HNHacker News
TopNewBestAskShowJobs

pjbster

176 karma · joined May 30, 2016

submissionscomments
pjbster··on Pinboard vs. Raindrop
Pinboard's performance was ultimately what led me to abandon it in the end.

I really like Firefox's built-in bookmark manager. It supports both hierarchy and tags and, if you export your Pinboard bookmarks to html, the file will include the tags which Firefox will preserve just fine when it imports everything.

I don't use Firefox as my day to day browser but all of my bookmarks live in there and I can search them from there much faster than any website. Those bookmarks live in a sqlite file which is easy to browse (good luck reverse engineering its schema though) so if anyone fancied knocking up a command line tool to search it I'm sure it wouldn't be difficult.

pjbster··on Balancing “If it ain’t broke, don’t fix it” vs. “Release early and often”
Odd that Kaizen doesn't get a mention here. The article draws battle lines between the two ends of the spectrum but there could be a middle way.

In Kaizen, "Fail Fast, Fail Early" would never get ouf of the gate. The game here is all about making other, smaller bets which gradually ratchet the company to a better place without ever having to come off the rope.

Perhaps this organisational conflict is rooted in the realities of burning through capital whilst still searching for a sustainable revenue model.

In many ways the idea of Scrum is very Kaizen-like. It mandates the idea of experimentation and measurement. With trying stuff even when what you have appears to be working. And with documenting failed experiments and moving on. Nothing risky about any of it but you wouldn't know it when you see the typical reaction to "how about we move the standups to the afternoon instead of first thing in the morning?"

The innovation pipeline described is encouraging but it's already too dogmatic in its proposed implementation. Kaizen is much more organic and, dare I say it, cultural. One of the key principles of Kaizen is empowerment and the innovation pipeline doesn't offer that at all.

pjbster··on Cull your dependencies
I was immediately reminded of this gem from https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-...

“You know their motto? ‘Find the dependencies — and eliminate them.’ They’ll never go for something with so many dependencies.”

pjbster··on The Twelve-Factor App (2011)
I'm not sure which vault we're using. There's no identifying information in the server responses. The storage type shows as "Consul" so that suggests Hashicorp Vault.

I'm not the person to ask how to set it up but it's seamless in use and can return data in json format which makes it easy to parse. If it were my money I'd look very hard at this product.

pjbster··on The Twelve-Factor App (2011)
I don't know and I don't need to know (I'm a mere dev -- no "ops" in my role). And, yes, this client has very high compliance requirements.
pjbster··on The Twelve-Factor App (2011)
The best approach I've seen is to have the secrets in a vault and to keep the vault URL in an env var (so different vaults can be used for dev and prod, for example). The secrets location within the vault is held in a variable defined in an application config file which is checked in to source control. At runtime, a piece of code consults the variable and queries the vault using the provided location and then dynamically configures the db connection with the returned credentials. The credentials are dumped from memory once the transaction completes.

(I should also point out that this is in a batch ETL system.)

The nice thing about this approach is that it is virtually impossible for secrets to end up in source control. The risk is that the vault becomes a major single point of failure.

pjbster··on Anna Kiesenhofer: Mathematician, amateur cyclist, Olympic champion
This isn't the first time something like this has happened: cycling aficionados will remember the tale of Robert Millar and the "stolen" 1984 Vuelta [1].

I personally love it when races are run without radios. The UCI tried to ban them in 2010 but the pro teams rebelled, claiming that they were essential for safety reasons; the number of crashes at the 2021 Tour de France would suggest that they aren't succeeding very well at that core function.

Radios make the races formulaic. Not necessarily predictable but certainly a different event. I can't think of any other sport where pros are held to different rules (i.e. allowed technical assistance) compared to amateurs.

[1] https://crankpunk.com/2012/11/09/robert-millar-the-case-of-t...

pjbster··on Excel Never Dies
Financial data migration. Big numbers down to many decimal places.

I lost days trying to locate a non-existent problem due to this "feature". Not to mention a stakeholder breathing down my neck.

pjbster··on Generalists vs specialists – Who has a greater chance of success? (2019)
Reminds me of the Cyrano de Bergerac line:

  Cyrano:  I was wandering in a maze
           I’d too many complicated paths to take:
           I took ...

  Le Bret: Which?

  Cyrano:  Oh! Of them all, the simplest one.
           I decided to be brilliant at everything, with everyone!
pjbster··on Excel Never Dies
I will never trust Excel for manipulating any real world data. Period.

Excel only keeps the first 15 digits of any number you give it [0]. If you want to keep the full number, you have to store it as text instead. And then you can't perform calculations with it without converting back to a number and losing fidelity.

The two most prevalent data types in business are numbers and dates. It's incredible that Excel is rubbish at dealing with both and yet the world thinks it's the gold standard for doing "business-y stuff" in.

[0] https://docs.microsoft.com/en-us/office/troubleshoot/excel/l...

pjbster··on Are We Really Engineers?
Software engineering is definitely a thing. But it's hard to define because, unlike a physical thing like a building which sits on a patch of ground which won't change much and which will sit there in atmospheric conditions which are unlikely to vary outside a known range, a piece of software is extremely sensitive to its environment. Pass in a single bad input (perhaps "unexpected" would be a better term) and an otherwise perfectly functional piece of code could bring civilisation to its knees. It's hard to rigorously prove your way out of that scenario.

Nevertheless, an engineering discipline would seek to identify all sources of unpredictability and tame them.

Engineering is "the elimination of guesswork". Let's see how some typical activities might be classified under this broad definition.

  - Installing a package from Npm and invoking some functions from it: Not Engineering.

  - Writing a function definition with a specified contract, a test suite to verify the contract is satisfied, documentation for users of the function, a characterised performance envelope, etc. : Engineering.

  - Downloading the source code for a function from Github and verifying that it satisfies the same function contract, passes the same test suite and offers satisfactory performance characteristics: Engineering.
But there's more to it than "just" this. The engineering discipline also encourages adherence to a code of ethics. Such as this one:

https://ethics.acm.org/code-of-ethics/software-engineering-c...

This code transcends managerial demands for shortcuts in the name of budget constraints or deadlines. Or it should do; professional engineers who are certified as such know that they can stand their ground and be given the full backup of a national organisation. An organisation which can fight a court case if necessary or blacklist an offending employer and cause other engineers to avoid working there. Whereas even the best software developers will be simply fired for any kind of professional pushback:

https://www.theguardian.com/technology/2020/dec/16/google-ti...

pjbster··on YouTube is streaming the first 19 James Bond movies for free
You should try to save Casino Royale. It's worth the wait and, after enduring the middle 6 or so, you'll appreciate just how much better it is than all that came before it.

Best opening credits. Best femme fatale. Most believable villain. It's all downhill from there.

pjbster··on SwiftNIO SSH
I am in the process of learning Vapor. You need to be comfortable with Swift closures as Vapor uses them everywhere. The SwiftNIO EventLoopFuture is prevalent too and there's a rich API over that which I'm still getting to grips with.

To my mind, the best learning resource is Tim Condon et. al.'s Server-Side Swift with Vapor (Ray Wenderlich publishing) but this book needs to be updated. Vapor 4 was released in April but the ORM (Fluent) and template engine (Leaf) weren't upgraded at the same time (June and November, respectively). The first half of the book was updated in September but everything else has been on hold waiting for the Leaf release. My progress through latter part of the book has been slow whilst I translate the examples and wrestle with the compiler errors brought on by my unamiliarity with the above concepts.

Tim C. is on the case and is very active and helpful on the forums so I expect the new version of his book will be finished quickly.

Anyway, to answer the question: Vapor should be nearly as productive as Rails once you become familiar with it. There's an offically supported MySQL driver for Fluent but no admin screen builder like you might find on Django, for example, so you'd have to put those together yourself.

pjbster··on Most Technical Debt Is Just Bullshit
The biggest contributor to technical debt is the mindset of "if it ain't broke, don't fix it". This gives everyone permission to just wait for issues to appear on the tracker before even looking at the code after it's gone live.

When issues do start to come in, the next blocker arises: the dreaded Cost Benefit Analysis. If a data fix can be applied in, say, 30 minutes and the business is seeing one of these every week, it's easy to live with the cost if the alternative is to spend 30 man-hours on pushing a fix through "the process".

(I'm talking about shops which haven't been able to move to CI yet. Shops which rely on a dedicated System Test team and a dedicated Release Management team. Shops which require downtime to ship fixes of any sort and which require a release slot booked at least 24 hours in advance.)

Furthermore, that 30 minutes of hassle making the data fix isn't felt by the manager whereas shepherding a fix through the release process most certainly will be.

A codebase that has been shaped over the years by this combination of mindset and process is probably too ossified to refactor by the time it's recognised as a problem.

Cue the "chains of habit..." quote.

pjbster··on Ask HN: Why can Apple out CPU Intel?
Intel could become dominant as a cloud service provider. They have the engineering resources and the facilities to build bespoke datacenters running servers built on their own SoC's running their own ISA on their own Linux kernel. Scrap the idea of selling cpus on the open market; they can optimise their silicon for cloud operations and make the margins on services.

If AWS or Microsoft decide they need to have an in-house fab capability, I wonder if Intel will become a takeover target?

pjbster··on The End of OS X
Am I the only one who wants to call it MacOS 11 Big Bottom? Any Spinal Tap devotees here? Oh never mind.
pjbster··on Every year I fill out this survey from Apple, for Apple developers
A "new" file is simply one which doesn't contain the licensee's signature.

Yes, there would be ways to game this approach by minimising the number of files saved but the price per new save could be set sufficiently low to make the inconvenience too uneconomical. And there might be users who need to create thousands of new files over the course of a year and who might be better served by a subscription model or a pricing cap.

pjbster··on Every year I fill out this survey from Apple, for Apple developers
I have been thinking about an alternative pricing model but it only works for content creation software. It would be enabled by an OpenPGP library which handles signing of files and micropayments.

What if the app itself was free but it charged a small fee the first time a new file was saved? The file format doesn't have to be proprietary - a simple chunk of metadata should be able to identify the creator and the files won't need to be tracked by a central authority because the mere existence of the signature in the file would imply that the one-off payment had already been made.

The canonical example is a rich Markdown editor. You could get the WYSIWYG conveniences à la Word and the resulting .md file would have a signature indicating that the app had saved it.

Subsequent edits by the author wouldn't incur a fee as the signature would match the app instance. But someone else with a copy of the app would incur a fee if they also used it to make changes of their own and their signature would be added to the file.

Someone else could edit the file with their favourite text editor. This wouldn't incur a fee. But the signatures would have to be preserved otherwise the original author(s) wouldn't be able to re-edit the file without incurring another payment.

Perhaps I'm being dumb but I think these files could be safely pushed to Github with the signatures intact. They'd be as secure as any public key.

I can see this working with many file types -- MS Office documents, Adobe Illustrator et al, 3D model files, PDFs, images, movies. The same file could be edited with different apps each saving their own signatures. All that's needed is something which disables the "File/Save" command unless a payment is made.

Is anyone aware of any software which works like this?

pjbster··on Scunthorpe Sans – a self-censoring font
Ah, now if you want to bring tribalism into this, here's the obligatory joke:

What are the only 3 English football clubs with swear words in their names?

1. Scunthorpe United, 2. Arsenal, 3. F*ing Man United!

pjbster··on Hidden Champions: Successful but little-known businesses
This scene from Cocktail includes some other ideas: https://www.youtube.com/watch?v=oHdUl8hHwKY

(None of those examples are on that list.)

pjbster··on An IT migration corrupted 1.3B customer records
Nice idea in theory but it can (and will) be gamed. For instance, the CIO will have an auditor sign off on a master checklist of yes/no items which the engineers will then be forced to self-certify any changes against. Any failures after that are "provably" due to engineering not being accurate in their assessment of checklist compliance.

What items might we see on such a list? Oh, I don't know... 100% test coverage, perhaps?

In the UK this is called Governance. Fancy word for what is, effectively, liability avoidance.

pjbster··on Decades of diesel use in Europe have created a public health crisis
The Kings College sensor data is visualised on this page: https://www.londonair.org.uk/LondonAir/nowcast.aspx

When I used to cycle in London I noticed that I struggled to recover at traffic lights. On one occasion I thought "this is it" because I simply could not catch my breath whilst my HR spiked. Most unpleasant.

pjbster··on The one-salary experiment, ten years in
3. I’m not sure how the accounting would work, but if we kept the salary the same and tied it to a quarterly bonus structure based on company profits, it could create a more direct link between short-term productivity and income. (That’s not really a fundamental change though… more like a nudge.)

Don't do this. This is the first step towards stack ranking and your 2nd-best developer walking out the door. Followed by the new 2nd-best after that.

I've never seen it tried but I think profit sharing should be allocated along salary share lines. So if you pay 20 employees an equal salary they should all get an equal share of the dividend. If an employee is actually paid, say, 7% of the total salary pot then they should get 7% of the dividend and everyone else would get their %-age share correlating with their %-age of the salary share.

If any rock stars feel they're owed "their fare share" since they did more contributing, then they should negotiate a mutually agreeable salary or find another employer who values them more in line with their expectations.

I'm aware that successful pro athletes expect individual performance bonuses. As do successful Large Company" employees. Whether this is just survivorship bias in action or not, I'm not qualified to say.

pjbster··on Superior Testing: Stop Stopping
I have two anecdotes about testing. First one was where I decided to refactor a function which had something like a 10-way cascading branch each of which had a compound test. Normally I wouldn't bother but, on this occasion, I wrote something like 60 unit tests in preparation for the exercise and one of those tests exposed a misplaced closing parenthesis in my solution.

The second case was where an in-house quotes engine was to be migrated to a SOAP service and some calculations needed to be ported. We didn't have access to the source so we created a small set of the most complex scenarios we could come up with and used those to generate calculator requests. I think we had 26 or 27 test cases and they each required non-trivial setup before the calculator could be invoked. Those cases exercised code which took the developer about 3 months to refine into a working solution.

So what does this reveal? I don't know. On the one hand, we had just under 60 unit tests which picked up 1 bug whilst, on the other, we had less than half that number of end to end tests which were sufficient to build a major piece of business functionality.

My gut feeling is that end to end testing is a better long term investment and unit testing is perfect for refactoring but inefficient for anything else.

pjbster··on Ten minutes a day
I miss cycling to and from work. I used to live 27 miles away from the office and I'd do that ride 5 days a week. Yeah it was 3 hours out of the day but the alternatives didn't add up to a whole lot less than 2 hours anyway so I didn't mind. But my fitness was incredible. I could jump on the bike at the weekend and do a hilly century no problem. I once did an Everesting challenge which amounted to 13 hours going uphill and I held several KOMs on local Strava segments.

But I had a bad collision which has kept me off the bike for 15 months now. When the doctors were attending me in hospital they had to double check my birthdate because they assumed I was 20 years younger. They wouldn't make the same mistake now -- I really feel like I've aged 10 years in that time.

pjbster··on Special Cases Are a Code Smell
Whatever happened to the Mechanism vs Policy mantra? It was all the rage in the nineties but perhaps X11 soured people on the idea.

Anyway, business logic is a perfect example of stuff that should go in Policy: functional, side-effect-free code (but not necessarily tidy or easy to read) which computes a value from a set of inputs. Like the parent says, effort spent optimising here may end up being a poor investment if the requirements change every year.

Mechanism code, OTOH, generally ends up containing all the side effects. It's harder to test so it tends to be dumb and, therefore, less susceptible to changing requirements. Optimisations here can pay off because the code lives longer.

Really though it all comes down to tests, tests and more tests. Automation is an asset and test cases outlive everything so make sure they work against the interface, not the implementation.

pjbster··on Prevent users registering with passwords from data breaches
I think every entity which holds a password should adopt the same policy: from the moment the password is created, the entity will undertake to do everything it can to try and break it. Whatever it takes - bot farms, 3rd-party white hat outfits, social engineering in the canteen, whatever. Anything (legal) goes.

Once the password is broken, the account will immediately be placed in suspense until the owner creates a new password. Which, of course, immediately gets fed back into the machine and life goes on.

This would eliminate password rules. If you want to create a password which consists of, say, 100 consecutive zeros, go for it. But you might only get to use it for a fraction of a second if the network can break it quickly.

pjbster··on Ask HN: What skills to acquire in 2019?
Not a list of "whats", exactly; more like a list of "whys": https://80000hours.org/
pjbster··on Ask HN: As a CTO, what is your most frustrating problem with technical debt?
Client access to database: too much effort to get stakeholder sign off for api changes and regression testing so we'll just grant the client full access to the database schema. Now we can't change the schema without breaking zero, one or many clients.

DBA deployment processes: insist on taking system offline for cold backup. Every. Single. Time. Solution: make application run dynamic code which is stored in a database table. Effect releases by issuing UPDATE statements. It's hard to argue that an Oracle database can't handle one of these reliably so the DBAs don't require cold backups for these. Still, we no longer have compiler support so our tests had better be solid. Bonus con: the DBAs cottoned on and started doing the cold backup thing for these updates so we lost business agility too.

Finally: a legacy web service. No toolchain but we do have WSDL and source. Ported to Weblogic in 30 minutes. Fits in with current infrastructure, more performant and gives company an opportunity to decommission the old box. But PM hasn't got a Jira for this work and we're already into integration testing so throws it out. The architect resigns.

Governance. A.k.a. Insurance-Against-Corporate-Liability. Responsible for at least 3 fucked up systems during my tenure there.

pjbster··on Ask HN: As a CTO, what is your most frustrating problem with technical debt?
Not a CTO and I've never come close to having a conversation with one. As a developer, though, I've been burned by tech debt too many times to feel comfortable with it.

The biggest problem with technical debt is that everyone has a different tolerance for it. Some even have an appetite for it. This is a breeding ground for conflict.

The next biggest problem is that the people who take it on are rarely the same people who end up paying it off. The former tend to get showered with kudos whilst the latter experience stress and poor performance reviews.

IMO the worst kind of technical debt is that which is taken on to route around a business process ("Governance"). So it, sort of, contributes to faster delivery but the conditions which drive the choice tend to persist until a regime change so the compromise sticks around forever.

In an ideal world, you should only agree to take on technical debt if you are also presented with a repayment plan. And that leads to my final problem with technical debt: most people tend to assume that that last part will take care of itself.

← PreviousPage 2 of 3Next →