martinced

I like your explanation about layered solutions to security, +1.

"Do you trust your chipsets?"

Certainly not. I do believe that the recent tiny bytes sequences in any TCP (UDP ?) packet that can lock Intel ethernet cards is actually a backdoor allowing the state to perform DoS at will. I do also believe Huawei and ZTE are state-sponsored espionage companies (I've certainly seen weird things like a keylogger inside a 3G Huawei USB device sold I bought in Europe).

But I do believe that even if I'm, say, a Debian or OpenBSD dev working on OpenSSL it's amazingly complicated for the chipset to modify source code and be able to make to the DVCS unnoticed. I also think that as long as the source code isn't corrupted there are ways to create non-backdoored builds.

It's the same thing with program provers that can verify that certain piece of code are guaranteed to be free of buffer overrun/overflow: what proves that the compiler itself hasn't been tampered with? But still... With DVCSes and many eyeballs I'm not that much concerned about the compilers typically used nowadays to be tampered with.

But why oh why immitate the Emacs shortcuts?

I love Emacs. I use it all the time. But the default shortcuts are the most stupid thing ever. That Control-x (C-x in Emacs lingua) is insanity at its best: due to the stupid non-symmetric layout of typical staggered keyboards 'x' in itself is one the hardest key to type (the equivalent with the right hand is way easier : '>' on a QWERTY keyboard). I'm a touch-typist and to hit 'x' I need to move my whole hand a bit. To hit '>' I just need to move on finger. I blame this on the fact that keyboard are using a staggered layout instead of a matrix or symmetric layout but whatever.

Then Control. Zomg. Control has to be accessed with the left pinky if you're a touch-typist: some very touch-typist friendly keyboards like the HHKB Pro 2 don't even botter with a right control key.

So to hit "C-x" you're supposed to use the two leftmost fingers of your left hand: this alone has to be one of the most RSI inducing keyboard shortcut ever.

But in Emacs everything is configurable. So I'm using "C-," to replace "C-x" and "M-," to replace "M-x".

It shall never cease to amaze me (in a very sad way) that when people "copy Emacs", the first thing they copy are the Emacs shortcuts. The Emacs shortcuts are the lamest thing ever in Emacs.

I love Emacs but I hate its default shortcuts. Emacs is not about its shortcuts: Emacs is about tailoring it to your needs by using Lisp.

I'm also wondering why that constant loss of energy in editors which shall never produce anything close to what one million lines of elisp code are providing. I'd much rather see that energy spend on creating a bridge for the Go-completion facility in Emacs, the real thing.

"Emacs is big, startup is slow..."

Please. I don't even bother compiling my .el to .elc and I've got a shitload of modes and a gigantic .emacs file (which I should split btw).

Emacs, from the scratch, takes two seconds to fully load, including all the modes and my solarized color theme etc. I'm not talking about always running an Emacs server to which you can connect in a split second: no, I'm talking about a cold start.

It's 2013 and that's on a Core i5 3450s with 4 GB of RAM. Hardly a speed/memory demon.

If I was motivated I'd compile all my .el to .elc and always run emacs in server/daemon mode to connect lightweight windows to it but why bother!? The friggin' entire thing launches in two seconds!

Regarding the "Emacs is big", I know the joke was funny when people, 20 years ago, were writing that Emacs meant "Eight Megabytes And Constantly Swapping" but in this day and age where most devs are using IntelliJ IDEA, Eclipse or other super-fat IDEs, you have to admit that Emacs is really in the "very very very lightweight camp".

Yes, you need lot of elisp scripts: and preferrably as much as possible written by yourself, because this means you're tailoring your editor to your needs, not the other way around.

"Interfaces can now define static methods. "

Twenty years for that one ; )

zomg. Another one debated at length through flamewars on Usenet and ##java. And now it's here. Feeling good : )

lemon shows on their frontpage someone taking a picture of its VISA and putting it inside his iPhone.

What can possibly go wrong?

: )

"...add a new parameter, set a default and it does it across the entire codebase."

OK but why exactly does a new parameter with a default need to be repeated at different places across the codebase? Because you're using Java and Java is incredibly verbose and requires you to do crazy stuff and you end up with a super-complected codebase where instead of passing messages around you're actually telling objects "do this", "do that" and then when you have one parameter to a method you're in a world of hurt (because that method is used from different parts of your spaghetti codebase).

In Clojure, for example, you'd simply pass the parameters in an associative array (a map) and, even better, when you're constantly passing through the same set of parameter you'd simply wrap the method + its common parameters in a higher-order function and then you pass that higher-order function order. This makes for incredibly shorter codebases and incredibly easier refactoring.

Don't get me wrong: at 75% off during doomsday I did buy my IntelliJ IDEA licence but you're foolish if you think that the "text editor" part of IntelliJ is anywhere near close what vim or Emacs do offer you.

Also what's really great about Emacs is that you can add functionalities yourself to the "editor". Wanna run unit tests automatically and see the result in another frame/window/buffer? That's trivial to write.

No later than yesterday I missed IntelliJ's "goto declaration..." feature. I wrote a quick defun in elisp that had... Seven lines of code and did 90% of the job. Sure people are going to hard that it's for those 10% cases where my script doesn't work that IntelliJ really shines but that's not the point. The point is that you can program Emacs to suit your way of working.

You adapt vim / Emacs to yourself. With Eclipse / IntelliJ you have to adapt yourself to the IDE.

"when your tools are oriented toward making huge balls of mud and your philosophy is oriented toward making huge balls of mud, you will make huge balls of mud"

New sig for me on forums ; )

Paraphrasing Rich Hickey: everytime you're using a "pattern" and have your IDE generate code for that pattern for you, then it means: "I have run out of language" : )

"Have any of you overcome this after > 10 years of bad habits? How did you do it?"

I had a secretary handing my arse to me... So after ten years of bad habits I decided to learn the proper way. She showed me the basics (which are really super trivial: it's so easy that a five minutes YouTube video about how to touch-type should get you started) and then... Practice. Practice. And practice.

And I did buy a split keyboard (warning, there are two schools concerning where the '6' is located and there are even very rare split keyboard who very intelligently did put the '6' on both the left and the right part of the keyboard, so that everyone's happy : )

Buying a split keyboard kinda helps.

After three months I was back at the speed I was before. Then I started typing faster.

It's not so much about the speed: it's about the economy of hand and fingers movement too. I'm sure it's better from an RSI standpoint.

You need to force yourself and keep your eyes on the goal: become faster than before.

Don't mind the obstacles: the very beginning is going to be the most painful.

Buy a real keyboard too: my keyboard / chair / monitor are my physical tools which I use all the time. I spent $$$ on them.

Now the issue is that a good split keyboard is very expensive. ANSI Cherry MX 5000 go for about $500, split IBM Model M15 will settle you a good $1000 to $1500, etc.

Junk like the split MS ergo 4000 have a nice shape but are, sadly, using super shitty rubber dome keyboard.

If you spend your life typing on a laptop then you're destroying your fingers' joints with the ultra-low profile scissor switches.

I'm using a HHKB Pro 2 on my workstation and I hook it to my laptop. Topre switches. Amazing stuff for about $300.

Now that I know how to touch-type I don't really care about my keyboard being split or not.

That would be the world backward: it's like when IntelliJ or Eclipse do offer Emacs shortcuts (Emacs shortcuts being the stupidest things ever invented --and this comes as a long time Emacs user), completely missing the point.

BUT there's light at the end of the tunnel: there's eclim (eclim.org), which allows you to use vim (the real one) as the text editor for Eclipse. Or if you want you can run Eclipse in headless mode and then have vim transparently contact the (local) eclim server and suggest you, right in your vim, the autocompletion hints from Eclipse etc.

"As soon as I lose pride in something, I stop caring about it being good."

The one quote to deal with that is simple: "A professional is someone who can do his best job even when he doesn't feel like it"

That's what I keep in mind when I have to work in that special Java/C# + ORM / (N)Hibernate + XML + SQL kind of development hell.

:-/

Insecure defaults s^cks.

On a semi-related sidenote all the recent Rails exploits prompted a heated discussion on the Clojure devs (the developers developing Clojure itself) group / mailing-list about an insecure Clojure default value.

Some devs realized that using exploits similar to the Ruby ones in YAML deserialization rogue code could be run on the Clojure webapp server if certain functions were used... And the argument to force the benevolent dictator to act was precisely that the Ruby issue basically turned into a gigantic endless mess of compromised systems and patches.

In Lisps it's all too easy (which is good) to read data and to eval it by mistake (which is bad): Clojure by default ships with read-eval set to true which is maddening. These aren't safe defaults and several webapps are vulnerable. Sadly as I understand it that default behavior is so relied on upon by everything in the Clojure ecosystem that Rich Hickey decided not to change it to false.

Instead Clojure ships with insecure defaults and big fat warnings in the documentation saying: "You should not use this function, use the EDN functions instead". And it is recommended that everyone sets read-eval to false. Still as far as I understand it even when read-eval is set to false some functions do still have side effect (in Java land) and could potentially be used maliciously.

That's the big problem: I don't understand it all because it's super technical (Rich basically told people on the mailing list they weren't qualified enough to discuss about what the defaults should be). All I know is that I'm supposed to set read-eval to false and also not to use read-string etc. but instead use the EDN functions.

And then I guess "cross fingers" because "we promise you this way you'll be secure". I only half-buy it but whatever, I do still love Clojure as of now.

I think it's really sad that security seems to always be an afterthought. The very rare projects I know of which were conceived with security as the main reason are OpenBSD and it's OpenSSH implementation (which is also into Linux etc.) and esL4 (a 7000 lines microkernel from which hundreds (!) of bugs have been found and eliminated using a theorem proover).

I can't help but dream of the day were devs are going to take security seriously and ship with safe defaults.

Probably not for this decade but the situation is getting so messy that I'm certain something shall be done at some point.

And while some here are busy "getting real things done in PHP and Ruby" (which is great as long as you're not diminishing others), I want to thanks all the devs working on torny security issues and thinking about security from the start. Like all these Ph.Ds working on theorem provers etc.

"All of our sites (asp classic) on a single server went down at the same time"

Honest curiosity here (I'm not judging): you were running several sites on a single server that didn't have ECC RAM but regular RAM?

Did you then switch to ECC?

I like the thought about radiation from far away in space and time : )

It's a bit of a pain to find ECC mobos for desktops.

I looked for some when I built my last workstation seen that I was putting 16 GB in but ended up using stupid normal RAM : (

Now between SSH, SCP, SSL / TLS, Git, diffs before commits, unit tests, etc. I'd be really unlikely to have a bit flip really "destroying my work" : )

So, yeah, 16 GB of non-ECC memory on a Linux workstation which regularly reaches 6 months of uptime: no need to enter in a paranoia either for a desktop/workstation.

For servers, ECC is great...

"Start moving large compressed files (gigabytes) and you'll find that out the bad way."

Not if you do that over SCP / SSL / TLS that said... (and the bottleneck is the network, not the symmetric encryption used once the public/private symmetric key exchange has been made).

So, yeah, everytime I copy big files I'm using scp (small files too actually but it's just out of convenience).

"After all, what's offensive to one person may not be so to another, and they may end up offending you by mistake."

Including that sentence doesn't make the fact that it is undisputably a two-ways street go away.

If it's an honest mistake, sure, don't get offended. But if the person does it on purpose, then we're talking about something else altogether and there's no reason to simply "don't get offended". In the later case I'm not offended by what I'm hearing (the person who's going to make me feel inferior ain't born yet) but I'm offended by the fact that the person is trying to be offending on purpose.

There's a very easy way to be sure, you simply gently ask something like: "Are you trying to be offending?"

It sounds great both for users and for devs which, I'm sure, is going to help it take off.

However I've got one question: was this conceived from the start with security in mind and is it simple enough as to not be plagued with the countless security issues which product that are too complex inevitably run into?

I'm thinking, for example, of the various recent OAuth SNAFUs.

I didn't downvote it but I think I know why: there's a huge wave of negativity on HN and your question sounds like criticism.

There are ways to formulate the same question which would be much nicer and less negative, for example:

"It's great to see other solutions providing things similar to OpenID. Can anyone explain what are the differences with OpenID?"

Simply writing: "How is this different from XXX?" just sounds rude and negative.

Nobody accused them of "not encrypting" [sic] passwords. People accused them of storing passwords in clear text.

These are two entirely different things.

Why? Because passwords should NEVER be encrypted. Passwords are meant to be hashed (with a salt) and the hash (+salt) is what should be stored on their servers.

You really should know better...

PermGen, as if all the JVMs out there were Sun/Oracle or the OpenJDK ones ; )

"I was struck by the idea of a function taking a function as input and transforming it to another function as output."

That's a higher-order function (HoF). I'd say it's not the fundamental thing to understand about FP: you can even program in a functional way without using them.

And also you can have languages which aren't putting the emphasis on FP at all and yet who have higher-order functions: elisp, for example (anyone calling elisp functional is automatically setq'ed to crazy ; )

IMHO Lisp dialects aren't inherently functionals. Some are, some aren't. Even Clojure, which definitely puts the emphasis on FP, isn't purely functional, far from it. But you can use it in a functional way (and Java too, in a way -- I used to do "OO over immutable objects" and use "functional Java").

However you'll probably find that when using Lisps in a functional way, you can use higher-order function often. For example if you have, say, a referentially transparent function and want to add memoization for free then it's very convenient to simply (memoize myfunc).

Or if you want to "carry the state" of your program through monads (or to use other kind of monads): then you'll need higher-order functions.

To me if there is one thing about FP it is simply idempotent / referentially transparent functions which make it easier to reason about the program.

I'm simply beginning to "grok" FP, HoFs and Clojure so take this with a grain of salt : )

"Know your IDE"

I'm getting to the point where I can write elisp functions adding cool functionalities to Emacs (like jumping to a function whose name appears in a comment), does this count as knowing my IDE? ; )

I must have it all wrong: I did follow pg and Steve Yegge's advices and learned Emacs and Lisp ; )

I'm probably not a programmer...

The Web and all the technologies that come with it is a special kind of hell: a Rube Goldberg machine whose level of complexity and crazyness is hard to match.

The associated mediocrity is kinda jaw-dropping too: it's 2013 and the main "engine" used to run all these client-side apps in the browser is still... Single-threaded. Seriously. I'm not saying "language" because JavaScript in itself has so many warts that there are several technologies out there who try to dodge the language altogether and directly generate JavaScript source code... Even Douglas Crockford himself is criticizing JavaScript a lot.

But it's not just JS... The madness simply never stops: HTML, (X)HTML, CSS (oh, that one...), JS. And all the incomplete and overly complicated "standards" and, of course, all the competing implementation.

I'm always amazed that we're in 2013 and a lot of the demo page posted on HN still cannot serve videos correctly to people who don't have Flash in their browsers. That's the current state of affair: most web devs still aren't able to serve various video formats to please everyone. Why isn't this something that comes for free with the webapp server? Is it rocket-science to encode in different formats and serve the correct one? Apparently it is. So imagine for more complicated things...

To me the most fascinating is that hardly anyone steps back and wonders "Why do we have such an incredible mess?".

But that's what we have and a big part of software development is now for the Web and the trend ain't stopping anytime soon: be it server-side or client-side, it's a browsers world nowadays.

So let's stop bitching, let's learn the warts and ins and outs of these uber-shitty technologies and let's get back to work ; )

It's nice but the dropdown selection suffers from the common issue that Amazon solved using "fuzzier" mouse tracking. Trying to get to the last dropdown box on this "Almost Flat UI" is hard: as soon as you're one or two pixels off everything disappears.

IMHO that is one of the main benefit of negative spaces (I didn't know the term but knew the technique): you actually hardly notice that there's "something else" and yet the logos somehow look nice. I'd say they look "soft", without knowing why.

Once you focus too much on "what's inside", it gets a bit confusing because you're seeing conflicting things (like the tree leave that is also people): but it's not a problem because it's not meant for people to really focus on.

And somehow it just works. I find several of these logos really very simple and great.

Now that this has been posted on HN I expect lots of startups to come up with similar logos ; )

"The Byzantine generals' algorithm is used to handle situations where the computers do not agree. That situation could come about because of a radiation event changing memory or register values, for example."

This always got me wondering: what happens if the algorithm used for handling that is itself affected by a radiation event? Is that just too unlikely because such few code is executed? Or what if the computer in charge of verifying that the other computers do come up with a correct answer is itself dying, isn't it a SPOF?

(curious mind wants to know)

Weird. My Debian systems don't have that alias...

Exactly. He's a Keynesian freak who lost it a long time ago.

Krugman lost it a long time ago. The final nail in the coffin was when he wrote that it actually was a good idea to mint a $1 trillion coin to dodge the legislation preventing to raise the U.S. debt ceiling.

If you're into economy at all you should know that disciples of Friedman did predict the precise situation the eurozone is in right now (including Spain unemployment, the Greek default, Italy and France struggling) before the first euro even circulated... Meanwhile Keynesians have never been able to predict anything more than two or three years before they happened.

Keynesians are ultra-short sighted but politicians loves them because they're basically telling them what they want to hear: more state intervention, create even more money (the $1 trillion coin was just ultra rubbish, really), etc.

His whole book "End this recession now" is a gigantic pile of shit.

The situation ain't good because of the Keynesian doctrine and yet these people want to do more of what does obviously not work: let's print more money.

I never had much sympathy for Keynesians but honestly since he wrote about that $1 trillion coin I've entirely lost interest.

He lost it.

"Its value for its users (basically how much value is gained by using Google as opposed to an alternate search engine)..."

and:

"(other search engines such as Altavista who had results which were poorer, but not hugely so)"

I upvoted you but for many Google is, and since quite a long time, just so much more than just the search engine.

Actually I don't even search that often anymore. My girlfriend hardly ever searches for stuff on the Internet: online life for her is GMail, YouTube (I take it you could hard there's search inside YouTube), eBay, Amazon, FB and a few other sites but that's basically it. What Google offers goes way beyond search: to me the biggest benefits are, by far, a spamless webmail, online backups and online editable/shareable Google Docs. Search is a very very very distant fourth or fifth service compared to the rest that Google is offering.

"I'm not inclined to make grand pronouncements about the future of software, but if anything kills off commercial software, let me tell you, it won't be open source software. They needn't bother. Commercial software will gleefully strangle itself to death on its own licensing terms."

If there was no open-source alternative companies like MS could have continued for ever and ever with ever more convoluted licensing terms and people wouldn't have had the choice...