Hacker News Reader

Comment by ajarmst | Hacker News Reader

That's a fair point, (and +1 for PlatformIO). And that is sort of the argument I sometimes find myself making: the Arduino Hardware is delightful. It's the ecosystem that has emerged around hobbyists that is problematic. It may just be early teething pains of something that will become remarkable. But right now, we find ourselves spending a lot of time walking back bad habits and lack of understanding of fundamentals when students show up with "projects" that involve a "schematic" that is really just a photograph of a breadboard, and the introduction of complex parts without ever consulting a data sheet, based on random code just pulled down over the Internet. And I've seen commercial products that are at about the same level of quality. The problem may be that Arduino is too forgiving.

View on HN

s/Arduino/Node.js/g

It's exactly the same problem. These platforms make it really easy (too easy?) for people who don't really know what they are doing, to quickly build up something that is functional, but without then understand the underlying concepts. Grab this library, copy and paste from this tutorial, change a few lines and boom! You have a blog or IoT weather station.

And that is bad because?

It's bad when people that don't really understand what they're doing release products, but I didn't know that was the case with Arduino. I've used it for learning/prototyping without ever having any intention of creating the final product with it (or at all really).

That's bad when have tons of connected buggy, unsecured devices powering botnets. Not that I blame hobbyist for that, but such mindset that "hardware is easy" should not prevail.

The thing is, if you wait till you know things to start learning, you will not learn at all. This is quite visible in programming - people who assume "it is complicated" or try to learn all basics before doing things have low changed of becoming programmers. Whether they came to that conclusion alone or someone gave them that advice, "don't do stuff until you know what you are doing" is bad advice for students.

It also filter out precisely the people who tend to listen to advice.

Meanwhile, people who confidently do crap despite not knowing anything, make mistakes in the process, but can eventually learn to become good.

Mistakes are fine, and expected as someone is learning, but when you put something out there that has severe security problems, that's... a problem.

I don't have a good solution to that. Certainly a lot of the frameworks out there have security bolted on as an afterthought, or, at best, just don't make it easy to build things that are secure by default.

But ultimately it comes down to the author of the code to take responsibility for the security of the code they throw out there and promote as something people should use. And that's the crux of it: I want people to experiment and learn, but there needs to be a way to keep those sorts of people from building (or perhaps just distributing or promoting) things that (unintentionally) harm others, at least until they're knowledgeable enough to avoid doing that.

It is surprisingly hard to find good advice on how to code securely beyond absolute basic advice. And a lot of it even bundled in things that are good engineering/process (use linter, code review), but lead to security only indirectly. Code review wont make code more secure if reviewer does not know what to look for when doing said review.

The way it works is that general advice I have seen many times is "don't do it". Finding how to code securely or comprehensive list of insecure patterns is much harder. So, people inclined not to follow advice and the ones with huge ego are the ones attempting to create security related software.

I am not saying that I have instant solution, but strategy of discouraging people from trying does not work well. Promoting good beginer level write ups would work better.

----------

Nevertheless, the original topic was arduino and doing circuits while being unable to read schematic. That is seen as a problem, because they did not learned theory before doing 5V dummy circuits.

And I think it is as good start for learning or getting interest as any.

"Finding how to code securely or comprehensive list of insecure patterns is much harder."

The problem is not only secure coding, actually, I'd argue that it's not even the biggest concern. You can produce the most secure code on the whole world, but that won't matter if your device has an unprotected or easily brute forced telnet access by default. Loose default security settings and permissive access is the key concern imho.

If you want to learn how to secure software then learn how to hack. It will give you an insight into the tools and techniques used to breach systems and especially give you an insight on how many attack vectors there are.

Kali Linux and the tutorials for that are the Arduino of hacking.

I'd suggest that upwards of 95% of arduino projects are not accessible via any kind of network connection.

Also that around 95% of arduino projects are useful in educating & encouraging people around small microprocessor / electronics projects.

Lol...there are ALOT more buggy , unsecured devices on the internet that are made by companies with "professional" programmers. Look at the crappy DVR's and Webcams coming out of China, not to mention the buggy and perpetually exploitable software that companies like Microsoft and Adobe produce ( and sell for profit) I agree that inexpensive and easy to use developer boards make it easier for a hobbyist to screw up, but the things that are doing the most damage on the net are not hobbyist items.

I've made the argument that the Arduino is great for quick and dirty projects (a colleague builds stuff for Escape Rooms that only ever exist for a few months using them), and for trying out ideas when you already know what you're doing. They're less valuable as a tool for learning that stuff, if only because of the Wild West nature of the ecosystem.

Learning by experimentation is a perfectly valid way of learning. You can't force people to learn in depth but, if you want to, there's no problem gradually deepening your understanding over time by trying stuff and thinking about it.

That hasn't been my experience. In fact, I spent months finding an appropriate MOSFET to drive some LEDs because the random ones I spent a month waiting for couldn't switch fast enough. That taught me right quick to read datasheets to make sure I get what I need.

These days, however, I recommend the ESP8266, not so much the Arduino. You lose the shields' flexibility, which may put people off with the steeper learning curve, but you gain a lot in capability.

The problem may be that Arduino is too forgiving.

Isn't that the same argument for using xml over html?

It's the same argument for putting Republicans instead of Democrats on the bench. Whether or not you find that argument compelling doesn't really affect whether you find another one similarly structured to be similarly so.

Reply on news.ycombinator.com