Comment by fapjacks | Hacker News Reader

Comment by fapjacks | Hacker News Reader

I've been arguing about this for the last three days. Mostly around the reason that "complexity" is not strictly the same thing as "sophistication" when it comes to software. Noobs will conflate the two, but experienced programmers will agree that -- just to illustrate my point -- some code which solves a complex problem in a very clever way while also being very clean and easy to maintain will be considered strictly more sophisticated than some other code solving a similar problem which simply has a higher degree of complexity than the former. There is a subtle difference when it comes to software, and this subtlety needs to be considered in this question. Now, I think Stuxnet is a fantastic suggestion to this question, for a number of reasons:

1) The legal, ethical, technical challenges of creating the software.

2) The ability of the software to remain hidden in (sophisticated) environments rich with (sophisticated) organizations looking for exactly this kind of thing.

3) The stealth of the entire research, design, development, and deployment phases of the project.

4) The highly specialized nature of the target.

5) The scale of the entities involved.

6) All of this sophistication and we can't even see the source code (decompilation doesn't count).

This is frankly some impressively sophisticated software. Also, incidentally, the Quora poster's company looks like a fun place to work (with good programmers on the team). Some of his other answers are thoughtful and interesting to read, too, if you get the chance.

On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software.

In response, the US introduced an integer overflow bug that was uptime dependent, and took something like 6 months to hit. The bug simultaneously cranked up the pumps and closed all the valves in the network.

It was known that the Soviet economy would crash in under a year without the ability to cheaply move natural gas, so they couldn’t test long enough to find this.

A year or so later, the DoD’s seismographs detected the largest non-nuclear explosion in human history.

The main impact wasn’t the explosion or the short-term economic damage. The main impact was that the USSR stopped trusting stolen software, which set them way further back, economically and militarily.

Arguably, that ~one line of code was infinitely more sophisticated than stuxnet.

Do you have a source for this? I can only find reports from "At the Abyss", which are uncorroborated.

somewhat described in the book Victory, by Peter Schweizer

Wow I have never heard this story before! I had to look it up, for anyone else interested here's a quick wiki about it https://en.wikipedia.org/wiki/Siberian_pipeline_sabotage

> On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software.

I think this account might be a bit wrong. The one I read said that the CIA acquired a "shopping list" of Western technology that the USSR wanted to acquire. It included the pipeline control software, so they arranged for a trojaned version to become available to the Soviet shoppers.

Apparently this was a pretty common Soviet activity. Their electronics technology was behind the West's, in general. IIRC, many US semiconductor designs has little cartoons on the dies to taunt the Soviet reverse engineers.

Do you have a link to more info? Would love to read more but can't seem to find anything.

How do you even define sophistication in context of computer software? Let me try by defining the opposite. What would be unsophisticated computer program? I would say it is brute force algorithm. It is unsophisticated because it uses simple logic and iterative approach to achieve aim in inefficient manner. So sophisticated program is:concise(non-iterative), efficient (doesnt use too many steps to arrive at destination) and uses non-simplistic modeling of given problem. Anyone has anything better :)?

This didn’t actually happen, but it makes a good story that is often repeated.

http://jeffreycarr.blogspot.com/2012/06/myth-of-cia-and-tran...

Also, this story seems to be taking on a life of its own. You have some details that were not in previous rounds. Integer overflow based on uptime was not in the original unverified story.

I want to second this. The things I wrote throughout my career that I'm most proud of aren't very complex.

I find it very satisfying to understand a problem so well, up to the point you can find a simple and elegant solution to it. It makes the solution easier to reason about with other team members, and easier for the team to maintain it later. I see this as making your domain expertise available as a framework for the other team members.

This is my idea of sophistication in the software development world.

Simplicity is always a sign of a quality solution. I’m not sure why anybody would ever conflate complexity with quality or sophistication. I wrote some very complex code in college, but it wasn’t very high quality.

To date, my most complex piece of software in terms of how it was implemented was a simple calculator written in my first programming course. About a week before I started it, I had learned about regular expressions (the programming construct, not the formal language construct).

The basic implementation was a calculator that could add, sub, mul, div, pow, and sqrt. Bonus points were awarded for adding additional functionality including lettered variables. It started with a relatively clean shunting-yard implementation, but my use of regular expressions quickly fixed that.

My calculator worked under most circumstances, but that thing is an eye sore. I'll never get rid of that source code. I like to go back and look a few key pieces of software I've written through the years.

Yes, in my experience, solving a problem / feature well involves three steps:

1. Get the code to work 2. Clean up the code 3. Simplify the code

1 is self explanatory. 2 involves removing any logical redundancy, separating and cleaning the logic into methods, etc. 3 involves simplifying logic and logical mechanisms.

Most developers only do step 1 and maybe step 2. Step 3 is where beauty comes in.

If I could organize my thoughts around this concept, it would probably make a pretty good article. I don't know who the source is but a good quote goes something like this, "real genius isn't solving the complex, it's solving the complex in a simple way."

“Any fool can make something complicated. It takes a genius to make it simple.”

I made a poster with this for my office wall.

This fits perfectly with my own experience. The 3rd pass is always the one that makes the difference in terms of code that just feels nice/clean.

Indeed. I think that the mark of sophistication is not complexity but irreducible complexity. Sophisticated solutions are those that have been reduced to their simplest form.

I'm wondering why do you think this is true? Using stuxnet as an example, would it not be better if they used every feature within reason that would add to the likelihood of success? Why does reductive elegance make an application of technology superior to an inelegant solution? Does final effectiveness not overrule the developer's aesthetics?

I'm asking in honesty, not using the question to merely attack your opinion. I recognize there are things I have probably not considered.

Referring back to my natural gas pipeline example, just install the nasty centrifuge control software at the factory.

It is easier and more likely to succeed. Also, stuxnet has now been repurposed by multiple governments and criminal organizations. So, it’s creators built a symmetric capability, and gave it to their adversaries, when they could have used asymmetric capabilities that are more expensive to reproduce.

[edit: Also, it is still well within the Iranians’ capabilities to build a bomb, and our recent foreign policy greatly increases the chances that hard liners will take over and restart the program.

Contrast this to the outcome of the broader cold world strategy, which was a regime change to a relatively US-friendly government.]

Irreducible complexity sounds like an incredibly high bar.

If you are a state actor, it's not difficult to gather a couple of programmers from the "antivirus" and security field and build something that is hard to detect.

It would be impressive if it was the work of a teenager but it's not.

You also somehow need access to the industrial grade target platform in some way shape or form which is not something a teenager has lying around in their room nor extensive knowledge about to this extent.

You can buy the Simatic PLCs they targeted on ebay for a few hundred bucks.

Industrial automation stuff like this is a common part of the "technical high school" curricula where I live. (of course only on the "press this button and then that happens" level)

> not something a teenager has lying around

Ha, generally true probably, but in my case as a teen I got my hands of a bunch of old industrial PLCs and built all kinds of interesting things in my room. :-) Ladder logic is how I got started programing, I didn't even have my own computer back then.

The SCADA stuff was novel and interesting though and goes above and beyond your average malware both in what it did and the idea to do it in the first place.

A really creative hack, so to speak. (or destructive? anti-destructive? shrug)

And just to reiterate. They built a rootkit that stealthily sabotaged an effort to build nuclear weapons in a way that just made it look like the people who were trying to do it were just incompetent...

If that's not cool, I don't know what is...

Yeah, you understand exactly what I was trying to convey when I wrote the article. Thanks.

Reply on news.ycombinator.com