Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:BASIC programming skills (Score 1) 214

You completely missed the point. I could have just as easily said "past a compiler" but since I used VB as my example I went with interpreter. Next time you may try reading the entire post rather than jumping off a single clause.

My post had nothing to do with one language/framework/tool being better than another. The point that you missed is that the skills needed to be a programmer have nothing to do with proficiency in a language. They have everything to do with math. Let's teach more math and then perhaps if you happen to enjoy coding you can be a programmer.

Another aspect I didn't mention has to do with tools. So long as we rely on tools which essentially build an application by linking interfaces from a library, you don't need a programmer. You need one to build the library but any mildly intelligent human can then build the app like linking together legos. That has been the main focus of software development for some time, which of course removes incentives to hire qualified developers. Thus the more 'intelligent' your tools, the less you need intelligent developers.

Software development is well on the path that Networking took about a decade ago. Good luck finding a job that pays enough to support a family when every 10th grade is building apps.

Comment BASIC programming skills (Score 4, Interesting) 214

I taught myself how to program using the BASIC books located in the Radio Shack stores and typed them into the (new) TRS-80's they had out. (Yes I am THAT old) I then moved on to using Assembly (Z80). At the moment I can code in 23 languages, and I think in C so there can be a progression.

Although I completely agree that one needs an introductory language to bridge the gap between language arts and programming, the last time I checked Dice there were no openings for Wolfram programmers. I do however remember all the hype around the various instances of BASIC and I can attest to a large number of VB apps that were written (very poorly) by non-programmers. Coding past an interpreter syntax does not qualify you as a programmer.

I see this entire discussion, including the various calls for CS education in the public schools as yet another instance of what killed my profession: the incorporation of unskilled labor. I am CCIE #12981 and there was a time when having that certification meant I could pull down a well paying job nearly anywhere. Now it almost doesn't matter because so few organizations need highly qualified networking resources. They have farmed out networking to a 3rd party, or they have a few slightly skilled resources that keep the lights on. I see the same thing happening to software development, and we as a culture will continue to suffer under the risks of running poorly written applications, because corporations don't see the need to hire highly skilled developers. Shoving all students into the pot via mandatory CS education, or promoting BASIC languages like Wolfram will only make that worse.

If you want a programmer you don't start with a language. You start with math and specifically with logic. The language used is a mere vehicle for the expression of concepts and as such learning its syntax is secondary. Rather teach principles, such as "Always check your inputs, and your return values" which is true in any language.

Comment Two things (Score 4, Interesting) 197

One of the checks I do is to have a non-programmer just READ my code. If they can make any sense of it (Think variable and function names) then I continue. If not, I rewrite until it reads like English (with extra stuff in the middle :-)

I also have SHORT (as in a single line or perhaps two) comment block at the start of anything that isn't immediately obvious. This adds to readability.

I have code blocks that are more than 10 years old, that I still refer to and which I can make out the intent and the execution without issue because of these two very simple techniques. '$a' doesn't tell me anything. '$account_name' does. Stop trying to limit your typing load.

Other thing I do, which I find missing from a a great many things; Check your inputs and your return values. As much as this is Programming 101 level stuff, it is remarkably absent from so much code. How is it that SQL injection works at all?

Comment Shades of Grey (Score 1) 95

The only truly 'white' hat is the one paid to attempt a break in, with full knowledge and cooperation of the target, who delivers the results directly to the company paying the bill, without disclosing their results to anyone else. A 'Black' hat is the one that does a similar thing entirely for their own benefit and the specifics of the exploit used are never disclosed to anyone. As you can see by these definitions, there is a great deal of spectrum between those two extremes. Therein is also a reasonable definition of 'Grey' hat - one who discloses beyond the target, or at all.
And thus the problem. As in the story of The Emperor's New Clothes, calling out the 'nakedness' is fraught with peril. In doing so you are, among other things, saying 'I'm so much smarter than you' to the target. Most people don't appreciate that and will retaliate out of self preservation.
So what motivates a 'Gray' hat? Sometimes it is arrogance. Sometimes it is charity or a sense of the greater good. Sometimes it's just dumb luck when you stumble over something while testing out your latest kit. There are many shades of grey.

Comment This is why so much software is shit (Score 1) 242

Saying "A background in math or science isn't necessarily a requirement to teach CS," explains the Dept. of Ed, "as disciplines like English, history and civics can also provide a solid foundation for teaching CS concepts." is akin to saying I can teach medicine because I'm dating a nurse. CS is fundamentally linked to math (logic). English, history and civics are studies of humans, and humans by nature are illogical.

Comment API hell (Score 2) 279

I suspect given the trends of the past decade that there will be more pseudo-code looking scripts written in language du jour, than actual code. API calls, to API calls that invoke still other APIs, without any understanding of what is actually being executed or on what platform it is executing. There has been a lot of effort put into making 'coding' simpler and more distributed which has many faults. First and foremost the simpler it is to code, the dumber our coders become. Similarly the more distributed we get, the harder it is to diagnose problems.
It used to be that a good debugger was all you needed. Now you can barely even tell what is going on without a sniffer trace, and even that will leave you wanting for some piece of the puzzle. I'm not suggesting a return to the days of COBOL, but not all advances result in better code.

Comment Nonhuman intelligance (Score 1) 189

We already have various methods of ascertaining intelligence as expressed by nonhumans. Animals are routinely imbued with various levels of intelligence. We do this from a behavioral analysis very much like the Turing test which I suspect is the basis from which it was taken. I think the main issue with the Chinese room thought experiment is the inclusion of an outside influence over the behavior, the book. Since we cannot manipulate the behaviors of animals in the wild, we can rightly ascribe intelligence to those behaviors which indicate something other than a simple response to stimuli. In that respect I think a machine which programmed itself to respond correctly to the Turing test would qualify as intelligent. Remove the external influence, the 'book', and allow the machine to develop its own understanding. I am aware of several efforts along these lines. Programming a machine to simply learn through exposure to various stimuli over time. I believe that should something like this actually produce a machine which could converse would end the discussion of whether or not the Turing test was valid. That we can cheat does not invalidate the test itself.

Comment Re:I'm beginning to see a pattern here. (Score 1) 305

Yes I agree there should be a breach of contract litigation effort against IBM. However I think the greater good could be served by firing every government worker who had any part of the approval for the project, the oversight of the project itself or requests for additional funding. I do see a pattern. It seems ever since we have left the mainframe, the federal government has failed in all cases with any form of IT project. I suspect it is because those in charge either can't spell there own name the same way twice, or because we have people whose core competency is in something other than IT making IT decisions.

Oh wait. That isn't unique to the federal government.

Comment Maybe (Score 1) 121

I think there is a discrepancy between your intended audience, home users, and the skills necessary to take full advantage of this platform. I could use it, but then I could build one of my own as well. General consumers want something that serves a well understood purpose and which requires little interaction. I think if you tailored it to a specific purpose, say as a security device which filters Internet traffic which was also you main WiFi access point it would sell. Being simply an open platform means you are marketing to hobbyists and quite frankly your platform has no real differences from others.

Comment Where to start (Score 1) 158

You have an impossible task. Rejuvenate your CV, and find your next job.
Seriously though, start with a budget. Until you can secure funds you cannot do anything and the budget will tend to direct what you can accomplish next. Once you have cash, find the oldest piece of hardware in operation and start with that one. You will have more failures based on hardware than you will based on unpatched OS's. Disks are your primary concern in this realm.
Second, after you've completed a few of the more horrendous back-end server migrations, the desktops are next. This is a political move. It will endear you to the user community and this will make additional funding possible. If you focus entirely on the back end, you will run out of support and therefore money long before you can complete the task. You may have to do this step by department, so make sure that your most supportive users get their upgrades first. As I said, this step is entirely political in nature. You will not be able to perform all the upgrades in this step, so be picky.
Third, address the network. Given the health of the server architecture you've described, I suspect that even gigabit-Ethernet is foreign to your environment. Make sure you can build in redundancy along the lines of 802.3ad (LACP) etherchannel connections for all things. Redundancy is your top priority in a network refresh. Basically there are two (2) of every component, each of which is connected to two (2) others.
Fourth, take the remaining servers in order of business impact, most first. This will give you the opportunity to introduce the user community to the concept of "maintenance windows". It will also allow you to engage top management in the upgrade process, which should allow you to re-negotiate the budget; which will be woefully inadequate at first.
Assuming you've made it this far (doubtful) go back and finish the user PC upgrades.
Then prepare to do this entire process again in about three (3) years. Perhaps five (5) if you are lucky enough to get the funds needed to buy things which have significant life. Leasing is also a good thing here because it forces the refresh once the lease terms are fulfilled.

Comment I'm going to scream (Score 1) 616

THIS is exactly why we have so many exploits available in systems today. We have too many 'coders' who have no idea of how the underlying system functions. In the company where I am currently employed, there are individuals who are writing code for new services that don't know what a TCP 3-way handshake is.
IT is the only profession on the planet which does not have a governing body of any sort. There are no exams, no licensure requirements, no educational requirements. Nothing. Anyone who can convince a hiring manager, who themselves is unlikely to be versed in technology, that they "know what they are doing" can be hired into a position of impact. And we wonder why software written today is so bloated and filled with exploits.
What did you expect?

Comment Re:And so it begins (Score 1) 60

And you all missed the point. You focused on the story that occurred back in the late nineties when people used to plug their Win95 machines directly into the broadband modem.

THE POINT WAS that inoculation is a valid response to security threats. If the malware perpetrators can take control of a PC behind a corporate firewall, there is nothing stopping that from being less about exploitation and more about service. Furthermore until we in the profession of IT give up our dependence on reactive techniques to deal with security threats, and move in the direction of actively recapturing the BOTs being used against us, we will continue to have an unending list of major security breaches.

How long do you think it will go before the government steps in and begins the process of setting up regulation?

Comment And so it begins (Score 3, Interesting) 60

This is the first published report I've seen regarding a technique I've been promoting for a decade. Inoculation. If you find an infected machine, take control and fix it. Slashdot commenters universally reply to this technique with sarcasm, warnings of legal action or downright vitriol but the technique stands as the only way to move forward. The best defense after all is an offense and all current and future planned security activities are reactive in nature. As long as you wait for all the other machines to be patched and comply with security best practices, you will never stop waiting and your services will be under attack.
There was a small script I wrote a number of years back when I first got broadband access at my home. My firewall was being inundated by attacks from the metro loop so I wrote something that scanned the source IP for well-known exploits. If one was found, it used said exploit to take enough control to put a system level dialogue box up that said "Your machine has been infected by a virus - please fix this immediately", and then listed the virus it used to gain access. This ran for about a month until my provider called me and asked me to desist.

Comment Saw it comming (Score 1) 220

A decade ago I had a discussion with my then boss about how to respond to inbound attacks. It was clear then that the current methods of defense were wrong by any measure you care to use. They haven't gotten any better in a decade. They've only increased in cost and complexity. The basic failure can be demonstrated by the metaphor of feudal Europe, since I know all of you are aware of your western civ history. Our current defense methods are akin to various forms of dumping molten lead onto the Visigoths below are 'fortified' walls. The problem is that the Visigoths are already in our land, destroying things along their way to the castle. Of course the metaphor breaks down because these Visigoths replicate in place; get stronger, faster and more sinister in their siege weapons with nothing more than the passage of time and no matter how many we disable there are always more than there were a minute ago.

So what to do? Given that the attack is always through an intermediate entity, I propose using a biological analog to address it. Treat it is a diseased state and execute a vaccination. Since the intermediate system has already been compromised, as is demonstrated by the fact that it is currently an intermediate for an attack, it would be best to rest control of it from its current commander. We can certainly discuss what that means or how to accomplish it, but that is the best solution. Remove the Visigoths from battle rather than attempting to thwart their attack on us. The other side of this equation, and the thing its success depends on is automation. The takeover system must be able to respond to the attack within a few packets and rest control a short time later. Otherwise you have accomplished nothing. Waiting until the entire village is infected with Ebola before you send in the inoculant will only result in more deaths. Waiting for a human being to respond is similarly inappropriate in this situation.

This is not an attack. It is a method of removing resources from an attacker. If the takeover were done correctly, say leaving the affected machine in a state where it was no longer vulnerable to the exploit the attacker used originally to take control, you have in fact helped the Internet over all. You have inoculated another machine and the pool of available resources to attackers has diminished. If you can do it fast enough you can rest an entire farm from its nefarious controlling entity and put them back at square one. This method levels the playing field as every attack is therefore a chance to lose all your resources. It requires no coordination to execute, no notice since the machine is already infected, and there is no data breach involved.

The real question is can it be done?

Give me a minute.....

Slashdot Top Deals

So you think that money is the root of all evil. Have you ever asked what is the root of money? -- Ayn Rand

Working...