessly improve the code at every opportunity. I will never make the code worse.

                                        Deadlines again: if you are working against a short deadline, and must deliver a feature, it is definitely possible to make the code worse while meeting business goals.

                                        I will do all that I can to keep the productivity of myself, and others, as high as possible. I will do nothing that decreases that productivity.

                                        Short term or long term? How does this jive with the previous rules?

                                        I will continuously ensure that others can cover for me, and that I can cover for them.

                                        Not really sure how this one pertains to programming: assignments and hiring are not usually in my power, so I can’t control whether there is someone who has the time to learn my organizational knowledge.

                                        I will produce estimates that are honest both in magnitude and precision. I will not make promises without certainty.

                                        This is impossible. There are entire disciplines of estimation. Vast arrays of books. None of them work.

                                        I will never stop learning and improving my craft.

                                        Finally, something valid! This is the most important and powerful rule, and the only one that is not tangled up in business dependencies or otherwise outside our control as developers.

                                        1. 11

                                          I will make frequent, small, releases so that I do not impede the progress of others. Yes, very important–unless you’re doing a refactor or library upgrade that requires a big-bang release.

                                          This assumes people are impeded by the frequency of releases. Often times I’m impeded by people releasing often with backwards breaking changes, which make more work for me. I think people should be a lot more thoughtful about releases, rather than just quick about them.

                                          But yeah, I agree with you. This “Oath” is total bullshit. As you point out, a lot of these things are “well, it depends”. If you look at the ASCE Code of Ethics, I think it captures reality much better. It’s about trying to do the best in the situation you are in and acting like a professional.

                                          http://www.asce.org/code-of-ethics/

                                          Consider this one:

                                          Engineers shall build their professional reputation on the merit of their services and shall not compete unfairly with others.

                                          Compared to the author’s:

                                          I will produce estimates that are honest both in magnitude and precision. I will not make promises without certainty.

                                          One is about trying to perform your best and treating those around you well. The author’s is about trying to find some objective way to act. I think the world is too fuzzy for this Programmer’s Oath.

                                          1. 11

                                            I admit to submitting this primarily because my immediate reaction to it was disbelief and annoyance.

                                            That is Uncle Bob’s chief export, yes. Frankly I find unpacking his delivery to find the valuable advice carefully hidden within to be net-negative effort for value.

                                            1. 4

                                              I will produce, with each release, a quick, sure, and repeatable proof that every element of the code works as it should…

                                              Er, no you won’t. Tests are not proofs.

                                              An interesting topic. Unit tests typically prove things about particular inhabitants of a type, but not for all inhabitants.

                                              assert(add(2, 3) == 5)
                                              

                                              If this test passes (and add is pure), it proves that add returns 5, given 2 and 3, but it doesn’t prove that add always returns the sum, for all numbers.

                                              1. 2

                                                Unit tests typically prove things about particular inhabitants of a type, but not for all inhabitants.

                                                It gets even worse. As functions don’t necessarily need to be pure, add(2, 3) might be 5 on the first three calls and something else on the following. Or do some time based calculation, so it only proves that at the time of execution the assertion holds.

                                              2. 3

                                                Not really sure how this one pertains to programming: assignments and hiring are not usually in my power, so I can’t control whether there is someone who has the time to learn my organizational knowledge.

                                                Coming a bit more from the Sysadmin side of the house, I see no problem with this as a goal. On an ongoing basis you should ensure that what you have basic documentation, and if possible that someone other than you has used each system and has a rough understanding of how it fits.

                                                Perfection is unlikely here, but in my previous job it only took me 20 minutes to handover as almost everything was already either documented or in configuration management.

                                                1. 3

                                                  Completely agree! As a goal, it’s a good one. However, the place where the action can really be taken here is at the organizational level. If your organization has everyone working separately on Deep Magic projects, or doesn’t hire enough good developers to keep the average talent up in the face of attrition, all you can do is document your work and hope someone cares enough to read it.

                                                  That’s not how the post is framed, though: it’s “The Programmer’s Oath,” not “The Software Development Firm’s Oath.”

                                                2. 3

                                                  I will not produce harmful code.

                                                  “Harmful code” is not always obvious when you write it. If you’re working in a legacy system, you can produce “harmful code” purely by accident.

                                                  Certainly, but by this logic the Hippocratic Oath doesn’t make sense for doctors either, since doctors can do harm accidentally. Professional oaths like these are understood to include an implicit “to the best of my knowledge and abilities.”

                                                  The code that I produce will always be my best work.

                                                  Likewise, impossible. If you’re working on a team with a legacy system, and you have deadlines, you have to do what you have to do in order to get things out

                                                  Depending on the constraints you’re operating under, “getting things out” may actually be your “best work.”

                                                  I will produce, with each release, a quick, sure, and repeatable proof that every element of the code works as it should…

                                                  Er, no you won’t. Tests are not proofs.

                                                  Not in the modern mathematical sense of proofs, but in the more general English usage of “evidence or argument establishing or helping to establish a fact or the truth of a statement,” it certainly is.

                                                  I will produce estimates that are honest both in magnitude and precision. I will not make promises without certainty.

                                                  This is impossible. There are entire disciplines of estimation. Vast arrays of books. None of them work.

                                                  That has not been my experience. I’ve found estimates produced by a mature team of senior developers to be pretty reliable. But “honest” doesn’t mean perfectly accurate, and if you can’t promise without certainty, then just don’t promise.

                                                  You’ll have noted by now that most of my responses have something in common. Namely, you seem to be reading each of these points in the most literal and restrictive way possible. But unlike code, human language typically doesn’t work like that.

                                                  1. 6

                                                    “…you seem to be reading each of these points in the most literal and restrictive way possible…”

                                                    This is positioned as an Oath. That is, one of the strongest affirmations and most binding contracts that we have. Lying under oath is a crime; breaking a legal contract is not. As such, oaths should be read literally and restrictively. The idea that we should take an oath to take actions over which we have no control is ludicrous–but that’s how the goals are presented.

                                                    1. 1

                                                      Then you would of course agree that anyone who has taken the courtroom oath to “tell the truth, the whole truth, and nothing but the truth” is obligated from that day forward to never use hyperbole, tell a story that didn’t actually happen, etc. Because after all, the oath didn’t specify that it applied only to the courtroom, therefore it literally applies at all times. And it didn’t make exception for tales that everyone understands to be fictional, therefore it literally excludes all parables and fictions.

                                                      Well established legal oaths don’t stand up to the sort of ultra-literalism that you seem to be proposing.

                                                      To be clear, though, I do think Uncle Bob’s proposed oath would benefit from a rewrite. I just don’t think that the reading you’re giving it is a fair one.

                                                      1. 10

                                                        If you’re going to play the “english is up to interpretation” card, I’m not sure you can tell someone their intepretation is fair or not.

                                                        1. 2

                                                          Hmm. That is actually the opposite of what I’m saying. My point is that Uncle Bob’s proposed oath (like the courtroom oath) is relatively clear, and can’t be reasonably read in the way suggested above.

                                                          1. 5

                                                            is relatively clear

                                                            Perhaps for some, but I found the Oath as clear as a foggy day. He uses precise language in imprecise ways. Given it’s a programmer’s Oath, “proof” has a pretty precise meaning in programming. But would he consider a demo a proof? Or just tests? Or? I dunno.

                                                            He also uses imprecise language in ways where I don’t actually have any idea to determine if I’m abiding by it. What is “harmful code”? Is “Stuxnet” harmful because it purposfully breaks things for the good of some other nation states? Is Uber harmful because it’s putting people out of jobs that lack the ability to retrain in other fields? Should I not work for Uber? A lot of programming is based around putting laborers out of jobs.

                                                            I do like the idea of a programmers oath (although I like the idea of a “Code of Ethics” better). Maybe the next revisions will capture programming values a bit better.

                                                  2. 2
                                                    I will produce, with each release, a quick, sure, and repeatable proof that every element of the code works as it should…
                                                    

                                                    Er, no you won’t. Tests are not proofs.

                                                    He did not mention tests, he was specifically talking about proofs. I was thinking of Isabelle or Coq proofs that the code does what the specification says. Which is certainly time consuming, esp. as then you have shifted the problem a bit to make sure the specification works.

                                                    1. 12

                                                      Uncle Bob is a TDD “guru,” so I feel safe in assuming he means unit tests. I sincerely doubt he means proofs.

                                                      1. 4

                                                        I think that’s a warranted assumption, which puts him in contention with Dijkstra’s famous statement that

                                                        “Program testing can be used to show the presence of bugs, but never to show their absence!”

                                                        1. 2

                                                          It’s very odd wording then or maybe he believes tests are proofs?

                                                          1. 2

                                                            If you read his blog he outright states that tests trump encapsulation. He shows a few examples of how he would rip apart objects to get into them and “test” them. It may very well be that he believes that constitutes “proof” of correctness.

                                                    1. 3

                                                      Struggling to work on RADIUS module (FreeRADIUS). Struggling because I realized that I’m suffering burnout and extreme frustration. The burnout is due to every effort I put in seems to be a complete waste of time. On side project this is exemplified by countless efforts that have gone absolutely nowhere. @work this is exemplified by putting in a lot of effort to think about and solve problems despite a completely dysfunctional working environment.

                                                      The frustration is due to the perception of very unbalanced effort. For this RADIUS project I have to admit the FreeRADIUS mailing list has been exemplary in terms of fast response. However I ran into an issue with VPN server (ASA 5505) where multiple Reply-Message’s are not handled by IKEv1. Until this point I have never dealt with RADIUS, VPN’s or ASA 5505’s. With help I got the 5505 configured locally, I figured out how to enable enough debug to log what I was seeing and posted on reddit, StackOverflow, Cisco Support Forum, and email to the person that helped me configure the ASA 5505 in the first place. This specific instance is not the frustrating part, its a death by a thousand cuts that’s been going on for longer than I care to admit.

                                                      So after getting the module ready, I guess I will be faced with looking over what source code I can glean from Cisco’s documentation about open source they use. It feels very unbalanced but I realize that I need to suck it up. I just am having a difficult time doing that right now.

                                                      1. 1

                                                        Without a really good crystal ball how do you know what future-proofing you are going to need? It’s really hard from your post to determine if this problem you’ve identified today was completely obvious to everyone but you. Personally I watch out for things like cross cutting and leaky abstractions so whatever terrible choice that were made N units of time ago, are encapsulated well enough that “fixing” them doesn’t require a whole re-write.

                                                        1. 1

                                                          I’m not sure. Predicting the future is hard. Two other great engineers built the system with me. They also missed this nuance. Since then we’ve had a dozen different people work on it and this short-coming wasn’t obviously a problem until now.

                                                          1. 1

                                                            Which is why future proofing is impossible, regardless of the amount of money you throw at the “task” of “future proofing”. Which by the way – since you had this breakthrough – how many hours a week are you going to spend attacking this problem of “not enough future proofing”?

                                                        1. 12

                                                          I’m going to repost a good comment from teraflop on MetaFilter here because y'all seem to be weirdly negative in this post.


                                                          Sigh. This made the rounds on Hacker News yesterday. To head off some common complaints:

                                                          • They’re talking about deprecating plaintext HTTP, not removing support for it.
                                                          • There are good reasons for this. When they say “browser features”, what they’re mainly talking about are privacy-sensitive things like geolocation, or access to your microphone and webcam. For obvious reasons, these features require the user to explicitly provide permission. But if they’re used on an http:// site, you have no idea who you’re granting permission to. That code could have been modified by your ISP, or your government, or whoever set up the wi-fi at the coffee shop you’re sitting in, or just any random person on your local network.
                                                          • This is not a hypothetical problem; ISPs (including Comcast) have already demonstrated that they’re willing to hijack your plaintext connections to inject ads.
                                                          • HTTPS is becoming cheaper and easier to set up. This move is being done in conjunction with the Let’s Encrypt project, which aims to make SSL certificate setup free and effortless. If you don’t want to wait for that to take off, you can already get free certificates from StartSSL.
                                                          • Yes, the CA architecture has problems. No, nobody’s come up with anything else that works as well. Mozilla isn’t doing this unilaterally; Chrome has already announced similar plans in the last few months.
                                                          • For development purposes, “localhost” will continue to be treated as secure. If that isn’t good enough, creating your own internally-trusted CA is probably a lot easier than you’re imagining.
                                                          • The fact that they’re talking about this now doesn’t mean it’s going to happen soon. Browser vendors are very serious about doing slow, methodical, careful rollout plans, even for much tinier compatibility issues than this one.

                                                          Anything else?

                                                          1. 2

                                                            “For development purposes, “localhost” will continue to be treated as secure. If that isn’t good enough, creating your own internally-trusted CA is probably a lot easier than you’re imagining.”

                                                            My development environment has many machines with private ip’s (192.168.0.0/16). I don’t like the argument that its “probably a lot easier than your imagining” because what you are doing is de legitimizing my complaint that my browser is now making me jump through a non-trivial infrastructure change. Just because you personally don’t see a problem with it, doesn’t speak to anyone else.

                                                            In my mind the only and obvious way to address this it to make it OPTIONAL and give users the ability to turn it off.

                                                            1. 1

                                                              I wish browsers would change (or provide an option to change) the default protocol used when just typing in a bare domain name to https, instead of defaulting to http.

                                                              1. 0

                                                                I’d also add that the browsers pushing this (Chrome announced similar intent a month or so ago) are actually going to make the CAs more competitive, not less, and drive down the prices and process involved.

                                                                1. 6

                                                                  When they say “browser features”, what they’re mainly talking about are privacy-sensitive things like geolocation, or access to your microphone and webcam.

                                                                  This is flatly not true. They are specifically talking about limiting new CSS properties and the like to HTTPS, not because of privacy concerns specific to those features, but as a way to manipulate people into using HTTPS.

                                                                  1. 6

                                                                    After thinking about this a little longer, it’s the manipulation that really rubs me the wrong way about this. Software–especially free software–should seek an honest relationship with its users. This is the opposite of that. They’re saying: we’ve tried to convince you that HTTPS is important, but clearly many of you have decided its importance is outweighed by its implementation difficulty. So rather than consider that maybe our arguments are not as compelling as we think they are, we’ve decided that we’re going take something unrelated that we know that you care about–the ability to (for end users) see and use websites the way they were intended to be seen and used, or (for site authors) the ability to use the same features as every other website on equal footing–and hold it hostage until you accede to our demands.

                                                                    Moreover, Mozilla is making this decision unilaterally. It has appointed itself to make these decisions for its users because it believes it knows better than those users. But it is accountable to no one. It could have gone before the relevant standards bodies and advocated for the official deprecation of HTTP. That would have been the honest and accountable way to try to effect the change it wants to effect. Instead it is attempting to use its position in the market–a position which gives it power over its users and over site authors–to do an end-run around the standards process.

                                                                    1. 4

                                                                      Funny, to me it looks like consumers are manipulated into using http as many sites don’t support https at all :)

                                                                      Additionally users are presented with no warnings when browsing over http (though browsers can show many for various issues with https). Presenting no warnings for http promotes a false sense of security. I think this manipulates consumers (most who don’t understand the problems with http anyway) into acquiescing to an insecure transport.

                                                                      I for one would love to see pressure applied to server operators who don’t offer https.

                                                                    2. 3

                                                                      That is a long, long way off and the economics of the situation are already not bad and will only get better. You’re stressing out over a memory of the past.

                                                                1. 2

                                                                  Gonna work on an integration with Symantec VIP. All evidence points to this effort being a waste of time but a very wise person said “take solace in the fact that even if it’s for naught, your brain may make a connection down the road, that it wouldnt have otherwise.”

                                                                  I’m trying to figure out how to minimally affect things while still making client authenticated TLS connections for SOAP calls to VIP. Ive been wrestling with how difficult the choice was for me to require client authenticated TLS REST calls and now I’m on the other side of that. Wish me luck.

                                                                  1. 4

                                                                    This week is primarily about RSA conference. Not the conference per se, but all the people that come for it. So far Monday, Tuesday and Wednesday are booked and I am irrationally happy about that. Hopefully some interesting things will come of it.

                                                                    1. 3

                                                                      Have people forgotten RSA’s involvement with NSA backdooring already? In my mind, this makes RSA irredeemably tainted. Why would people still attend their conference?

                                                                      1. 1

                                                                        No I haven’t forgotten but as far as I am concerned no one is not tainted and the conference has everything going on in the Enterprise security world. Keep your friends close and your enemies closer.

                                                                        1. 2

                                                                          no one is not tainted

                                                                          Please be more positive and less cynical. Of course that there are people that are doing far better in the world than those who promote NSA backdoors because they were bribed. It’s up to those people to shame RSA into bankruptcy for what they’ve done. RSA has done exactly the opposite of what its whole purpose of existing as a company is.

                                                                          If people like you just think, “everyone is shit anyways” (paraphrased), then that’s how things will stay: shit.

                                                                          Can you or your buddies do anything to start a different conference that is not affiliated to RSA? Pycon is one such community-run non-corporate conference. It’s taken many years to become what it is, but it has turned out quite well, and it has principles which have resulted, as I have heard it, in the only tech conference where women face bathroom lines.