x1

> I do not see anyone ... I don't see it to the scale

What scale do you see it? And what's the acceptable/unacceptable threshold? Right now you are jumping squarely into "this isn't an issue please move on and grow thicker skin", which is a lousy place to start a discussion.

> entire industry freaking out.

I really don't think my or your opinion matters, instead perhaps we should encourage more bloggers like this to speak out so we can see if there really is a problem. You know, encourage more data from the source instead of anecdotes like your wife and math?

Because if there is a problem then we should solve it, right?

> I'm so tired of hearing about sexism in tech > that's the way it goes. > I haven't seen any of this. Maybe I've missed it, or I'm not looking, who knows.

Or possibly you're predisposed to an opinion and only look to reinforce it instead of challenge it?

> In the rest of my program, those functions would be the only way to talk to the database. There's your guarantee. Honest question. Take these pseudo sql calls:

    //Bad Person
    username = "lastname'; drop table user--"
    
    //Good Programmer
    query = "select * from users where name like %[username]%";
    input = {"username":"frank"};
    result = execute(query,input);
    
    //Bad Programmer
    query = "select * from users where name like '%"+username+"%'";
    result = execute(query, {});
	

    //Bad Person
    String username = "lastname'; drop table user--"

    //Good Programmer
    Query q = new Query("select * from users where name like %[username]%");
    Input input = new Input(username);
    q.addInput(input);
    Result r = q.execute();
    
    //Bad Programmer
    Query q = new Query("select * from users where name like '%"+username+"%'");
    Result r = q.execute();
    
	
	

> But if you write a secure version, you only have to write it once.

> You only have to maintain it in one place.

> You only need to test it in one place.

Again, so this cannot be done in a dynamic language? If it can be done, why bring them up?

> And if you forget to use your secure Query type, anywhere else in your code, the compiler will yell at you. It's a significant advantage.

The only thing the compiler will yell at you is if you passed a type that is not of a Query type. The compiler will not yell at you for getting the current session directly or creating your own jdbc driver for that matter.

> What possible purpose does your example serve then if it doesn't impart any sort of meaning at all?

The example shows that static typing doesn't do anything more than what it says. It doesn't solve problems/fix bugs or provide some magical insight to the system as you seem to believe.

I'm genuinely curious as to your position and why you are so... clearly opinionated. I'll take the "idiot banner" for today. Please provide me with your insight as to what the fundamental argument (and why you feel so strongly about it) really is.

> Now you are suggesting that you wouldn't write such code in a dynamically typed language anyways?

I never suggested that...?

> With a statically typed language, when you make the error, you get told about it by the compiler. With a dynamically typed language, you find out about the error later, when that code actually runs.

> static typing enforces that you always use that function, and can't forget and accidently submit an unescaped string to the database.

So you are really just saying "static typing requires you to use static typing". This has nothing to do with actually writing good code or having any sort of validation. Just that the compiler tells you that you are sending the wrong type... that's what we are arguing about?

Look my whole point is static typing by itself gives you next to nothing (See my code example below) without some form of validation beyond static typing. That obviously holds true to dynamic typing as well... I'm not even sure what we are arguing about.

So when the Query is sent to the database MySQL actually receives a Query object and then parses that Query object?

...oh wait, right before it is sent to mysql it is turned back into a string again.

My point is that static typing doesn't help you do anything other than verify that the objects being passed are of a particular type. I'm not saying static typing is bad or good I'm just saying that type checking itself is NEARLY USELESS unless you include some sort of validation.

		Query q = new Query("select * from users where id = (id)");
		QueryParam qp = new QueryParam("(id)",25);
		q.addParam(qp);
		ResultSet rs = q.execute();
		public class Query {
			public ResultSet execute() {
			for(QueryParam qp : this.getQueryParams()) { 
				this.getSql().replace(qp.getId(),qp.getValue());
			}
			super.execute(sql);
			}
		}

> but static typing enforces that you always use that function, and can't forget and accidently submit an unescaped string to the database.

So you're saying it is impossible to do this without static typing?

Are we really talking about type checking or the larger circle of validation (of which type checking is just a small part)?

( Bugs found by unit tests ( ) Bugs found by input validation )

Or in other words...

String s = "lastname'; drop table user--";

...is still a perfectly acceptable string.

It seems to me that type checking is the simplest form of validation (are you an int, are you a String) and nothing more. It wont tell you if that int is positive or negative or if that string is an email.

When dealing with either static/dynamic languages I think more unit tests should be spent validating.

2004: http://www.processor.com/articles//P2651/07p51/07p51chart.pd...

2005: http://www.wired.com/science/discoveries/news/2005/08/68403?...

2007: http://www.cogniview.com/convert-pdf-to-excel/post/the-end-o...

2007: http://nick.typepad.com/blog/2007/04/brent_simmons_t.html

2007: http://www.codinghorror.com/blog/2007/06/who-killed-the-desk...

2008: http://www.cogniview.com/convert-pdf-to-excel/post/do-these-...

2009: http://allthingsd.com/20091119/chrome-the-end-of-desktop-app...

...Just a few examples. I'm just saying we've had this conversation quite a few times. Maybe this is the final nail, maybe it isn't.

That's easily solved

Have a slider. When you move it have a window that lists what applications can be served with the selected allotment.

Hell... that'd be pretty damn cool looking

Isn't this the same drum that has been beating since the days of desktop applications... for those old enough to remember when applications where actually run on a desktop OUTSIDE of a web browser ;).

Actually... even past the dark ages anyone remember the popularity of webpagesthatsuck.com?

No matter what the technology someone will need to do something that is out of the bounds of the 'stock user interface'. So you either account for it by allowing everyone to do anything or you limit it...

http://www.useit.com/jakob/constbook_preface_2nded.html

More pictures & Info: http://www.chipchick.com/2012/06/vizio-dives-laptop-all-in-o...

I'm not sure where to file this: Viral add campaign for Saygent or bored lawyers writing a TOS.

In either case, Saygent just won... oh I'll show YOU Saygent, I hope you like being on the front page of EVERYWHERE!

http://www.iana.org/assignments/character-sets

>The MIBenum value is a unique value for use in MIBs to identify coded character sets.

>The value space for MIBenum values has been divided into three regions. The first region (3-999) consists of coded character sets that have been standardized by some standard setting organization. This region is intended for standards that do not have subset implementations. The second region (1000-1999) is for the Unicode and ISO/IEC 10646 coded character sets together with a specification of a (set of) sub-repertoires that may occur. The third region (>1999) is intended for vendor specific coded character sets.

However that specific error (reference to entity "x" for which no system identifier could be generated) has this message:

>This is usually a cascading error caused by a an undefined entity reference or use of an unencoded ampersand (&) in an URL or body text. See the previous message for further details.

I notice this on one website that is using MIBEnumID:

<span

  class="st_facebook_large"  

  displaytext="Facebook"     

  st_url='http://www.hardrock.com/locations/cafes3/events.aspx?locationid=108&MIBenumID  
  

On a side note, now I understand why HN doesn't allow comments on job postings. This is a tough crowd.

> people who wouldn't dream of letting someone else take half their work

As someone who is routinely doing full stack development this phrase worries me. To be honest I'm more than happy to give someone half my work if they are talented. Are you making this point because...

A) The overhead is so low that you want "full stack" people to keep margins low (so by wouldn't dream you actually mean wouldn't expect).

B) You want people that are willing to silo themselves, not incorporating exterior feedback or following direction from someone that may have a better handle on the given task.

Wanting someone that does full-stack is nice, but do you REALLY want someone like that and WHY. I mean, this sentence "you don’t flinch at the idea of writing largely PHP for a living" flies right in the face of everything else. It is like saying the following:

Do you dream of creating time-tested architectures? Do you spend nights dreaming up the next great cathedral or monument? That's cool, so we want you to put in our bathroom tile.

You are asking for a dreamer, an innovator, a creator, a designer and an architect to .... primarily ... write .... php .

With that said, it is written very well and etsy is a pretty cool company so I'm sure you'll get plenty of hits.

What if amazon bought book.com and then sold subdomains? So harrypotter.book.com?

I don't really feel this... I guess this might be a horrible thing to say but "I don't really care".

It costs 100k to get a tld. So if Amazon takes .author then what about .writer? Or what about biographer, columnist, composer, creator, essayist, ghost, ghostwriter, ink slinger, journalist, originator, playwright, poet, producer, prose writer, reporter, scribbler, scribe, scripter, word slinger, wordsmith, work-for-hire, writer?

Is amazon going to take all of them? So what if they do? Does that suddenly invalidate FirstNameLastname.com/net/me/us/co.uk or FirstNameLastnameAuthor.com/net/us/co.uk?

I'm worried about the opposite trend. That is to say Amazon (or any other company) REQUIRING people to buy a certain tld before allowing them to use certain services (want to sell in the apple store you must buy a .apple tld, want to publish a book you must buy a .book tld)

>computationally prohibitive

yup it'd be a nightmare :)

I'm not sure if you could even sell users with large clusters... as the only way to generate a large cluster would be to generate more fake users around that cluster. So you'd have a large cluster of fake users. That or make good content that people cluster around... but then again that isn't gaming the system, just putting content next to people that want it.

This is the fundamental problem with a static point system.

Up/Down votes should be personal and entirely void from the process of agree/disagree. It should be about pushing individuals closer or farther away from your perspective.

I'd like to see something like Reddit that was more like a network. As you "downvote" something or someone you push yourself away from that network. As you upvote something/someone you push yourself closer to that network.

Then again, I also think thread titles should be editable via a wiki and people should be able to submit counterpoints and they should be given equal weight to the original post (not just a comment but right next to the original author's post).

The test will persist and always be there to test again where as a gauge will be a one time thing.

What happens next week when someone does an x += hugeBlockOfText in a loop?

I'd rather have a set goal and a test/process that validates it over a one time event where human error is involved. You want X process a million records in under three seconds? Build a test.

I'm not advocating one tool. I'm simply saying that everything described so far is better solved with a test first approach over a debug first approach. Build a test to replicate the problem. Solve the problem. Keep the test to prove that the problem is solved.

Fair point. On reflection my biggest problem isn't just tinkering, I don't mind that, but the fact that now when it fails it can fail HARD. That or it just wont have something supported (multi-touch, graphics, webcam)

It's good to know you got your zenbook working, I really like the keyboard and size on that laptop but the fact that I could brick it just makes me uncomfortable.

Meh, I think you are over-inflating the benefits of a debugger. Everything you described can be achieved through proper testing.

Want to know if something is efficient? Then build a test to gauge it. That way if it changes and becomes less efficient in the future your test will break. That's a much more solid approach than simply walking through the code a couple times and noticing something out of place.

(I posted this earlier... this is a little off topic)

https://help.ubuntu.com/community/AsusZenbook#Suspend

http://ubuntuforums.org/showthread.php?t=1774661

First off, I'm glad newegg will accept returns but we've got a HUGE problem in the linux community with these newer laptops. The problem isn't that newegg needs to accept our laptops but why these newer laptops are getting bricked by linux!

I want an ultrabook. I want something solid, fast, long battery life, great keyboard, great screen, lightweight and FLAWLESSLY running Debian. I can't buy that, I have to buy a MacPro. Yeah, my MacPro is nice and all (insert appletax joke) but I'd trade it in a HEARTBEAT for the equivalent running my distro of choice.

I wouldn't go that far.

The best way to learn something is through whatever method encourages you to learn.

For some that is starting from zero, others want to start at the highest level and work backwards, others start in the middle and jump around. Whatever can keep you interested.

I grudgingly agree. It is frustrating but something created while using an IDE tends to create specific ways of thinking.

For example, most IDE developers tend to love their debuggers... want to learn something? Just run the debugger! Want to debug something, hey run that debugger and watch 'dem breakpoints!

When I code without a debugger I tend to write smaller, easier testable code because I lack a real way to step through a convoluted process. I feel this encourages a simpler application (but I have no study to prove that).

Another example is most Java/C# work tends to be in the center of the unknown universe. You are editing something twelve layers deep in a mess of public/private/protected objects and you aren't sure if the item you should call is the MarginalFlowStateController or the ControllingMarginalFlowState... with an IDE you would just open up both of them, their unit tests, and any documentation until you discover which one you should be calling.

It bothers me because I really enjoy my vi/tmux development environment where every time I :w a file and run a test I am running on virtually the exact same environment as dev/qa/pre/prod.

>It is a matter of you messing with something you didn't understand, jamming the machine in a bag to overheat, and then having to replace the battery.

Wrong.

https://help.ubuntu.com/community/AsusZenbook#Suspend

>If this workaround not used, there have been reports that the laptop's memory controller setting may be screwed. After an incorrect suspend, if the corruption happens, many memory blocks starting with ~1G will be corrupt. Good way to see it is to use "memtest86+". The only way to fix controller setting is to open the case and plug off the battery. Please note that on this ultrabook the battery is not a user serviceable part and this could mean that by opening you can get your warranty void! If you start Windows or Linux with a corrupted controller, you will get system crashes or/and damaged file system. More info here: https://bugzilla.kernel.org/show_bug.cgi?id=42728 and https://bugs.launchpad.net/ubuntu/+source/linux/+bug/962798

Houses can be rented and apartments can be owned. Think of all the different local laws that might apply to someone that owns a condo, rents an apartment, owns a house, owns a townhome or rents any of these. Hell, even a HOA might have something to say about it. Then again you might rent from a person who doesn't care if you sub-rent out.

Having AirBNB try to determine if every single renter/homeowner has the rights would be a nightmare.

He's been wanting this since the mid-90's - not downplaying or being snarky, just making a point. This reminds me of Hero in Snow Crash.