HNHacker News
TopNewBestAskShowJobs

anyonecancode

1,167 karma · joined January 14, 2019

contact: user name: "hn" domain: "ppspost" tld: "com"
submissionscomments
anyonecancode··on Log4j 2.15.0 – Previously suggested mitigations may not be enough
Yup. Here's a concrete example -- my team owns a couple of java services. They're spring boot with slf4j as our logging wrapper, using the default logging implementation of logback -- we didn't opt for log4j. So we're good, right? Well, let's do a `gradle dependencies` and see if we're pulling it in transitively -- still good. See some `log4j-api`, but no `log4j-core`. We're not actually doing any logging with log4j -- the "api" is from spring to allow you to use log4j if you want. Again, we're not, so we're fine.

Oh, but it does turn out that we do have the elastic apm agent, and it has log4j as a shaded dependency. So not as free and clear as we thought, and damn hard to detect that.

anyonecancode··on Ask HN: I've lost faith in myself as a developer, how do I get it back?
What would drive me crazy is pointing out code that _clearly_ did not do what it was supposed to do and get back, at best, a shrug. I think I'm pretty open minded on most tech topics -- I started with PHP! If the code works I'm happy, everything else is gravy! -- but to have people insist that, no, this is fine and, yup, being on-call with services guaranteed to wake you up at 2AM at least once during your rotation and our stakeholders sending nasty grams once a month is just normal... crazy making.
anyonecancode··on Ask HN: I've lost faith in myself as a developer, how do I get it back?
It does sound like burnout, and also like not being in the right environment (which contributes to burn out). I had one job where there was a lot of technical debt, but my manager did not respect me and my colleagues had what was basically a "learned helplessness" attitude. So I'd go around trying really hard to make things better, but everyone responded to me like I was just crazy or naive or didn't know what I was talking about. Thankfully my previous job had been one where I had earned a lot of respect from my colleagues and managers, so I knew that I wasn't the problem, but even knowing that I found the doubt starting to creep in.

I left. My new job has lots of tech debt, lots of processes that are broken, but when I propose changes people listen. When I put in the work I can see progress. It's hard work and frustrating, but I know that it's because the problems I'm tackling are hard, not because I'm a failure or lacking. That's a very different environment.

I can only give a very broad bit of advice here -- having a positive, open environment is very important. Gaslighting will bring down even the most secure, confident person over time. If you can't change the environment, leaving to find a better one is the right thing to do. What that looks like will differ on one's situation -- might be a long break from coding, might be changing teams, might be changing companies. But we absolutely need people around us who believe in us to work sustainably.

anyonecancode··on What killed Haskell, could kill Rust, too (2020)
Haskell is neat, and is one of those things I'll regularly come back to play with in my spare time. A lot of the ideas behind it have made me a better programmer. Rust I've never touched, though it looks interesting. But:

- In my daily work, the work that pays my bills, I regularly use software built in Rust, eg ripgrep.

- About the only time I ever cross paths with Haskell is in those times when I'm going out of my way to do so as part of my tech hobbying.

I think that's an important difference

anyonecancode··on What happens to developers who never go into management?
Managers control the money. They hire, they fire, the approve or disapprove promotions. That's _fundamentally_ more power than writing code. It would be nice to be able to ignore this, but things like paying for housing, paying for kids' education, etc means you can't really just put that aside.

If you want to stay in a technical track, you need to offset your natural disadvantage here. You can't _just_ be writing code, you need to make sure you're actively -- and visibly! -- adding a lot of value as a tech lead. Even if you're not formally managing people, you're going to be coaching and mentoring engineers, because being able to tie your org's goals into a technical vision is the easy part -- the hard part is turning that vision into code that will be mostly written by not-you. And that's all people skills, involving people who do not report to you. IOW, there's still a lot of "management" work if you want to stay in the technical track.

I recently did a stint in the management track but have gone back to the technical one because I get a lot out of technical work and found I need that to sustain me and give me energy. I found I can do the management part, and didn't even mind most of it, but it wasn't sustaining me -- an important consideration since, while I've been working for a while, I have a long while to work yet. But it did help clarify where I need to grow if I'm committed to staying "technical".

anyonecancode··on Why Bitcoin is not a socialist’s ally (2020)
If controlling money means controlling speech, and so keeping money free from regulation is a strike against censorship, then I'd suggest the problem isn't over-regulation of money, but rather that somehow money == speech. Cryptocurrency seems to make that worse, focusing on protecting the freedom of wealth but doing nothing to break the unhealthy premising of freedom on wealth.
anyonecancode··on Why Bitcoin is not a socialist’s ally (2020)
> So IMHO crypto currencies are an aspect of hyper capitalism pretending to be something else.

Yes, exactly! The "problem" cryptocurrency solves is people with wealth having too many restrictions on that wealth.

I think blockchain technology is super interesting, and insofar as cryptocurrencies are an implementation of that technology they're interesting, but I'm very much not in agreement that they're solving any real problem that needs solving, and in fact the concept of cryptocurrency as money actually exacerbates an already bad situation. If one is worried about a small number of economic elite having undue influence over society, crypto is part of the problem, not the solution.

anyonecancode··on “It's not peaches and cream either for men”
Isn't one of the basic insights of feminism that patriarchy is bad for men, too?
anyonecancode··on Study: Hailed as clean energy but hydrogen produces ‘substantial’ emissions
(headline slightly modified to fit)
anyonecancode··on Facebook Renames to Meta
I assume this is short for "metastatic"?

--

Ok, acknowledged throwaway line. To try and save this and at least make this at least slightly more substantial -- I'm skeptical of VR becoming seriously mainstream, in the near term or perhaps ever. I'd say I hope FB goes all in and ends up burning up all their money, except I could see it being a profitable niche, giving them money to continue negatively impacting the mainstream non-metaverse online world.

anyonecancode··on EFF co-founder John Gilmore removed from org's Board
That's really interesting! When I first saw your comment I thought to myself "well sure, spam is kind of like this, but that's more about commercial/marketing," and on clicking the link and learning about Serdar Argic, I see that, actually, the first big spam incident was actually political trolling. Did not know that history.
anyonecancode··on EFF co-founder John Gilmore removed from org's Board
A nuance I see missing from the censorship/free speech dichotomy is around what's essentially DDOSing of speech. I think that the free-est speech has something equivalent to the voting idea of "one person, one vote." No one should be silenced, but also everyone should have equal representation.

In the same way that being very rich generally gives you effectively much more power than having a single vote, and so is a corruption of democracy, I think we see a similar thing with online discourse, where those with extra resources are able to essentially "flood the zone" and dominate the discourse.

So the question is what should be the effective response? Those pushing the censorship/free speech framing argue that removing voices is wrong -- banning, deplatforming, etc. That may be right, but it's also incomplete as it doesn't address the dynamic of the well-resourced voices overwhelming everyone else.

I don't know what an effective solution _is_ here, but I know what it _looks_ like -- all voices with equal access. I don't think the censorship/freedom framing gets us there.

anyonecancode··on Online abuse: banning anonymous social media accounts is not the answer
One interesting design choice on HN is that the user names are not very prominent. I often don't even notice them, skipping right past the user name and to the comment. So I do think what you're saying here is partly right, but not completely.
anyonecancode··on Online abuse: banning anonymous social media accounts is not the answer
I think the relevant property is not anonymity, it's accountability. The argument against anonymity is that it will make people more accountable, but that's not always true. Rather, it's the way an online community structures itself.

For instance, here on HN we have the ability to be anonymous (on a sliding scale -- people can say who they are in their profiles, or be completely anonymous, or somewhere in between, posting contact info so that with effort they can be tied to their offline identity). But compared to many online communities, there's very little abuse here, and I'd argue that's because there's accountability -- there are clear standards, and those are enforced both by the moderators and by the community itself. Whether you post as yourself, fully anonymously, or somewhere in between, there's a community standard that hold you accountable for your posts.

I, personally, highly value the ability to have online identities somewhat separate from my offline one. I'm not trying to hide anything, I simply find it freeing to be able to enter a community without dragging around the weight of previous personal history, and to be able to establish an identity specific to that community I'm participating in. I always found this one of the amazing things about the internet, and I've been saddened to see that undermined. At the same time, I absolutely try to be accountable for what I say online, I expect others to hold me to that, and I hold others to that standard. None of this requires I know someone's "real" name, or that they know mine.

anyonecancode··on As a whistleblower prepares to speak out, what can be done to rein in Facebook?
I actually do think that in most cases it should be for-profit -- I just think that the profit can't be derived from your audience. For instance, a cafe that does online and in person orders and ALSO has an online social media hub, where people gather and interact and are also able to purchase goods from the cafe, I think would work because it's a social hub where the users are truly customers.

I think some institutions might work -- a forward-thinking library whose website isn't just an announcements and catalog site, but an actual social media hub -- but I think that'd be rare.

I don't think, by and large, private individual sites as social hubs would really work, as there's not enough draw to bring in a sufficiently large userbase to become a social hub.

anyonecancode··on As a whistleblower prepares to speak out, what can be done to rein in Facebook?
Unless and until we come up with a different economic model for social media, we'll always have Facebook (or Twitter, or whatever successor toxic social media site comes next).

Plenty of people here on HN have argued that the real problem is centralization, and I agree. Take whatever specific issue one might have with FB -- let's say disinformation, for instance. We have all these debates about censorship vs free speech vs accountability etc. But in fact, if FB wasn't the behemoth it is, much of this would be moot. In a world where there were _only_ smaller, more niche social media sites, fears around things like online radicalization would be much less, and any well-founded suspicions of actual criminal conspiracies would lend themselves to much more targeted warrant-backed investigations rather than privacy-destroying giant electronic dragnets. And if this example doesn't work for you, pick another one and think through how a world of smaller, less influential sites would change what you see as the problem with social media.

But you can't brute force your way to that world -- that's pushing against a very strong current. So long as the economic model is to create a large, targetable advertising market, you're going to have very strong incentives for centralization and invasion of privacy.

Contrast this with non-digital social hubs -- say, a pub. People come for the socialization, but the actual product being sold is food and drink. Social space becomes a side effect, one that complements and enhances the business model (a pub with a reputation as a good place to meet friends gets more business), but the business model isn't data-mining your audience.

I think a social media network that focused on extending offline hubs into social spaces, where the economic model is attracting an audience to gather and chat and then _selling them something_, would mitigate the incentives to centralization and invasion of privacy. We need to tie social media to the selling of actual products; users need to be customers, not the actual product.

anyonecancode··on Lab-grown meat may never be cost-competitive enough to displace traditional meat
I'm not convinced that cattle ranching is always or necessarily the best use for much of that land, but I think the second point made was the more impactful one -- "growing animal feed." Much of _that_ land is either land that would be better suited for other purposes, or is land that we're intensely farming at high costs to the environment.
anyonecancode··on ‘Every message was copied to the police’
I always took this as "you're not a domain expert so you'll get it wrong", with the implied corollary that if you actually _are_ a domain expert, then you know what you're doing. IOW, hire bonafide domain experts rather than trying to cheap out.
anyonecancode··on Principles of Green Software Engineering
> So the incentives are generally aligned. When I deploy a system I want it to run on 5 servers not 50 for cost reasons not because I'm being green. If I'm being green by accident, that's a bonus.

I think that's the whole game right there -- figure out how to make sure negative externalities stop being external and become part of the cost. Then incentives will naturally align, as opposed to being at odds. In the case of your comment, you're noting they're already aligned, but overall I think many times they are not.

anyonecancode··on I Failed to Transform the Enterprise
In fairness, his audience was his manager, not the app's users. So it was perfectly rationale for him to push for the relatively easy re-write instead of worrying about the app's users, given that his manager was not a user of the app. As an engineer who finds value in making things people actually find useful, though, it was a pretty dispiriting experience.
anyonecancode··on I Failed to Transform the Enterprise
At one job I ran into this pretty badly. The team I joined had an internal app that was, basically, a bunch of forms connected to a database. It had a lot of problems -- the data models didn't actually map to what the business needed, the UI was unintuitive. My manager insisted that what we needed to do was rewrite the entire thing as a React SPA. I told him, well, we're just going to end up with the exact same problems, only now implemented in a different framework. This won't solve any of the actual problems. He insisted, though, saying that React was "modern."

Thankfully, the depth of mismanagement here was pretty exceptional in my experience. In most cases, even if I'm personally skeptical of the need for an SPA I can see a reasonable argument in favor. The cartoonish straight out admitting that the sole purpose was to be more "modern" with literally zero regard for actually serving any user needs is thankfully not something I've run across too often.

anyonecancode··on The Coronavirus Is Here Forever
I suspect the reason children are the hold up here is less around current data than around where we are in this pandemic and patterns of thought/risk assessment. Here's an analogy that maybe will work with the HN crowd. Say we've got a service that, for 75% of the API endpoints, often gets a severe error. 25% of the endpoints only very rarely get the same error. My team discovers that by applying one simple change to the 75% of the affected endpoints, their error rate drops dramatically. We can't, for whatever reason, apply the same fix to those 25% yet, but we're confident that within a relatively short amount of time we'll be able to.

Do we declare that the service is now working well and move on to other items? Maybe -- in a real setting it'll of course depend on what other priorities the team's juggling at the moment. Maybe this is "good enough" to move on. Still, I think we can all relate to the emotional pull to say "hold on, we still don't actually know why those 25% of our endpoints weren't affected as often. Something could easily change there so that we start seeing similar error rates. We have a fix on the way for this -- can we wait just a bit longer so we can roll this out?"

I think that's where a lot of people are. Again, one could certainly argue that we're close enough, but OTOH I think the reluctance to declare this "over" yet makes a lot of sense too.

anyonecancode··on GitHub’s engineering team has moved to Codespaces
I feel I'm swimming against the current of contemporary dev practices, but I actually believe trying to run as much of your apps and development locally is important. Not exclusively, but at least from time to time I think shutting off your network connection and seeing what happens is important. It flushes out all sorts of assumptions, especially around dependencies, you may not have realized you had. If you at least occasionally code in a local, non-networked environment, I think you end up with more robust code.
anyonecancode··on 2020 U.S. Migration Map
Related:

Where America’s developed areas are growing: ‘Way off into the horizon’[0]

(Washington Post -- paywall, sorry, but posting as relevant to this thread)

[0] https://www.washingtonpost.com/nation/interactive/2021/land-...

anyonecancode··on Climate change: IPCC report is 'code red for humanity'
Absolutely -- inequality has brought us to this pass, continues to be an obstacle, and will make the consequences far worse. Should we, as individuals, eat less meat, drive more fuel efficient vehicles, fly less, and other such activities to reduce our carbon output? Yes, but as many have pointed out in this and other discussions, that doesn't come anywhere close to being enough. It's the dynamic of the rich scolding people for a Starbucks latte habit, writ large.

Should the elite aggressively pivot their companies to carbon neutral strategies, divest their substantial investments from greenhouse gas producing holdings, put their political muscle toward laws that will get us off our current disastrous path, and fund this change via taxes on their wealth? Yes, and this would do far, far more to change things for the better.

If you can figure out how to make this happen, well you'll be some kind of sociological and political genius.

anyonecancode··on Climate change: IPCC report is 'code red for humanity'
> If there is anything covid has taught me its that collective action isn't something we can rely on and is a lot more wishful thinking about the state of humanity rather than a sober look at the reality.

If climate change plays out the way the pandemic has, I think we will have collective action, but it'll be uneven and fall short. We'll avoid the most dire outcomes, but blow right past acceptable outcomes. Many, many will die who could have been saved, the cost will be enormous, but we'll successfully avoid the absolute worst cases. I don't know if we call that a successful failure or a failed success.

anyonecancode··on Stupidity is a specific cognitive failing
> Trench warfare in the US Civil War didn't end in such a stalemate so there wasn't much precedence

I suppose this hangs on one's definition of stalemate, but I'd consider the nine months of the siege of Petersburg to qualify.

https://en.wikipedia.org/wiki/Siege_of_Petersburg

anyonecancode··on Why I Wrote PGP (1999)
I agree with you, but my hypothesis is straightforward -- it's the money. The internet in particular, but tech more broadly, is now a mainstream industry, generating and attracting a lot of money. In the US, even a poorly paid SWE, for instance, is almost certainly making well above the median income. Decently paid SWEs make a lot more, and well paid SWES... And of course those who actually employ well paid SWEs and are only paying their developers the least they can get away with, while still paying them a lot, are obviously raking it in.

There's good and bad in this, but it does clearly change things. When there's that much money on the line, ironically the stakes become higher and there's less genuine creativity and risk taking. The flip side is of course true -- too little money is a problem (I mean, I'm not about to trade my SWE gig for working in an Amazon warehouse as a means of spurring personal creativity), but given enough money past a certain baseline, things do change. There's a sweet spot at "enough money that people can feel free to be creative and take risks" and "so much money people are scared to take too many risks".

anyonecancode··on The Emacs Lock-In Effect or the Emacs Sunk Cost Fallacy
Interesting post. I'm ~6 mo into using emacs, but I'm a long time vim user. I use emacs for org mode and org-roam, and for personal finance[0]. And sometimes, magit for git. And honestly... I may never use it for much more beyond this, and that's totally fine with me. Which I suppose is the point of flexibility -- people can use a flexible tool in the way that works best for them. My contribution here is to note that its _also_ ok to decide a tool, even an impressive tool, is something you only want in a few specific contexts without feeling bad about not adopting it everywhere.

I think its working out that way for me because I'm not actually much of a tinkerer. I very much like the straightforwardness of plain text, and I like all tools that empower me to put that in the center of my workflows. I can take or leave emacs, but I love org-*. Actually not too different from how I got into programming in the first place -- being able to write a plain text file in a certain format, point my browser to it, and boom it's a web page, was magic. And from there into actual programs -- use a certain format and boom it does stuff... The tools themselves - eh. Keep it simpler and I'm happier, but I'm not much for customizing them.

I can see how for the tinkering personality one can really get into emacs. That's not me, but emacs works for me for some things, and I've been happy to learn it for those.

[0]https://github.com/beancount/beancount-mode

anyonecancode··on The UK’s delta surge is collapsing
I'd find it helpful if you provided some thoughts on determining what's reasonable and what's not reasonable to expect from future variants. As I understand it, a virus dramatically changing its mode of transmission -- say going from respiratory to a hemorrhagic fever -- doesn't really happen. But we also have a decent understanding of how covid gets transmitted now, so have some way to anchor expectations. You're saying it's not reasonable for covid to evolve to become more likely to cause illness in children. If that's true that's great news, but I really have no way to evaluate such a claim. Why is that unreasonable? Wouldn't we need more insight into why children are currently less affected to speculate on how reasonable it would be for that to change?

I notice your profile you have a biology background. I don't, and am guessing most people here don't either, so I'd find it helpful to get an explanation of why you find a change that puts children at more risk unlikely (and I bet others would too).

← PreviousPage 7 of 10Next →