HN user

bm98

400 karma
Posts5
Comments74
View on HN

That was a great talk! Notice how his entire career got launched from an internship at Tektronix. I love the bit about how he found his own troff macros in use at O'Reilly because a coworker had taken his code there years before -- and he appreciated that! One might say that the same kind of "80's hacker ethic" is what got him into trouble at Intel.

The Camel book was so well-written. It was my introduction to Perl, which became my "superpower" in the 90's and far longer into the 2000's than I tend to admit. I eventually switched to Python because it's the closest thing that is considered an acceptable "modern" choice. I really enjoy Python too, but the obligatory XKCD about Python[1] rang true for me about Perl first.

For me the #1 superpower strength of both languages is the first-class treatment and syntactic sugar for associative arrays (a.k.a. hashes, dictionaries).

Perl did the same for regexes and file I/O; Python did not.

I have come to appreciate Perl's backwards compatibility -- that old scripts still run unchanged -- though maybe that's largely because Perl 5 has been in maintenance mode for so long.

[1] https://imgs.xkcd.com/comics/python.png

Thank you for this article. One of the great frustrations of using Magit for Emacs is the inability to read things because the foreground and background colors for various things end up the same on some platforms.

From this article I found the command "toe -a" and was able to try various TERM values until I found one that makes Magit readable: vt100. This turns off colors entirely, which may not be pretty, but at least I can read everything now.

The ZX81 Turns 40 5 years ago

1982 Atari 800 here (was 8 years old at the time). I remember thinking the same thing at the time. When we first bought the thing, there just wasn't much I/O beyond the tape drive (and later the disk drive), and therefore the things we could do seemed very limited. It wasn't until we got a printer (a Star Micronics SG-10 dot matrix tractor feed) and a 300-bps modem that the world really opened up!

26 Years of Delphi 5 years ago

The best memories I have was that probably, this was the first time I had that "feeling" of having built something useful to somebody. And certainly the best moment was when one of his suppliers who also accepted those coupons asked us for a copy of the program. Great times.

And then you go off to college, and one day the program stops working because of one problem or another, and they call you in the middle of studying for final exams, and that's when you learned about technical support and technical debt and all the things that make programming less fun!

Some people have recurring dreams in which they show up to school or work in their pajamas... my recurring dream is that some program I wrote in high school is still being used twenty years later, and they come calling because something broke...

Software lifetime is an interesting topic. See for example [1], a 1992 paper that surveyed business applications and found an average lifetime of about 9 years, with a maximum of 20 years and a minimum of 2 years. 2 years versus 20 years!

Things don't seem much different today.

On the one hand, HTTP, HTML, and producing HTML server-side in a language like Java or Python and with a SQL database isn't all that different now than it was 20 years ago. There are Java web apps developed in 1999 that are kept up-to-date and work just fine in 2020. On the other hand, there are applications developed with popular technologies a just a few years ago that are hopelessly out-of-date and in need of a rewrite today.

I see it as an end user too. I've been an ING Direct (now Capital One 360) customer for 18 years. The web app that I use in 2020 seems to do the same things as the one in 2002 (though it's slower today), but it seems like it's been completely rewritten at least three times.

[1] https://scholar.google.com/scholar?cluster=23826996884004375...

EDIT: And HN! 13 years old and counting...

I always thought the primary driver of the demise of Flash was that Apple simply decided not to support it in iOS Safari. Is that not right?

To me this is the crux of the issue. And it's non uncommon in software development:

The developer fails to check for an error condition or raise an exception because doing so would add too much complexity to the system. So instead it is assumed (or hoped) that it simply can't or won't happen. Problem solved...

(Edit: Or that the user will just have to reboot if it happens.)

Tracking time is part and parcel of being a consultant, at least if you have multiple clients and overlapping work. After doing it for 15+ years, I've tried it all - everything from the spreadsheet, to the apps, to forgetting and having to go back and reconstruct.

I read this article and I think it's missing the point about what's so hard about time tracking.

What's hard is: Implementing the trigger on the context switch.

You're working on one thing, something happens and you make a context switch to something else - and in order to track your time, you need a trigger to fire to prompt you to record the switch. It doesn't matter if it's in a spreadsheet or an app or on a piece of paper - I find that my brain doesn't fire that trigger very reliably. Especially if I'm busy.

If someone can solve that problem with a fancy app, I'd be impressed!

I've said it in another thread [1]: I want a robot that watches me and quietly makes intelligent decisions about what I'm really doing, and tracks that.

[1] https://news.ycombinator.com/item?id=15790918

Standards like SMART-on-FHIR [1] and CDS Hooks [2] have the potential to allow innovation developed outside of Epic and Cerner inside of those products. Both of those vendors even have "App Stores" [3] [4]. So far, though, there aren't a lot of apps in these stores, and none of my doctors (all of whom work for large academic medical centers and use Epic) have access to any third-party apps - so I do wonder whether the vendors (or their customers) may be putting up roadblocks that are slowing adoption.

[1] http://docs.smarthealthit.org/ [2] https://cds-hooks.org/ [3] https://apporchard.epic.com/ [4] https://code.cerner.com/apps

Most new mice, yes. I use an original Logitech MouseMan 3-button mouse with no scroll-wheel. I realize I'm an outlier, but no mouse has ever come close in terms of comfort for me - so I continue to use it, and life has been just fine until the advent of the Overlay Scroll Bar.

I realize the benefits of the Overlay Scroll Bar to the majority of users who have scroll-wheels. But it sure would be nice if there was an easy way to revert back to the Normal Scroll Bar ("Classic" scroll bar?). You know, the wide bar that scrolls down exactly one page-length if you click outside of the bar? I've spent plenty of time Googling and in "about:config" and exporting environment variables like GTK_OVERLAY_SCROLLING=0 to no avail.

In cases where I need to download and install unsigned software that's not available via package manager, I run hashes (MD5, SHA1, SHA256, etc.) on the downloaded file and the run Google searches on those hashes. As long as the software has been released for more than a day or two and it has a decent sized user base, the hashes will show up in various places such as fossies.org and will be cached by google. That would have protected against this particular attack.

EDIT: But in this case, the software in question is signed, so the (fallback) technique described above is not necessary. The download page [0] contains a GPG signature along with a link to the author's GPG public key. Checking the signature would have prevented the attack.

[0] https://handbrake.fr/rotation.php?file=HandBrake-1.0.7.dmg

I'm a little surprised that the majority of the answers here are Yes!

I help my parents and my kids work with bookmarks but I have none myself; and I was beginning to think that bookmarks were primarily used by non-technical people. I guess I was wrong!

Everything I need is a simple URL (like, my bank: usaa.com - why would I bookmark that?) or a quick Google search away. If I come across a deep link that's so important that I want to keep it, I email myself the link along with maybe a short description, and it will be searchable forever.

My lack of bookmarks fits with the rest of my "online personality". I have 14,183 threads in my work email inbox and I do not file emails into folders like most of my colleagues. I do not have the desire or the time to manage email folders or browsing bookmarks.

Also, the fact that I browse in a "clean" browser instance in SELinux that saves no history from instance to instance probably contributes to my lack of bookmark use.

As a web developer, I wonder if this class of accessibility functionality renders the web accessibility guidelines [1] obsolete? Many of the guidelines have to do with organizing content and following rules that make it easier for older (inferior) screen readers to handle. But I just enabled this feature on my iPhone, and browsed some sites that I know are ridiculously noncompliant, and it handled them beautifully. Even guidelines having to do with describing photos and avoiding text in images could be rendered obsolete with some of the third-party apps that perform OCR and use AI describe photos.

[1] https://www.w3.org/WAI/intro/wcag

Ugh. A good and scary reminder of what's lurking around the corner for any of us at any time - including holidays and vacations (Linode's holiday attack last December comes to mind). IMHO, the emotional impact of breaches on the staff who respond to them is under-discussed. The author touches on it here:

The discovery of a root cause is an important milestone that dictates the emotional environment an incident will take place in, and whether it becomes unhealthy or not.

A grey cloud will hover over a team until a guiding root cause is discovered. This can make people bad to one another. I work very hard to avoid this toxicity with teams. I remember close calls when massive blame, panic, and resignations felt like they were just one tough conversation away.

Maybe not favorite but "most memorable": "CVE-2014-6271: Remote code execution through bash" [1]

The top comment when I first saw it was, "If you are responsible for the security of any system, this is your immediate, drop-everything priority." [2]

Shellshock just kept going, and going, and for days you didn't know what was coming next. I suppose it's unfair to real PTSD victims to say this, but sometimes I feel like I have a little PTSD from that incident. I can only imagine what people at the center of it were going through.

My favorite blow-by-blow account was David Wheeler's essay [3] [4].

[1] https://news.ycombinator.com/item?id=8361574 [2] https://news.ycombinator.com/item?id=8361871 [3] http://www.dwheeler.com/essays/shellshock.html [4] https://news.ycombinator.com/item?id=8428644

As I posted in a previous discussion of this two years ago [1]:

The very first comment below the article (correctly) contradicts the author's claims about SELINUX sandbox. The author acknowledges the comment, and criticizes the SELINUX implementation, but does not dispute the fact that SELINUX sandbox ("sandbox -X xterm" in RHEL/CentOS/Fedora/SL) does in fact defeat the keystroke logger attack described in the article.

[1] https://news.ycombinator.com/item?id=7607082

a bad actor is purchasing large amounts of botnet capacity in an attempt to significantly damage Linode’s business.

I wonder what size investment this is taking, and what the end-game is for the bad actor. Unless Linode's mitigation tactics are increasing the bad actor's costs, what's to stop the bad actor from continuing the attacks until Linode goes out of business?

In many cases the decision to go with Oracle was made decades ago, and the cost of migrating large, legacy databases and codebases away from Oracle is higher than the cost of continuing to use Oracle. Oracle licenses can be very expensive, but migrating and rewriting and retesting working code can be even more expensive!

Also, Oracle is pretty good at achieving vendor lock-in. For example they introduced a rapid web application development platform called "Apex" [1] about a decade ago and shipped it with every Oracle database (even the "free" Oracle Express Edition). In my experience, developers who use it tend to like it, it does achieve rapid development, and there's really nothing else like it outside of Oracle. Once an organization has Apex apps, though, there's no migration path to Postgres that doesn't involve completely redeveloping the Apex applications from scratch.

Finally, despite all of the ways in which Oracle seems to be business and developer unfriendly, for a developer or DBA trained and experienced and entrenched in the Oracle ecosystem (and for whom license costs and sales tactics are not a concern), it's really not such a bad place to be IMHO. I personally would not choose Oracle for my own ventures but in the cases where Oracle has been chosen for me, I enjoy working in the ecosystem.

[1] https://en.wikipedia.org/wiki/Oracle_Application_Express

Fedora and Red Hat (+ the Red Hat clones like CentOS) have a "sandbox" command which uses SELinux to sandbox applications or entire X sessions and the applications inside them. For more info see [1] [2]. I've used it for a long time and it works well enough. It's not available in Ubuntu, though.

In Ubuntu the closest thing to it, I think, is AppArmor, but I've never tried it myself. Or you could run a virtual machine with Fedora and use SELinux there.

[1] http://danwalsh.livejournal.com/31146.html

[2] http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-...