firelizzard

joined 1 year ago
[–] firelizzard@programming.dev 6 points 3 weeks ago (1 children)

If the ask is, why was the hardware like that in the first place the answer is because it can’t be fully validated.

But that's not the question. There are two questions: Who should be responsible for patching hardware vulnerabilities? And if the answer is "the kernel" then should speculative but never demonstrated vulnerabilities be patched? Linus' answer is the hardware manufacturer, and no.

Is this really the hardware vendor’s problem though? It’s the consumers problem.

Maybe we're running into the ambiguity of language. If you mean to say, "Who does it cause a problem for? The consumer." then sure. On the other hand what I mean, and what I think Linus means, is "Who's responsible for the vulnerability existing? Hardware vendors. Who should fix it? Hardware vendors."

If the ask is why should a speculative fix go into the Kernel [...]

Depends on what you/we/they mean by "speculative". IMO, we need to do something (microcode, kernel patches, whatever) to patch Spectre and Meltdown. Those have been demonstrated to be real vulnerabilities, even if no one has exploited them yet. But "speculative" can mean something else. I'm not going to read all the LMK emails so maybe they're talking about something else. But I've seen plenty of, "Well if X, Y, and Z happen then that could be a vulnerability." For that kind of speculative vulnerability, one that has not been demonstrated to be a real vulnerability, I am sympathetic to Linus' position.

[–] firelizzard@programming.dev 25 points 3 weeks ago (3 children)

Who said anything about fully validating hardware? "Hardware vendors should solve their own problems" is not the same as "hardware vendors should fully validate their products".

[–] firelizzard@programming.dev 2 points 3 weeks ago (1 children)

Is there supposed to be a link?

[–] firelizzard@programming.dev 3 points 1 month ago

My comment game has gotten far better since I started doing live code reviews. Essentially I ask myself, “Would I feel the need to explain this to someone during a code review?” and if the answer is yes I add a comment.

[–] firelizzard@programming.dev 5 points 1 month ago

That’s a hot take. If you want your code to be maintainable at all, it needs comments. If you’re part of a team, write comments for them. If someone else may take over your project after you move on, leave comments for them. And have you ever tried to read uncommented code you wrote a year ago? Leave comments for yourself.

[–] firelizzard@programming.dev 5 points 1 month ago

The con is that it’s not very powerful. I haven’t attempted to code on a gaming handheld, but I’ve had issues with a midrange laptop being under powered. RAM is probably the biggest issue. My life improved noticeably when I upgraded my main machine to 64 GB. Granted I was doing particularly heavy work. It really depends on what you’re doing. You could get away with it for some work, but it’s going to be painfully slow for other stuff.

[–] firelizzard@programming.dev 2 points 2 months ago

The key difference is that compilers don’t fuck up, outside of the very rare compiler bug. LLMs do fuck up, quite often.

[–] firelizzard@programming.dev 3 points 2 months ago (2 children)

Copilot frequently produces results that need to be fixed. Compilers don’t do that. Anyone who uses copilot to generate code without understanding how that code works is a shit developer. The same is true of anyone who copies from stack overflow/etc without understanding what they’re copying.

[–] firelizzard@programming.dev 1 points 2 months ago

I'd create my own macro or function for that. I have enough ADD that I cannot stand boring shit like that and I will almost immediately write a pile of code to avoid having to do boring crap like that, even with copilot.

[–] firelizzard@programming.dev 7 points 2 months ago

Using git reset --keep would just make more work since I'll have to throw away uncommitted changes anyways. Removing uncommitted changes is kind of the whole point, it is called 'reset' after all. If I want to preserve uncommitted changes, I'll either stash them or commit them to a temporary branch. That has the added benefit of adding those changes to the reflog so if I screw up later I'll be able to recover them.

[–] firelizzard@programming.dev 21 points 2 months ago (4 children)

If you’re using reset with uncommitted changes and you’re not intentionally throwing them away, you’re doing something wrong. git reset —hard means “fuck everything, set the state to X”. I only ever use it when I want to throw away the current state.

[–] firelizzard@programming.dev 1 points 2 months ago

I have not and will not ever use AI generated code that I don’t thoroughly understand. If you properly understand the code you’re committing there shouldn’t be any damage. And beyond AI you should never commit code that you don’t properly understand unless it’s a throw away project.

 

As a senior developer, I don't find copilot particularly useful. Maybe it would have been more useful earlier in my career, but at this point writing a prompt to get copilot to regurgitate useful code and massaging the resulting output almost always takes as much or more time as it would for me just to write whatever it is I need to write. If I am able to give copilot a sufficiently specific prompt that it can 'solve' my problem for me, I already know how to solve the problem and how to write the code. So all I'm doing is using copilot as a ghost writer instead of writing it myself. And it doesn't seem to be any faster. The autocomplete features are net helpful because they're actually what I want often enough to offset the cost of reading the suggestion and deciding if it's useful. But it's not a huge difference (vs writing it myself) so that by itself is not sufficiently useful to justify paying the cost myself nor sufficient motivation to go to the effort of convincing my employer to pay for it.

 

I exclusively use Visual Studio Code for editing code. I primarily work with Go, and a little bit with JavaScript/TypeScript, but I need to do some C# work.

I have no interest in using Microsoft's proprietary C# Dev Kit or dealing with their licensing terms. What capabilities am I losing? The marketing materials for the dev kit talk about a lot of stuff that appear to be features of the open source C# extension, so it's unclear which features are actually exclusive to the dev kit.

 

Why is crypto.subtle.digest designed to return a promise?

Every other system I've ever worked with has the signature hash(bytes) => bytes, yet whatever committee designed the Subtle Crypto API decided that the browser version should return a promise. Why? I've looked around but I've never found any discussion on the motivation behind that.

 

Not sure if this is the right community, but I didn't see a general one. What search engine do you use? Besides Google increasingly spying on its users, the quality of its search results seems to have gotten significantly worse over the last decade. What search engine(s) do you use?

 

I have a subscription to Nature but most of the articles are totally beyond me. I’m thinking of switching to a comp-sci specific journal. I’m mainly interested in compiler design and implementation of JIT compilers and VMs like JVM and .NET.

 

I am a self-taught programmer and I do not have imposter syndrome. I have a degree in electrical engineering and when I thought that was going to be my career I did have imposter syndrome, so I'm not immune. I wonder if there's a correlation. It seems that many if not most professionals suffer from imposter syndrome; I wonder if that's related to the way they learned.

When I say self-taught, I don't mean I never took a class, I mean the majority of my programming skill was learned by doing/outside of classes. I took a Java class in high school that helped me graduate from procedural languages to OOP, and I took classes in college but with few exceptions the ones that were practical (vs theoretical) covered material I already knew.

 

My last job was at a company that designed and built satellites to order. There was a well defined process for this, and systems engineers were a big part of it. Maybe my experience there is distorting my perspective, but it seems to me that any sufficiently complex project needs to include systems engineering, even if the person doing that is not called a systems engineer. Yet as far as I can tell, it isn't really a thing in the software industry. When I look at job postings and "about us" blog posts about how a company operates, I don't see systems engineering mentioned. Am I just not seeing it, is it called something else, or is the majority of the industry somehow operating without it?

 

I am working on an application that has SDKs in multiple languages. Currently Java, JavaScript, Dart, and Go, but ultimately we'd like to have an SDK for every major language. Our primary test suites are written in Go, which means our other SDKs are not well tested. I do not want to write or maintain test suites in four or ten different languages.

What I would like to do is choose a language to write the tests in, define a test harness interface, implement that test harness for each SDK, and write the tests using that harness. Of course I could do this with RPC/HTTP/etc but that would add significant complexity. I'd prefer to write the tests in a language that has a meaningful degree of interop/FFI with most of the major languages. Lua comes to mind, since it seems like someone has built a Lua interpreter for basically every language in existence, but I have very little Lua experience and I have no idea how painful it might be to do this in Lua. I am open to other suggestions besides interop/FFI and RPC, though I don't want to take the approach of creating test templates and generating the tests in each language. I've done things like that and they're a pain to maintain.

 

I am not hating on Rust. I am honestly looking for reasons why I should learn and use Rust. Currently, I am a Go developer. I haven’t touched any other language for years, except JavaScript for occasional front end work and other languages for OSS contributions.

After working with almost every mainstream language over the years and flitting between them on a whim, I have fallen in love with Go. It feels like ‘home’ to me - it’s comfortable and I enjoy working with it and I have little motivation to use anything else. I rage every time I get stuck working with JavaScript because dependency management is pure hell when dealing with the intersection of packages and browsers - by contrast, dependency management is a breeze with Go modules. I’ll grant that it can suck when using private packages, but I everything I work on is open.

Rust is intriguing. Controlling the lifecycle of variables in detail appeals to me. I don’t mind garbage collectors but Rust’s approach seems far more elegant. The main issue for me is the syntax, specifically generic types, traits, and lifetimes. It looks just about as bad as C++'s template system, minus the latter’s awful compiler errors. After working almost exclusively with Go for years, reading it seems unnecessarily demanding. And IMO the only thing more important than readability is whether it works.

Why should I learn and use rust?

P.S.: I don’t care about political stuff like “Because Google sucks”. I see no evidence that Google is controlling the project. And I’m not interested in “Because Go sucks” opinions - it should be obvious that I disagree.

 

I've started noticing articles and YouTube videos touting the benefits of branchless programming, making it sound like this is a hot new technique (or maybe a hot old technique) that everyone should be using. But it seems like it's only really applicable to data processing applications (as opposed to general programming) and there are very few times in my career where I've needed to use, much less optimize, data processing code. And when I do, I use someone else's library.

How often does branchless programming actually matter in the day to day life of an average developer?

 

I am an experienced developer, but not an experienced manager. I'd prefer if organizing tasks was not my responsibility, but I work at a small company and no one else is inclined to do it. How do you organize miscellaneous tasks when using a task management system such as Jira? We're using GitLab, but it has the same basic features, such as epics, milestones, tasks, and subtasks.

I don't want to have miscellaneous tasks floating around in the ether, because things like that tend to get lost. But an epic is supposed to have a well-defined end goal, right? A good epic is something like "Implement this complex feature" or "Reach this level of maturity" - not "Miscellaneous stuff".

The majority of the work we do fits fairly clearly into specific goals, such as "Release the next version of feature." But what about bug fixes and other random improvements and miscellaneous tasks? How do you keep those organized?

view more: next ›