smarks

In my earlier message [1] I described the evolution of the PEM Encodings API in a way that prevents applications from being exposed to the risk of runtime exceptions arising from future additions to the list of permitted subclasses.

[1]: https://news.ycombinator.com/item?id=50148756

The discussions around the PEM Encodings API also led my colleagues on the langtools team to write an article "Preparing for Change: Safe Switching over Sealed APIs" that discusses these issues in more detail. [2]

[2]: https://openjdk.org/projects/amber/guides/exhaustiveness-gui...

The article focuses on pattern matching and exhaustive checking, because this is an important feature for a large class of applications.

As a library designer, though, I'm primarily interested in the use of sealed classes to control subclassing. The old idiom for controlling subclassing of concrete and abstract classes was to ensure that all constructors had package access or less. This mostly prohibits subclasses outside the package. (Strictly speaking, it prohibits such subclasses from being compiled or instantiated.) For interfaces, it was formerly impossible to control subclassing at all. The addition of sealed classes to the language solves the problem completely.

Indeed, in the JDK we've converted all the uses of the older idioms to use sealed classes. [3] (This bug covers most of the changes; there are a handful of others that were converted individually.) Of the several dozen examples here, it doesn't look to me like ANY of them are candidates for pattern matching. This probably reflects the long-standing issue of subclassing control in object-oriented systems. That issue has existed in Java much longer than pattern matching. As time goes on, I expect the JDK class libraries to introduce more new APIs that make use of pattern matching and sealed classes.

[3]: https://bugs.openjdk.org/browse/JDK-8283414

The article (which seems to be from 2026-04-24 based on its URL) refers to the JDK 26 version of the PEM Encodings API. [1]

[1]: https://openjdk.org/jeps/524

The article points out a potential pitfall with how this version of the API exposes a sealed class. If the application has an exhaustive switch expression that lists all permitted subclasses, and a later JDK release were to add a new permitted subclass, this would potentially expose the application to a MatchException at runtime.

In the JDK 27 version of the PEM Encodings API, JEP 538 [2], we’ve adjusted the permitted subclasses of the sealed class in question to include a non-public permitted subclass.

[2]: https://openjdk.org/jeps/538

This prevents applications from using an exhaustive switch expression by enumerating all permitted subclasses. This allows the JDK to extend set of permitted subclasses in the future without exposing applications to the risk of unexpected exceptions.

I don't know, but I did observe differences in power consumption caused by all sorts of unexpected things.

At some point during all my fiddling with this stuff, I discovered a correlation between GPU power consumption (as indicated by iStat Menus) and fan speed. For example, if I switched to high resolution, the power would increase, and at low resolution, power would decrease. And of course more power means more heat, which causes the fans to run. That kind of made sense: moving more pixels consumes more power.

But I also observed an effect caused by refresh rate. Oddly, I seem to recall 30Hz would cause increased power draw but 60Hz the power draw was reduced. Yes, this seems counterintuitive. Since I didn't have a good model for what caused the increased power draw, I decided to try all combinations of the settings. On a lark I tried inverting the image and it actually affected the power draw! Probably has something to do with the access order of memory, but I don't really know. And indeed it seems odd that running the image upside down actually pulled less power than right side up.

The cabling issue was a bit more complicated. My initial configuration was to run the video through a dock, with the dock's video output going to the monitor. That always resulted in high power draw. Connecting the computer directly to the monitor did have the effect of reducing power draw... but only in certain configurations.

Oh yeah, I forgot about the graphics.

I had (and still have) a 4k external monitor. Naturally I wanted the MBP to drive the monitor with a resolution that took advantage of all the pixels. Unfortunately with most monitor settings the GPU power consumption would produce enough heat to run the fans even if the rest of the system was completely idle! If I set the output to full HD the GPU would cool down and the fans would turn off. But full HD on a 4k monitor is a waste.

It was very strange. I could drive the monitor at 4k but with the image upside down, and the power consumption would be low. But flip the image right side up and it would run hot and turn on the fans.

It took a couple weeks of fiddling, but I finally found a combination of refresh rate, resolution, image orientation (right side up!), and cabling that let me drive the monitor at high resolution without running the fans. What a pain.

(I used iStat menus to monitor GPU power consumption. At “good” settings it consumed about 5w. At “bad” settings it would consume 17w. At a bad setting you could immediately see the various temperatures go up and the fans spinning up to compensate.)

I saw this title and I immediately thought “SCCS”. Indeed, the article is a deep dive into the SCCS data structures. Cool!

I actually still use SCCS… sort of. I have some old code bases that are stored in SCCS. They’re actually Sun CodeManager/Teamware repositories, which used SCCS for file storage. I don’t actually update any files in SCCS; I use it only for browsing history. These old repos have been converted to git, but somehow I find it harder to trace through the history in the converted repo.

Instead, I use the open-sourced version of SCCS commands that the late Jörg Schilling ported to various OSes from the OpenSolaris/SVR4 source base. The guy was a real fan of SCCS. He even gave a conference talk on it once. Kind of retro computing, but for software instead of hardware.

https://news.ycombinator.com/item?id=28832682

Warming up a 2019-era (Intel) MacBook Pro was never my problem. Quite the opposite. Those machines ran notoriously hot. The later macOS releases, combined with company-mandated crapware, made it worse. Doing an ordinary build or starting a videoconferencing session was enough to cause the fans to run. On a warm day the fans couldn’t shed enough heat and so the system would go into thermal throttling. The OS would occupy a core with a 100% kernel_task that didn’t do any work but which would serve to prevent actual work from being scheduled onto that core. When four or five out of the six cores were occupied by kernel_task, I knew I was in for a bag of hurt (to steal a phrase from Steve Jobs). Responsiveness went completely to hell. The machine became effectively unusable.

After a while my normal procedure was to run with the thing sitting on top of an ice pack. That would let me run a 60-90 minute video conference without troubles.

The only redeeming feature of these machines is that they could emulate old x86 hardware at speed. That allowed me to run old apps on old OSes without having to keep old hardware running.

I took another look at L.H.S. and the buildings have rather more octagons than hexagons. There’s even a decagon-shaped building. Still, the symmetric geometry of the architecture is quite striking.

Thanks for your explanation; it’s very helpful.

Part 2 shows this comment from the Linux TCP code:

    /* As outlined in RFC 2525, section 2.17, we send a RST here because
     * data was lost. To witness the awful effects of the old behavior of
     * always doing a FIN, run an older 2.1.x kernel or 2.0.x, start a bulk
     * GET in an FTP client, suspend the process, wait for the client to
     * advertise a zero window, then kill -9 the FTP client, wheee...
     * Note: timeout is always zero in such a case.
     */

Ok, so the RST is explained and well justified by the literature. But what are the “awful effects” of sending FIN instead? Can someone explain?

I rewatched this recently; I think it held up well. It’s probably re-entered the zeitgeist given the recent developments in “AI” and “agents”. So far accidents seem to have destroyed only data, but it’s only a matter of time before some fool hooks up an “AI agent” to a missile.

Much of the film was shot at the Lawrence Hall of Science in the hills above Berkeley, California. This building was probably chosen because of its unique brutalist hexagonal architecture. I spent a bunch of time there as a kid.

Eric Braeden (Forbin) is still alive, but his house in Pacific Palisades burned down in the 2025 fires. :-(

Oh! This is a great explanation, thanks. I remember your original exchange (and I found it baffling and uncharacteristic), and I remember the William Shatner SNL Trek convention sketch, but I never made the connection between them.

I believe the definitive analysis of the Therac-25 incident was written by Nancy Leveson, first in IEEE Computer,[1] and later as an appendix of her book.[2] The appendix is freely available as a PDF on the web [3][4] and probably other places. Many people here are asking questions about what happened and how it came about. The answers to many of these questions can be found there. I strongly recommend that anyone who is serious about safety and wants to learn more about this incident read Leveson’s analysis.

[1]: N. G. Leveson and C. S. Turner, "An investigation of the Therac-25 accidents," in Computer, vol. 26, no. 7, pp. 18-41, July 1993.

[2]: Nancy Leveson. Safeware: System Safety and Computers. Addison-Wesley, 1995.

[3]: http://sunnyday.mit.edu/papers/therac.pdf

[4]: https://web.mit.edu/6.033/2014/wwwdocs/papers/therac.pdf

Thanks for posting this. The Leveson article is IMO the definitive study on this incident. I’m going to repost at top level for emphasis.

You encountered this book in 01996? Is that around the time of the Norman Conquest?

I'm assuming you're using octal here. Myself, I haven't used octal since 03677.

:-)

I see you mentioned https://interlisp.org/ ; while it's not a Lisp machine, the Medley Interlisp Project aims to recreate the Interlisp environment that ran on Xerox D-machines up through the 1980s or so. Still very interesting.

There's a meta-problem here, which doesn't seem to have been discussed. How did the setting change in the first place? The article says:

> Then, seemingly out of nowhere...

> In my case, the “Wake for maintenance” option was disabled...

So presumably the option was originally enabled. Somehow it was disabled, resulting in the battery-draining behavior. Re-enabling it manually solved the problem. Great.

But how did the setting get changed in the first place?

I've noticed this on my Macs (actually mostly the new one; not the old, obsolete ones I still run) as well as various iOS devices. At some point I'll notice some odd, unusual, or different behavior. Hunting around in the settings, I'll sometimes find an option that seems like it should control the behavior. Changing the setting has the desired effect of restoring the former behavior. So what changed it? It's a mystery.

A memorably egregious example was the "do not disturb" setting. I normally have do-not-disturb enabled from 11pm to 7am on my phone so I'm not awakened by notifications. But one night I was awakened at 3am by my phone buzzing, because some random text message had arrived. Huh?!? The next day, working on my Mac, it seemed unusually quiet... maybe a lot of people were on vacation or something. Then I checked Slack and there were a lot of messages pending, questions put to me that went unanswered, and even speculation that I had gone on vacation. What happened? My Mac had somehow set itself to do-not-disturb from 9am to 5pm, which covers most of the workday. And my iOS devices also had do-not-disturb set for the same incorrect time interval. (Well at least I got a lot of work done.)

In this case I suspect iCloud settings synching was the culprit. My conjecture is that I logged into my iCloud account from a new device, and that device's default settings got synched to my other devices. But I'm not entirely sure.

I know I've had other cases where settings seemed to be changed spontaneously. My speculation is that OS updates will change settings. Unfortunately this isn't reproducible, and it happens rarely and with different settings. But it's happened enough times over the past couple years that it seems to be a pattern. Maybe it happened to the OP. Does anybody else experience this?

This is a very old argument. Xah Lee wrote the linked article around 2008, but previously he had posted "Why we have cons?" on comp.lang.lisp (and comp.lang.scheme) all the way back in early 1998:

https://groups.google.com/g/comp.lang.lisp/c/T_Tozq2P53I/m/N...

Lee's post seems more of a question, but to my eye it's a "why X" question that thinly disguises an "X is bad (or ugly, redundant, useless, confusing, counterproductive, unnecessary, etc.)" argument. Essentially though it's the same topic.

The post elicited around 60 responses, among them this one from the late Erik Naggum:

https://groups.google.com/g/comp.lang.lisp/c/T_Tozq2P53I/m/g...

which includes the following gem (or turd, depending upon your point of view):

  > All in all, the pairs notion is redundant.
  
  I hope you understand and appreciate what I have written above so the
  following does not apply to you anymore. you see, I wrote it all because
  I _really_ wanted to say that that sentence is the single most ignorant
  and shallow-minded line that I have ever seen in any programming language
  newsgroup or forum and I hope _never_ to see anybody display such utter
  disregard for the brilliance and genius of people who came before them
  just because they grew up in an age when "simple interface" is sneered
  and laughed at in favor of "simple implementation" so any dumb fsck can
  implement it right out of a "for Dummies" book.

From where I sit in 2025, I have nothing to add.

“Somehow, Dark Helmet has returned.”

All this is true. Note also that the C++ folks are putting a serious effort into reducing UB. See the "safe by default" section of this writeup [1]. See also my other comment [2] regarding the performance impact of this sort of change. Short answer: with sufficient optimization, smaller than one might think.

[1]: https://herbsutter.com/2024/08/07/reader-qa-what-does-it-mea...

[2]: https://news.ycombinator.com/item?id=43779449

I'm a bit distant from this stuff, but it looks like C++26 will have something like -ftrivial-auto-var-init enabled by default. See the "safe by default" section of [1].

For reference, the actual proposal that was accepted into C++26 is [2]. It discusses performance only in general, and it refers to an earlier analysis [3] for more details. This last reference describes regressions of around 0.5% in time and in code size. Earlier prototypes suggested larger regressions (perhaps even "horrendous") but more emphasis on compiler optimizations has brought the regression down considerably.

Of course one's mileage may vary, and one might also consider a 0.5% regression unacceptable. However, the C++ committee seems to have considered this to be an acceptable tradeoff to remove a frequent cause of undefined behavior from C++.

[1]: https://herbsutter.com/2024/08/07/reader-qa-what-does-it-mea...

[2]: https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2024/p27...

[3]: https://open-std.org/jtc1/sc22/wg21/docs/papers/2023/p2723r1...

There are similarities in the problems, but there are also fundamental differences. With inlining, the JVM can always decide to deoptimize and back out the inlining without affecting the correctness of the result. But it can't do that with tail calls without exposting the program to a risk of StackOverflowError.

We've been using TCO here ("tail call optimization") but I recall Guy Steele advocating for calling this feature TCE ("elimination") because programs can rely on TCE for correctness.

The security manager was removed (well, “permanently disabled”) in Java 24. As you note, the permissions available at any given point can depend on the permissions of the code on the stack, and TCO affects this. Removal of the SM thus removes one impediment to TCO.

However, there are other things still in the platform for which stack frames are significant. These are referred to as “caller sensitive” methods. An example is Class.forName(). This looks up the given name in the classloader of the class that contains the calling code. If the stack frames were shifted around by TCO, this might cause Class.forName() to use the wrong classloader.

No doubt there are ways to overcome this — the JVM does inlining after all — but there’s work to be done and problems to be solved.

ConcurrentModificationException is typically thrown from an iterator when it detects that it’s been invalidated by a modification to the underlying collection. It’s harder to check for the case described in this article, which is about multiple threads calling put() concurrently on a non thread safe object.

Interesting. I haven’t seen an infinite loop either, but I can imagine one if a comparator tries to be too “clever” for example if it bases its comparison logic on some external state.

Another common source of comparator bugs is when people compare floats or doubles and they don’t account for NaN, which is unequal to everything, including itself!

In Java, the usual symptom of comparator bugs is that sort throws the infamous “Comparison method violates its general contract!” exception.

Hey! A fellow Wang 2200 veteran!

Updated RFC for JSON: https://datatracker.ietf.org/doc/html/rfc8259

Good reference! Turns out this internet draft has been turned into an official, informational RFC:

https://datatracker.ietf.org/doc/html/rfc9413

I don't think Postel's Law was necessarily a bad idea, in its time and context. However it seems to have fallen into usage as an argument-ender. This RFC is a useful antidote to that.

> Yes, there were a few "dumb" terminals that were simply paperless teletypes

Ah yes, the proverbial "glass TTY." There were a few years in the late 1970s where printing terminals (actual Teletypes such as the ASR 33, and matrix printing terminals like the DECwriter) were fading out and "dumb" CRT terminals came in. When I arrived at university in 1980 the computer center was filled with dumb terminals like the ADM-3. There were a few smart terminals (they could run Emacs!) but they were hard to come by.

Within a couple years, though, the dumb terminals were all gone and were replaced by "smart" CRT terminals that had the more sophisticated features. So the lifetime of the glass TTY might have been only 5-10 years.

Right, the point of being able to save a game was to pick up later where you had left off. However, the game attempted to prevent you from restarting from a saved game if you made a mistake or got killed or something.

I think the scheme was fairly clever but it wasn't terribly sophisticated; nothing like public-key crypto for instance. It did have a number of countermeasures that attempted to prevent cheating, such as restarting from a modified save file. For example, I believe it hashed all the bytes of the file, plus a bunch of metadata -- possibly including the uid and the file's i-number, as you suggest -- and also things like the file modification time and maybe even the i-node change time. Then it would write this hash back into the file. I seem to recall a bit of cleverness to avoid problems because writing the hash could potentially modify things like the file modification time. Maybe it just retried until the modtime didn't change. Not too difficult since the granularity was one second.

In principle this is easy to defeat if you know the hash algorithm, and if you knew how to use the Unix system calls to change a file's modification time. Since the original rogue program was closed source, the hash algorithm was secret. But eventually somebody reverse-engineered it, and programs emerged that were able to successfully copy save files.

Oh MANNNN I spent so much time playing rogue back in the day. I got decently good at it, but it was hard. I don't think I ever actually won. I do recall a strategy of clearing out the easier levels in order to gain treasure and magic items. At a certain point you wouldn't be able to defeat all the monsters, so you'd try to find the stairs as quickly as possible. On the occasions where I'd get really far -- far enough to start looking for the amulet! -- I'd get trapped by some powerful monster like a Titan and get killed instantly.

Such a letdown. You'd play for hours and it would all be over in an instant. That damned tombstone.

Like several others here, my first programming language was BASIC. For this we owe Kurtz a debt of gratitude.

I know Dijkstra is famous for having said that we're mentally mutilated beyond hope of regeneration, but you know, I kinda think we didn't turn out half bad.