c0rtex

Also reviewed by Cory Doctorow: https://pluralistic.net/2025/04/22/vinges-bastards/#cyberpun...

I'm looking to do exactly this. I'm currently doing embedded software for aerospace, so somewhat similar with regards to documentation and standards (it's critical software, just not human safety related). Can you share how you found the work?

I'm also curious to know how you can do small quantities of hourly work in this field rather than take on projects that would require much larger time commitments. Are you just consulting as a domain expert or something?

https://www.businessinsider.com/coronavirus-compared-to-flu-...

Here's a great talk that addresses style vs. standards in the context of NASA and space flight software.

https://www.usenix.org/conference/hotdep12/workshop-program/...

He presents a compelling case for why you should use automated tools to check compliance against coding standards (the standards don't do you any good otherwise).

As far as style goes, pipe your code through indent if you have hangups about formatting. That way you can spend your time on issues that are known to be correlated with risk.

In that case, check this out - the NASA Systems Engineering Handbook. It's an impressive beast (only tangentially software-related though).

http://www.acq.osd.mil/se/docs/NASA-SP-2007-6105-Rev-1-Final...

With respect to his point that Uber requires passengers to identify themselves, I think a completely anonymous transportation system is not what is needed. Why do conventional taxi services and public transit systems have cameras? The answer is ostensibly to provide safety not only to the rider but also to the driver and other passengers [1]. But I'm sure Stallman would say "ban the cameras everywhere, Big Brother has no business tracking us!" If I were a cab driver though, I would feel safer knowing that a video of the transaction was at least being captured. And as a passenger I would feel less violated if I knew that the video was stored offline and took some amount of effort to retrieve, could only by accessed by certain individuals, and even then only with proper oversight.

What is needed is a balance between privacy and safety. Uber violates user's privacy, but fully anonymous transportation, especially in a one-on-one ridesharing situation, is unsafe for both parties. Law enforcement should be hard, not impossible.

[1] http://taxi.vic.gov.au/drivers/taxi-drivers/driver-safety/sa...

Same thing on YT: https://www.youtube.com/watch?v=k3bzHk_6yHM For those who like to watch at 2x.

What static analyzers do you use for your embedded C++ work?

No pun intended?

https://en.wikipedia.org/wiki/TheDraw

http://www.knoxbox.com/property-owner-support/faq

Relevant in the context of the recent FBI / iphone case.

Where I live in California, these boxes are everywhere.

One interesting aspect is that they can be alarmed, so that you can know when someone has accessed the key. It would be interesting to at least know when someone has accessed your encryption keys.

I hope the Riverside fire marshall (in the video) isn't holding up the real key on camera.

If a situation is causing no problems outside of depression/anxiety, and you took away the depression/anxiety mechanism, there would be nothing wrong with it.

The article's premise is that having one's core psychological needs go unmet is like having a broken bone.

If you take away the pain from a broken bone, you still have a broken bone. As you say, there is nothing wrong with taking the pain away. But the bone is still broken, and limits you in ways that a healthy bone would not.

Taking away the symptoms of an unwell psyche still leaves you disabled, even if it isn't as outwardly evident as a broken bone.

Here's a great video with a bit more background about why you'd want to adopt such a standard.

https://www.usenix.org/conference/hotdep12/workshop-program/...

You might also be interested in the MISRA C coding standard, which is geared towards reliability and safety rather than security. The MISRA C standard is fairly strict and mostly (but not entirely) machine checkable.

There was a Usenix talk on developing code for Mars rovers in which Gerard Holzmann pointed out that for large projects coding standards are much more effective when you have automated compliance checking. https://www.usenix.org/conference/hotdep12/workshop-program/...

I note that there is a tool for checking the CERT rules called Rosecheckers: http://www.cert.org/secure-coding/tools/rosecheckers.cfm? It looks like it might be incomplete and/or outdated.

And the CERT pages include a reference to a deleted summary of other automated checkers such as Coverity and Klockwork: https://www.securecoding.cert.org/confluence/display/seccode...

Maybe it's sufficient to ask: what would be useful for developers to keep score of in order to improve professionally?

Surgeons keep score by measuring patient outcomes in order to draw conclusions about their own performance, the effect of which is to "shrink the outliers" - people see where they can improve and they go ask their colleagues, "hey, how'd you do that?". So what would the equivalent of that be for a developer?

The best tool I can think of for this isn't an automated system for scorekeeping - it's soliciting feedback [1]. You ask a more seasoned dev who is familiar with your work where you can improve.

How do you "shrink the outliers" on a team of developers? Get people to work together. Take each other's code apart.

[1] Particularly negative feedback, according to Elon Musk at the end of this vid: http://www.ted.com/talks/elon_musk_the_mind_behind_tesla_spa...

It would be very exciting to see some long-term study results on this.

Also: Q: As long as we're food hacking, why not open-source it and post it on GitHub? A: It's a liquid. You can't fork it.

But seriously, the open-source version of this could be the nutritional version of the OLPC.

Aside: Does anyone know how these slides are generated?