bgbntty2

I'm not a good programmer by any means, but here are some ideas that have helped me along my journey:

* pick a language. It doesn't matter which one. A popular one will have more tools already built for it and a bigger community;

* learn the basic grammar of the language - it's usually trivial, unless it's your first language;

* understand what kind of algorithms and data structures exits and what problems they solve. You don't need to implement them yet, just know they exist;

* find something interesting to work on, if you can. Are you interested in something specifically? Do you want to know how to make a game or how to automate some everyday tasks, for example?

* find something your friends are contributing to or working on, and ask them questions;

* search online whenever a though pops up in your head. Not only for references from a manual, but for best practices and even open-ended questions. If you're not sure if something is correct, search for articles or comments that say it's wrong or that it's dangerous or that it's the best. Don't rely on 1 source of information. If you're using AI, ask it to give you links so you can read what actual people wrote. Don't feel inferior for making 50 search queries in an hour and writing 10 lines of code;

* take time to set up your environment. Look for ways to make it better, to automate a lot of what you do. It may be boring, but it will save you a lot of time down the road;

* try different technologies, languages and tools. Some suck objectively, some will suck for you personally. Don't stick with the first thing;

* look for similar threads elsewhere so you get more suggestions;

* learn how to freely acquire books and papers that are behind a paywall;

* take your time and enjoy the process.

About 10 years ago I was regularly withdrawing small sums of money every month, looking a bit poor, with old clothes, sometimes a bit torn or dirty. The bank teller just offered to give me a pair of winter shoes. I felt uncomfortable so I didn't take them, but thanked him anyway. I could've used them, but I think he probably offered them to someone else later on who needed them more than I did.

I didn't have any prior relationship with him, except going to him to give him my ID so I can get the money a few times.

I think school ruined fiction books for me. I had to read long boring books about stories that didn't interest me, with useless sentences describing what the scene looked like or what someone had for dinner. Most of the stories and themes were outdated and didn't have enough context to make them understandable. Some books even used outdated words and phrases.

Maybe if I wasn't forced to read a book in an outdated language about some Christian farmer 300 years ago while I was not in school, and if I could access a succinct version 1/10th of the length of the book, I'd read it.

Maybe if I wasn't asked to describe minor details to prove I read the book, I'd actually focus on the story and not on every irrelevant detail.

Maybe if my teacher didn't force their religious holier-than-thou attitude and allowed us to form our own opinions, I'd be more engaged.

What school taught me was how to get away with not reading the books. I skimmed books by skipping tens of pages at a time or asked friends for the TL;DR or just got an F.

Now I have a feeling of uneasiness and dread when I try to read fiction for fun. So I don't.

Most 300 page fiction books I had to read could've easily been condensed to 30 pages without any loss of information.

Being forced to read and memorize poetry was the absolute shit. A lot of people won't care about poetry no matter how hard you try to force them to like it. And half of it was propaganda - how $nation survived $struggle, how $nation is so great or beautiful or how $hero did $ethical_thing.

This is a (very) rambling comment since I added things to it as I watched the video.

I think the state of the current Desktop UX is great. Maybe it's a local maximum we've reached, but I love it. I mostly use XFCE and there are just a few small things I'd like changed or fixed. Nothing that I even notice frequently.

I've used tiling window managers before and they were fine, but it was a bit of a hassle to get used to them. And I didn't feel they gave me something I couldn't do with a stacking window manager. I can arrange windows to the sides or corners of the monitor easily with the mouse or the keyboard. On XFCE holding down alt before moving a window lets me select any part of the window, not just the title bar, so it's just "hold down ALT, point somewhere inside the window and flick the window into a corner or a side with the mouse". If I really needed to view 10 windows at the same time, I'd consider a tiling window manager, but virtual desktops on XFCE are enough for me. I have a desktop for my mails, shopping, several for various browsers, several for work, for media, and so on. And I instantly go to the ones I want either with Meta+<number> (for example, Meta+3 for emails), or by scrolling with my middle mouse on the far right on my taskbar where I see a visual representation of my virtual desktops - just white outlines of the windows relative to the monitors.

Another thing I've noticed about desktop UX is that application UX seems follow the trends of website UX where the UX is so dumbed down, even a drunken caveman who's never seen a computer can use it. Tools and options are hidden behind menus. Even the menus are hidden behind a hamburger icon. There's a lot of unnecessary white space everywhere. Sometimes there's even a linear progression through a set of steps, one step at a time, instead of having everything in view all the time - similar to how some registration forms work where you first enter your e-mail, then you click next to enter a password, then click next again, and so on. I always use "compact view" or "details view" where it's possible and hide thumbnails unless I need them. I wish more sites and apps were more like HN in design. If you're looking to convert (into money or into long-term users) as many people as possible, then it might make sense to target the technological toddlers, but then you might lose, or at least annoy, your power users.

At the beginning of the video I thought we'll likely only see foundational changes when we stop interacting with the computer mainly via monitors, keyboards and mice. Maybe when we start plugging USB ports into our heads directly, or something like that. Just like I don't expect any foundational changes or improvements on static books like paper or PDF. Sure, interactive tutorials are fundamentally different in UX, but they're also a fundamentally different medium. But at 28:00, his example of a combination of window manager + file manager + clipboard made me rethink my position. I have used clipboard visualizers long ago, but the integration between apps and being able to drag and otherwise interact with it would be really interesting.

Some more thoughts I jotted down while watching the video:

~~~~ 01:33 This UX of dragging files between windows is new to me. I just grab a file and ALT+TAB to wherever I want to drop it if I can't see it. I think this behavior, to raise windows only on mouse up, will annoy me. What if I have a split view of my file manager in one window, and other window above it? I want to drag a file from the left side of the split-view window to the right one, but the mouse-down wont be enough to show me the right side if the window that was above it covers it. Or if, in the lower window, I want to drag the file into a folder that's also in the lower window, but obscured by the upper window? It may be a specific scenario, but

~~~~ 05:15 I'd forgotten the "What's a computer?" ad. It really grinds my gears when people don't understand that mobile "devices" are computers. I've had non-techies look surprised when I mention it, usually in a sentence like "Well, smartphones are really just computers, so, of course, it should be possible to do X with them.". It's such a basic category.

Similarly, I remember Apple not using the word "tablet" to describe their iPad years ago. Not sure if that has changed. Even many third-party online stores had a separate section for the iPad.

I guess it's good marketing to make people think your product is so unique and different than others. That's why many people reference their iPhone as "my iPhone" instead of "my phone" or "my smartphone". People usually don't say "my Samsung" or "my $brand" for other brands, unless they want to specify it for clarity. Great marketing to make people do this.

~~~~ 24:50 I'm a bit surprised that someone acknowledges that the UX for typing and editing on mobile is awful. But I think that no matter how many improvements happen, using a keyboard will always be much, much faster and pleasant. It's interesting to me that even programmers or other people who've used desktop professionally for years don't know basic things like SHIFT+left_arrow or SHIFT+right_arrow to select, or CTRL+left_arrow or CTRL+right_arrow to move between words, or combining them to select words - CTRL+SHIFT+left_arrow or CTRL+SHIFT+right_arrow. Or that they can hold their mouse button after double clicking on a word and move it around to select several words. Watching them try to select some text in a normal app (such as HN's comment field or a standard notepad app) using only arrow keys without modifiers or tapping the backspace 30 times (not even holding it down) or trying to precisely select the word boundary with a mouse... it's like watching someone right-click and then select "Paste" instead of CTRL+V. I guess some users just don't learn. Maybe they don't care or are preoccupied with more important things, but it's weird to me. But, on the other hand, I never learned vi/vim or Emacs to the point where it would make me X times more productive. So maybe what those users above look to me is what I look to someone well-versed in either of those tools.

~~~~ Forgot the timestamp, it was near the end, but the projects Ink & Switch make seem interesting. Looking at their site now.

Pretty much for everything, except for things that are already tied to my real world identity like email and a few sites that know who I am.

It accomplishes 2 things:

* I'm not tracked as much. Less data points for the companies to gobble up.

* More Tor users lead to better anonymity for everyone as it's easier to blend in - you won't be the only one wearing a mask at the club every weekend.

I got used to the latency. It's not that bad. Some sites load instantly, others take 1-2 seconds. A few take a while.

Sites from one regional hosting provider in my country just don't load at all. I get "Server not found". I'm not sure how that works - are they blackholing an ASN or using something else with BGP?

The main issue for me is not the latency, though, but the CAPTCHAs and 403's (HTTP Forbidden). If I were to search for a recipe, for example, I'd open 5-10 of the results in new tabs (with the middle mouse button; idk why people use CTRL+click), then close the ones with "Attention Required" or "Forbidden" so I'm left with 3-5 usable sites. That way I always have something to read. When I open a few sites one after the other, at least one will usually load instantly.

I haven't used Tor without Whonix on Qubes OS for a while, so I'm not sure if the latency is different on a standard OS with just Tor Browser installed. My workflow is that I use disposable VMs for different things I do. Right now I have a VM with HN and a few links I've opened from it and another VM with other research I started earlier today that I plan on finishing a bit later. When I'm done with my HN session, I'll close this VM, which will destroy it. For me this compartmentalization is good not only for security and privacy, but for productivity, as well.

A better metaphor would be that Tor and VPNs are like wearing a mask in public. It's obvious that you're trying to be anonymous, but you're still wearing a mask, so no one knows who you are.

You may be denied entry to certain establishments, but some of the bouncers don't block all masks and if you're persistent with changing your mask (Tor or VPN exit node), there's a good chance you'll get in. CTRL+SHIFT+L works on Tor Browser to change your circuit. The linked article blocks Tor, but after pressing CTRL+SHIFT+L a few times, I was able to read it.

For the sites that don't let me view them via Tor, I can install FoxyProxy and try some IPs from the free public lists. Lots of sites that block Tor don't block these IPs, although it's a bit of a pain. Another option is to load an archived version of the site on archive.org or archive.md (or .is or the various different TLDs it uses).

As for HN - it sometimes gives a "Sorry." if you try to access a certain comment directly, but after a few tries it works. This account was created over Tor and I've only accessed it through Tor. I think my first comment was dead and someone vouched for it, but now my comments appear instantly.

I've heard that banking sites don't work over Tor, but I haven't had a need to use Tor for banking, as the bank already knows who I am pretty well.

Most of the big social media sites don't allow Tor, but if I wanted to create a fake account, I'd most likely buy a residential proxy.

So it's not that bad, considering what you get from Tor (and with some VPNs, depending on your threat model) - no tracking, anonymity and so on.

You mentioned "on your phone". Is it only for phone OSes? A depressing "download from the Google Play Store or the Apple App Store only" app? Are UK citizens required to have it?

> Doctors prescribe "sildenafil," not "Viagra".

Depends on the location, I guess. I've had doctors prescribe trade names, which I don't understand if there are alternatives with the same dosage, route of administration and similar inactive ingredients. Not even talking about the "do not substitute" prescriptions which are also based on dubious information most of the time.

As for "sildenafil" - I don't think generic names are usually meaningful. Usually the suffix relates to the category of the drug, but the first letters seem as random as the letters in trade names. I could imagine a world where the generic name is viagrafil and the trade name is Silden.

Facebook has never had a consistent policy with what's allowed and what isn't. They haven't banned several obvious scams I've reported, but have banned a post that contains a picture of dog medicine (a blister of pills). The vague reason given was that it (could've been?) related to recreational drugs or something like this.

It's different. You show an ID card to a human if you don't look old enough. They look at it and return it. The ID card doesn't get scanned or tied to all your future recreational drug purchases - you don't have an account or a trail that identifies you.

When uploading ID documents, your account gets tied to your real world identity. That's not a precedent the government should be setting, because private entities having an excuse (the law) to require identification erodes privacy, and because in the future other services could be required to ask for an identification, too. Yes, it's the slippery slope (aka "boiling the frog") argument, but that's how laws that erode privacy evolve - step by step.

Now it's account for social media, then it's porn sites, then it's forums where you might see porn or discussions on suicide, drugs or anything deemed morally hazardous. They might require an ID just to view the site or require the site to not make it public. If (or "when", if we don't oppose such laws) enough countries mandate something like this, most sites will likely require an account for all content, regardless of where the person is located, as otherwise they'll likely have to prove that they've not only geolocated the IP of the visitor, but checked that they weren't using VPNs, Tor or similar services.

As for using zero-knowledge proofs and similar technology to make it less infringing on privacy - I very much doubt the government (any government) to implement this with 100% privacy and security.

Empathy towards what, in this case?

I think there's no "you", just an illusion that there's this uninterrupted "you"-ness from birth to death. It's a very useful illusion for the most part.

I view life (in the philosophical sense; consciousness) as the stream of subjective experiences (qualia) that arise out of life (in the biological sense; neurons and such). Right now my life consists of a collection of sustained interest in this discussion, a little hunger, the qualia of seeing the screen and the realization that I'm sitting a bit uncomfortably. In a few moments "I" will be a collection of other ephemeral qualia.

There's no "real" continuation between one experience and then next, just like there's no real continuation between my past "self" and my future "self", but they're both extremely useful illusions. I'll eat to subside that hunger that was registered a moment ago or change my position to get comfortable. I'll be responsible for "my" previous actions, as well. I'll basically be able to function as a temporally continuous being.

On the topic of immortality, I'd like to be virtually immortal so I can pursue my goals indefinitely. If I stop having goals or feel like I've had enough, I could always kill myself. My goals arise from my ethics, my biological needs and probably many other things. Why would I be OK with biology and death preventing me from achieving my goals at some arbitrary age?

So for me "immortality" is both being able to continue the illusions of self indefinitely (which I admit, feels good intrinsically), and being to continue the pursuit of my goals indefinitely. The goals seem to actually have more "real" continuity than "I" do.

The most troubling thing with immortality is the biological imperative to live that makes suicide so hard. But I think after a few centuries many people will reach that point. It's not a bad thing, it's just a personal choice.

I agree it's not an effective ad for most people and will likely damage their brand. Shitty ad from a business perspective. One more reason to like it.

As much as I hate McDonalds and think they should go bankrupt, and as much as I hate ads in general, I enjoyed this one. It's funny, it has lots of small clips of things going wrong one after the other. Compared to the standard corporate ads with a long family- and Jesus-oriented message that pretend to give some significance to Christmas besides how it affects their profits, this one is bold and different.

Who cares if it's made by AI and has obvious mistakes? It's not the new Star Wars movie where it's expected to focus on VFX issues. It's an ad - a 30 second clip that will run for a while to get people to buy products. If you can make an ad with AI for less money, why do it without AI?

As for the message - we need more of this. It's kind of a taboo to hate Christmas, but I loathe it and everything about it. And so do many people. Maybe they won't say that in the office or around religious family members, but we do exist.

You can't escape the shitty Christmas jingles that start in late November in almost all stores. You can't escape The tacky decorations, especially the blinking lights. If you mention the wasteful spending of taxpayer money on city decorations, people look at you as if you're crazy. You have to fight the implied obligation to participate in the celebration and to exchange gifts; having to tell people not to buy me anything. And the religious aspect of it, even though it started as a pagan holiday - people showing off how Christian they are even though a lot of them only remember their faith in twice a year. And finally, the commercialization of it - corporations pretending to care about it while trying to make everyone buy more products...

I agree - the statement could've been much more convincing. But it's above the threshold for me.

Although I agree if the new maintainer had some creds, it would've been better to use them in a similar reassurance like in your example. But it's hard to really vouch for someone, even if they've made X commits for the past Y years, etc.. Lots of examples here.

If it's still a random/(pseudo-anonymous) account you're trusting, unless there have been some real life appearances or if it's an account that's been proving itself for years, you can only trust them so much.

Basically I agree the message could be interpreted as "I don't trust them, so I'll be on the lookout for anything malicious", but, honestly, at first I just read it as "I trust it, but you can't really trust anyone, so I'll still be on the lookout".

Seems like a statement to reassure users who don't necessarily have any trust in the new maintainer. And even if the users trust the new maintainers, it's better to have the reassurance of previous maintainer on top.

Trust is not transitive, nor should it be. We (the users) trust the previous maintainer. They trust the new one. We don't (naturally). The old maintainer says they'll review the new one's work, so we'll have trust the old maintainer (mostly).

Not that the whole trust system can't improve in various ways in general. But for now we have to trust someone.

> You get backups, file synchronization, real time collaboration.

Shouldn't backups and file sync be handled at a higher level of abstraction? Unless every employee is only dealing with Microsoft Office documents and nothing else (doubt it), shouldn't there be a separate backup&sync strategy already in place?

There are a myriad of both FOSS and corporate backup/sync tools available.

As for the real-time collaboration - I'm not sure how important that is. Writer/Word seem like useful tools for documents that have reached their final state before being prepared for printing. I think there are lots of better formats suited to real-time collaboration. Intuitively it seems like text-first documents (markdown, etc.) should better lend themselves to tools like diff or git, or any other collaboration tool, especially a real-time edit tool. It's almost like asking for pdf to support real-time collaboration. I'm not sure about Writer, but Word and pdf documents are awful with regards to edits and git-style collaboration. They're formats for presentation, not editing. In case someone here hasn't delved into the internal structures of the files, remember how WYSIWYG HTML editors jumbled the HMTL beyond recognition? It's similar in that it doesn't seem like the format we want to collaboratively work on documents before finally converting them to Writer/Word/PDF.

I've been using LibreOffice Calc and Writer for years. I've used Microsoft Office Excel and Word, too.

I can't say I've ever suffered from my choices or that I missed any features. As for "polish" - that's subjective, isn't it? I can access all the features I want quickly and efficiently. It's a tool, after all.

There are some minor bugs with Calc that I'd rate 2/10 in importance - annoyances mostly. I haven't used Excel in a while, but it had annoyances, too.

But even if Microsoft Office is more polished and feature-rich, I still think that the trade-off is worth it - we get data and software sovereignty, privacy and cost savings. The workers need to relearn how to access feature X in the menu or how to live without feature Y.

It doesn't sit right with me that a government body has an ad account in a centralized for-profit service in the first place.

Even having a free account seems wrong to me. The European Commission could post news, updates on its work and polls on the official European Commission site. I don't think the government should favor corporate social media sites or have anything to do with them in the first place. If they feel like posting on their own site is not enough, why not use a free social media outlet? Something self-hosted, using ActivityPub, for example?

Precisely - they view security as just one part of many of their business, instead of viewing it as one of the most important parts. They've insured themselves against a breach, so it's not a big deal for them. But it should be.

The more casualties, the more media attention -> the more likely they, and others in their field, will take security more seriously in the future.

If we let them do nothing for a month, they'll eventually fix it, but in the mean time malicious hackers may gain access to the PII. They might not make it public, but sell that PII via black markets. The company may not get the negative publicity it deserves and likely won't learn to fix their systems in time and to adopt adequate security measures. The sale of the PII and the breach itself might become public knowledge months after the fact, while the company has had a chance to grow in the meantime, and make more security mistakes that may be exploited later on.

And yes, I know it may be a crime - that's why I said I'd report it anonymously from now on. But if the company sits on their asses for a month, shouldn't that count as a crime, as well? The current definition of responsible disclosure gives companies too much leeway, in my opinion.

If I knew I operated a service that was trivial to exploit and was hosting people's PII, I'd shut it down until I fixed it. People won't die if I make everything in my power to provide the test results (in my example of medical labs) to doctors and patients via other means, such as via paper or phone. And if people do die, it would be devastating, of course, but it would mean society has put too much trust into a single system without making sure it's not vulnerable to the most basic of attacks. So it would happen sooner or later, anyway. Although I can't imagine someone dying because their doctor had to make a phone call to the lab instead of typing in a URL.

The same argument about people dying due to the disruption of the medical communications system could be made about too-big-to-fail companies that are entrenched into society because a lot of pension funds have invested in them. If the company goes under, the innocent people dependent on the pension fund's finances would suffer. While they would suffer, which would be awful, of course, would the alternative be to not let such companies go bankrupt? Or would it be better for such funds to not rely so much on one specific company in the first place? That is to say, in both cases (security or stocks in general) the reality is that currently people are too dependent on a few singular entities, while they shouldn't be. That has to change, and the change has to begin somewhere.

I'm not well-versed in compilers, so it was a bit surprising to see how it optimizes all the add_vX functions.

What I most enjoyed, though, was how the guy in the video (linked at the bottom of the article) was typing - a mistake on every few characters. Backspace was likely his most-used key. I found it encouraging, somehow. I know typing speed or correctness isn't really important for coders, but I always felt like I'm behind others with regards to typing, even though when I really concentrate, I do good on those online typing tests. Even when writing this comment, I made like 30 mistakes. Probably an useless comment, but it may give some people hope or validation if they feel like they not great typists.

I'm a bit conflicted about what responsible disclosure should be, but in many cases it seems like these conditions hold:

1) the hack is straightforward to do;

2) it can do a lot of damage (get PII or other confidential info in most cases);

3) downtime of the service wouldn't hurt anyone, especially if we compare it to the risk of the damage.

But, instead of insisting on the immediate shutting down of the affected service, we give companies weeks or months to fix the issue while notifying no one in the process and continuing with business as usual.

I've submitted 3 very easy exploits to 3 different companies the past year and, thankfully, they fixed them in about a week every time. Yet, the exploits were trivial (as I'm not good enough to find the hard ones, I admit). Mostly IDORs, like changing id=123456 to id=1 all the way up to id=123455 and seeing a lot medical data that doesn't belong to me. All 3 cases were medical labs because I had to have some tests done and wanted to see how secure my data was.

Sadly, in all 3 cases I had to send a follow-up e-mail after ~1 week, saying that I'll make the exploit public if they don't fix it ASAP. What happened was, again, in all 3 cases, the exploit was fixed within 1-2 days.

If I'd given them a month, I feel they would've fixed the issue after a month. If I'd given then a year - after a year.

And it's not like there aren't 10 different labs in my city. It's not like online access to results is critical, either. You can get a printed result or call them to write them down. Yes, it would be tedious, but more secure.

So I should've said from the beginning something like:

> I found this trivial exploit that gives me access to medical data of thousands of people. If you don't want it public, shut down your online service until you fix it, because it's highly likely someone else figured it out before me. If you don't, I'll make it public and ruin your reputation.

Now, would I make it public if they don't fix it within a few days? Probably not, but I'm not sure. But shutting down their service until the fix is in seems important. If it was some hard-to-do hack chaining several exploits, including a 0-day, it would be likely that I'd be the first one to find it and it wouldn't be found for a while by someone else afterwards. But ID enumerations? Come on.

So does the standard "responsible disclosure", at least in the scenario I've given (easy to do; not critical if the service is shut down), help the affected parties (the customers) or the businesses? Why should I care about a company worth $X losing $Y if it's their fault?

I think in the future I'll anonymously contact companies with way more strict deadlines if their customers (or others) are in serious risk. I'll lose the ability to brag with my real name, but I can live with it.

As to the other comments talking about how spammed their security@ mail is - that's the cost of doing business. It doesn't seem like a valid excuse to me. Security isn't one of hundreds random things a business should care about. It's one of the most important ones. So just assign more people to review your mail. If you can't, why are you handling people's PII?