bm98

That was a great talk! Notice how his entire career got launched from an internship at Tektronix. I love the bit about how he found his own troff macros in use at O'Reilly because a coworker had taken his code there years before -- and he appreciated that! One might say that the same kind of "80's hacker ethic" is what got him into trouble at Intel.

The Camel book was so well-written. It was my introduction to Perl, which became my "superpower" in the 90's and far longer into the 2000's than I tend to admit. I eventually switched to Python because it's the closest thing that is considered an acceptable "modern" choice. I really enjoy Python too, but the obligatory XKCD about Python[1] rang true for me about Perl first.

For me the #1 superpower strength of both languages is the first-class treatment and syntactic sugar for associative arrays (a.k.a. hashes, dictionaries).

Perl did the same for regexes and file I/O; Python did not.

I have come to appreciate Perl's backwards compatibility -- that old scripts still run unchanged -- though maybe that's largely because Perl 5 has been in maintenance mode for so long.

[1] https://imgs.xkcd.com/comics/python.png

Thank you for this article. One of the great frustrations of using Magit for Emacs is the inability to read things because the foreground and background colors for various things end up the same on some platforms.

From this article I found the command "toe -a" and was able to try various TERM values until I found one that makes Magit readable: vt100. This turns off colors entirely, which may not be pretty, but at least I can read everything now.

1982 Atari 800 here (was 8 years old at the time). I remember thinking the same thing at the time. When we first bought the thing, there just wasn't much I/O beyond the tape drive (and later the disk drive), and therefore the things we could do seemed very limited. It wasn't until we got a printer (a Star Micronics SG-10 dot matrix tractor feed) and a 300-bps modem that the world really opened up!

>The best memories I have was that probably, this was the first time I had that "feeling" of having built something useful to somebody. And certainly the best moment was when one of his suppliers who also accepted those coupons asked us for a copy of the program. Great times.

And then you go off to college, and one day the program stops working because of one problem or another, and they call you in the middle of studying for final exams, and that's when you learned about technical support and technical debt and all the things that make programming less fun!

Some people have recurring dreams in which they show up to school or work in their pajamas... my recurring dream is that some program I wrote in high school is still being used twenty years later, and they come calling because something broke...

Software lifetime is an interesting topic. See for example [1], a 1992 paper that surveyed business applications and found an average lifetime of about 9 years, with a maximum of 20 years and a minimum of 2 years. 2 years versus 20 years!

Things don't seem much different today.

On the one hand, HTTP, HTML, and producing HTML server-side in a language like Java or Python and with a SQL database isn't all that different now than it was 20 years ago. There are Java web apps developed in 1999 that are kept up-to-date and work just fine in 2020. On the other hand, there are applications developed with popular technologies a just a few years ago that are hopelessly out-of-date and in need of a rewrite today.

I see it as an end user too. I've been an ING Direct (now Capital One 360) customer for 18 years. The web app that I use in 2020 seems to do the same things as the one in 2002 (though it's slower today), but it seems like it's been completely rewritten at least three times.

[1] https://scholar.google.com/scholar?cluster=23826996884004375...

EDIT: And HN! 13 years old and counting...

_That_ is the question we should be asking. If not, is it because geofence warrants have a higher legal bar if issued to a phone company? Or is it about the level-of-effort?

I always thought the primary driver of the demise of Flash was that Apple simply decided not to support it in iOS Safari. Is that not right?

Walmart. I've been Amazon Prime for years, but whenever I need to buy something with a high risk of being counterfeit (printer ink is the most common one for me), I use Walmart - and it's free shipping from them anyway. Really the only difference is that Amazon usually gets it to my door faster.

To me this is the crux of the issue. And it's non uncommon in software development:

The developer fails to check for an error condition or raise an exception because doing so would add too much complexity to the system. So instead it is assumed (or hoped) that it simply can't or won't happen. Problem solved...

(Edit: Or that the user will just have to reboot if it happens.)

Tracking time is part and parcel of being a consultant, at least if you have multiple clients and overlapping work. After doing it for 15+ years, I've tried it all - everything from the spreadsheet, to the apps, to forgetting and having to go back and reconstruct.

I read this article and I think it's missing the point about what's so hard about time tracking.

What's hard is: Implementing the trigger on the context switch.

You're working on one thing, something happens and you make a context switch to something else - and in order to track your time, you need a trigger to fire to prompt you to record the switch. It doesn't matter if it's in a spreadsheet or an app or on a piece of paper - I find that my brain doesn't fire that trigger very reliably. Especially if I'm busy.

If someone can solve that problem with a fancy app, I'd be impressed!

I've said it in another thread [1]: I want a robot that watches me and quietly makes intelligent decisions about what I'm really doing, and tracks that.

[1] https://news.ycombinator.com/item?id=15790918

Standards like SMART-on-FHIR [1] and CDS Hooks [2] have the potential to allow innovation developed outside of Epic and Cerner inside of those products. Both of those vendors even have "App Stores" [3] [4]. So far, though, there aren't a lot of apps in these stores, and none of my doctors (all of whom work for large academic medical centers and use Epic) have access to any third-party apps - so I do wonder whether the vendors (or their customers) may be putting up roadblocks that are slowing adoption.

[1] http://docs.smarthealthit.org/ [2] https://cds-hooks.org/ [3] https://apporchard.epic.com/ [4] https://code.cerner.com/apps

Most new mice, yes. I use an original Logitech MouseMan 3-button mouse with no scroll-wheel. I realize I'm an outlier, but no mouse has ever come close in terms of comfort for me - so I continue to use it, and life has been just fine until the advent of the Overlay Scroll Bar.

I realize the benefits of the Overlay Scroll Bar to the majority of users who have scroll-wheels. But it sure would be nice if there was an easy way to revert back to the Normal Scroll Bar ("Classic" scroll bar?). You know, the wide bar that scrolls down exactly one page-length if you click outside of the bar? I've spent plenty of time Googling and in "about:config" and exporting environment variables like GTK_OVERLAY_SCROLLING=0 to no avail.

Interesting - it's part of the routine childhood schedule in the US but not in the UK. From NHS: "Why isn't the chickenpox vaccination part of the routine childhood immunisation schedule?"

https://www.nhs.uk/conditions/vaccinations/chickenpox-vaccin...

Time tracking. No matter how many fancy time tracking apps you use, it's still painfully manual. I want a robot that watches me and quietly makes intelligent decisions about what I'm really doing, and tracks that.

> "According to Lee Nackman, Chief Technology Officer of IBM's Rational division (originating in 2003) at that time, the name 'Eclipse' (dating from at least 2001) was not a wordplay on Sun Microsystems, as the product's primary competition at the time of naming was Microsoft Visual Studio, which Eclipse was to eclipse." [1]

[1] https://en.wikipedia.org/wiki/Eclipse_(software)#Name

Interesting to compare this to some of the "old school" solutions for converting web pages to PDF such as htmldoc[0] or html2ps[1].

[0] https://github.com/michaelrsweet/htmldoc [1] http://user.it.uu.se/~jan/html2ps.html

Glaring omissions:

11. Security vulnerabilities and attacks (and the fear of them) 12. Technical debt

In cases where I need to download and install unsigned software that's not available via package manager, I run hashes (MD5, SHA1, SHA256, etc.) on the downloaded file and the run Google searches on those hashes. As long as the software has been released for more than a day or two and it has a decent sized user base, the hashes will show up in various places such as fossies.org and will be cached by google. That would have protected against this particular attack.

EDIT: But in this case, the software in question is signed, so the (fallback) technique described above is not necessary. The download page [0] contains a GPG signature along with a link to the author's GPG public key. Checking the signature would have prevented the attack.

[0] https://handbrake.fr/rotation.php?file=HandBrake-1.0.7.dmg

I believe the "hoarding the fix" comment was in reference to the patches for Server 2003, XP, and Windows 8 that were released publicly for the first time over the weekend (but had been distributed previously to customers paying for custom support) [0].

[0] https://news.ycombinator.com/item?id=14329914

I'm a little surprised that the majority of the answers here are Yes!

I help my parents and my kids work with bookmarks but I have none myself; and I was beginning to think that bookmarks were primarily used by non-technical people. I guess I was wrong!

Everything I need is a simple URL (like, my bank: usaa.com - why would I bookmark that?) or a quick Google search away. If I come across a deep link that's so important that I want to keep it, I email myself the link along with maybe a short description, and it will be searchable forever.

My lack of bookmarks fits with the rest of my "online personality". I have 14,183 threads in my work email inbox and I do not file emails into folders like most of my colleagues. I do not have the desire or the time to manage email folders or browsing bookmarks.

Also, the fact that I browse in a "clean" browser instance in SELinux that saves no history from instance to instance probably contributes to my lack of bookmark use.

As a web developer, I wonder if this class of accessibility functionality renders the web accessibility guidelines [1] obsolete? Many of the guidelines have to do with organizing content and following rules that make it easier for older (inferior) screen readers to handle. But I just enabled this feature on my iPhone, and browsed some sites that I know are ridiculously noncompliant, and it handled them beautifully. Even guidelines having to do with describing photos and avoiding text in images could be rendered obsolete with some of the third-party apps that perform OCR and use AI describe photos.

[1] https://www.w3.org/WAI/intro/wcag

It's odd that the status pasted in the parent has disappeared from https://status.cloud.google.com/ , as the page seems to be designed to keep event history - but it's not in the history. I can still find it in Google's own cache, though - in the snapshot of the page as it appeared on Feb 24, 2017 11:19:38 GMT.

Ugh. A good and scary reminder of what's lurking around the corner for any of us at any time - including holidays and vacations (Linode's holiday attack last December comes to mind). IMHO, the emotional impact of breaches on the staff who respond to them is under-discussed. The author touches on it here:

> The discovery of a root cause is an important milestone that dictates the emotional environment an incident will take place in, and whether it becomes unhealthy or not.

> A grey cloud will hover over a team until a guiding root cause is discovered. This can make people bad to one another. I work very hard to avoid this toxicity with teams. I remember close calls when massive blame, panic, and resignations felt like they were just one tough conversation away.

I have a time tracking code called "HN". 33.19 hours logged so far this year. I think it's time well spent...

Maybe not favorite but "most memorable": "CVE-2014-6271: Remote code execution through bash" [1]

The top comment when I first saw it was, "If you are responsible for the security of any system, this is your immediate, drop-everything priority." [2]

Shellshock just kept going, and going, and for days you didn't know what was coming next. I suppose it's unfair to real PTSD victims to say this, but sometimes I feel like I have a little PTSD from that incident. I can only imagine what people at the center of it were going through.

My favorite blow-by-blow account was David Wheeler's essay [3] [4].

[1] https://news.ycombinator.com/item?id=8361574 [2] https://news.ycombinator.com/item?id=8361871 [3] http://www.dwheeler.com/essays/shellshock.html [4] https://news.ycombinator.com/item?id=8428644

Running your browser in Red Hat's SELinux sandbox [1] [2] limits the ports you can connect to and thus limits this type of attack to those ports (80, 81, 443, 488, 8008, 8009, 8443, and 9000 in the default configuration).

[1] http://danwalsh.livejournal.com/31146.html [2] http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-...

As I posted in a previous discussion of this two years ago [1]:

The very first comment below the article (correctly) contradicts the author's claims about SELINUX sandbox. The author acknowledges the comment, and criticizes the SELINUX implementation, but does not dispute the fact that SELINUX sandbox ("sandbox -X xterm" in RHEL/CentOS/Fedora/SL) does in fact defeat the keystroke logger attack described in the article.

[1] https://news.ycombinator.com/item?id=7607082

> a bad actor is purchasing large amounts of botnet capacity in an attempt to significantly damage Linode’s business.

I wonder what size investment this is taking, and what the end-game is for the bad actor. Unless Linode's mitigation tactics are increasing the bad actor's costs, what's to stop the bad actor from continuing the attacks until Linode goes out of business?

In many cases the decision to go with Oracle was made decades ago, and the cost of migrating large, legacy databases and codebases away from Oracle is higher than the cost of continuing to use Oracle. Oracle licenses can be very expensive, but migrating and rewriting and retesting working code can be even more expensive!

Also, Oracle is pretty good at achieving vendor lock-in. For example they introduced a rapid web application development platform called "Apex" [1] about a decade ago and shipped it with every Oracle database (even the "free" Oracle Express Edition). In my experience, developers who use it tend to like it, it does achieve rapid development, and there's really nothing else like it outside of Oracle. Once an organization has Apex apps, though, there's no migration path to Postgres that doesn't involve completely redeveloping the Apex applications from scratch.

Finally, despite all of the ways in which Oracle seems to be business and developer unfriendly, for a developer or DBA trained and experienced and entrenched in the Oracle ecosystem (and for whom license costs and sales tactics are not a concern), it's really not such a bad place to be IMHO. I personally would not choose Oracle for my own ventures but in the cases where Oracle has been chosen for me, I enjoy working in the ecosystem.

[1] https://en.wikipedia.org/wiki/Oracle_Application_Express

Fedora and Red Hat (+ the Red Hat clones like CentOS) have a "sandbox" command which uses SELinux to sandbox applications or entire X sessions and the applications inside them. For more info see [1] [2]. I've used it for a long time and it works well enough. It's not available in Ubuntu, though.

In Ubuntu the closest thing to it, I think, is AppArmor, but I've never tried it myself. Or you could run a virtual machine with Fedora and use SELinux there.

[1] http://danwalsh.livejournal.com/31146.html

[2] http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-...