User: wintermute42

The cost of C/C++ and no bounds checking

On: Analysis of the Witty Worm

I'm a long time UNIX/Linux hacker (I first programmed on UNIX on a VAX). I've written a lot of C/C++ code. But long ago I used Pascal and more recently I've been using Java more.

Both Pascal and Java do range checking. That is, they check the bounds of arrays (buffers) when they are accessed. This means that about half of the security exploits (including the one, targeted at BlackIce etc...) would not be exist if our software base was implemented in languages with bounds checking.

The original reason that bounds checking was not implemented in C was that the early compilers were very basic (little in the way of optimization) and bounds checking overhead slows execution. Bounds checking overhead can be reduced through optimization, but Ritchie's original C compiler only did simple optimization.

Another problem is that in C pointers and arrays are more or less interchangable. So bounds checking becomes difficult or impossible in all cases (C provides way too much pointer flexibility when it comes to enforcing bounds checking).

If we were to add up the cost of all of the buffer overflow security attacks it must run in the billions. So the "power" of the C programming model has extracted a pretty high price. This puts an interesting retrospective slant on Brian Kernighan's 1981 article Why Pascal is Not My Favorite Programming Language .

I have to confess that I would not go back to using Pascal. But native compiled Java, with Java's bounds checks, would be far safer than C++. And it would result in software that is more robust against security attacks.

Yes we can all learn to use fgets, strncpy and other safer library routines. But this only makes our code safer. It does not provide the complete protection against buffer overflow attacks. So perhaps it is time to reconsider the programming languages we are using. Perhaps unrestricted pointers and no bounds checking has become too costly.

Re:Economists and prophecy

On: U.S. Students Shun Computer Science, Engineering

Go into finance. By finance I mean market trading, either as a trader or as someone who builds models. Or other financial areas like foreign exchange hedging for corporations, management of exotic options, stuff like that.

The technical parts of finance are really interesting. Highly mathematical (much like statistical physics). A knowledge of software helps. And you may get rich. Even better, so far no country matches the US markets. So this is not something that is ever likely to be offshored to India or China.

Re:guess what they're all becoming instead.

On: U.S. Students Shun Computer Science, Engineering

Or to summarize this argument, the way to fight the decline of the middle class and offshoring is better education. This is a popular argument with the free trade ideologs.

I'm sorry, I just don't buy it. The core problem is that there is someone in India, China or Russia with the same eduction (you name it: computer science + molecular biology, computer science + statistics,...) who can work for a fraction of what someone in the US with the same education can.

In the case of India and China there are huge populations. It is not that expensive these days to turn out a computer scientists (although a molecular biologists is a bit more expensive). So it seems likely that there will always be an large supply of cheap well trained offshore labor.

The irony is that "knowledge workers" like computer scientists would be better off if we were factory workers. At least then capital investment could be applied to increase our productivity and reduce the offshore advantage with automation. However, in the case of software development, any new software tool that increases productivity is available world wide.

So lets see, after you make the eduction argument you need to move on to the argument about how all this is temporary and things will be just mo'betta once the next big thing comes along. You know, biotechnology, nanotechnology....

Although my job title is "computer scientist" my undergrad degree is in biology. So I've taken chemistry, physics, organic chem, biochem, molecular biology, cell biology, neurbiology and so on. But I don't see a whole lot more opportunity in the vaunted biotechnology revolution. All I see are drug companies spending vast amounts of money with few drugs in the pipeline. At the same time there is pressure on drug prices. Biotechnology does not exactly look like a dream industry either.

Have you ever noticed that the US is almost alone in its free trade ideology? Virtually every country in Asia has an industrial policy that is aimed at protecting and expanding the industries that they view as strategic (China's efforts in semiconductors have been in the news lately). You simply would not see the policymakers in these countries willingly hollow out their technology base for "free trade".

It is time that the US realized that the problem is not eduction or that The Next Big Thing has not arrived. The problem is that the US needs an industrial policy aimed.

Re:Bruce Sterlings previous work has been weak

On: The Zenith Angle

I agree that Mona Lisa Overdrive was not the best in the Sprawl trilogy. I have to confess that when I wrote about weak Gibson books, this came to mind. I still own a copy of MLO, but I gave away my copy of The Difference Engine. I found The Difference Engine more or less unreadable.

Since I've outed myself as a William Gibson groupie (I guess "Wintermute42" might give it away too), I'll also mention that he speaks in the same way that he writes. I don't know if this is rare with authors or not.

Years ago I drove two hours through traffic from San Diego to Los Angeles to hear Ray Bradbury give a keynote address at the yearly Association for Computing Machinery conference. I've always admired Bradbury as a stylist. But listening to him speak is torture. Truely horrible. While I think that he can write beautifully, he cannot speak.

In contrast, listening to Gibson is like reading one of his books. Gibson is really bright and he sees the world differently than most people. He puts together these amazing sentences with the slight trace of a Southern drawl. This really comes through in the Gibson documentary No Maps for These Territories and to a lesser extent at his book signings.

Bruce Sterlings previous work has been weak

On: The Zenith Angle

After reading William Gibson's Neuromancer I wanted to read more science fiction like it. At the time there was a sort of boomlet of "cyberpunk" authors. In addition to the master, Gibson, some of them were pretty good. I liked Walter Jon Williams' book Hardwired. K.W. Jetter wrote some pretty interesting stuff. Jon Shirley wrote the Eclipse books which were a sort of cool combination of rock, drugs and cyberpunk distopia. And then there was Bruce Sterling. I've always seen Sterling as a wana-be Gibson. Unfortunately for Sterling he does not have Gibson's brilliance as a writer or Gibson's unique world view. Of the writers listed above, Sterlings has always seemed to me to be the weakest. I've found Sterling's writing in WIRED equally empty. Sterling might be viewed as a science fiction Tom Clancy (he even seems to share Tom Clancy's right wing political views).

William Gibson has written one really weak book, The Difference Engine and this was co-authored with Sterling. It is interesting to note that they have not written anything together since. Gibson must have come to realize that he is far weaker with Sterling than without.

I just finished Charles Stross' Singularity Sky (which I think was reviewed on Slashdot). I thought that it was excellent and I look forward to reading more of Stross' work. I rate Stross far higher than Sterling. Where Sterling is a techno-wana-be, Stross is the real thing. The author I would compare Stross to the most is Ken MacLeod (who I also like).

I have not had a chance to read Sterling's latest (which I think I'll get from the library). But if you're spending money, I'd spend it on Stross, Ken MacLeod, Dan Simmons (his latest book Illium is interesting). Or if you have not read Ian MacDonald, try his book Terminal Cafe which is one of the great speculations on the implications of nanotechnology.

Fascination with Transmeta

On: Handtop PC Announced Using Transmeta Processor

What surprises me is not that a product, which is not due to ship for months, has announced that they are using the Transmeta processor, but that Transmeta is still around (see Transmeta: hype and processor performance).

Other than support for the underdog, the fascination in the Linux community with Transmeta has been the Linux (or Linus) connection. This connection is now tenuous at best. It's time to look at Transmeta with a less romantic eye.

Originally Transmeta was founded to provide a high performance processor for laptops (I interviewed with them during this phase). They claimed that they were going to be the next Intel (truely, a quote). Unfortunately, the Transmeta processor could not beat Intel and AMD processors. So then they refocused on producing a low power chip for portable devices. But then Intel and others came out with low power processors. So there is no real edge that I can detect for Transmeta. I am only surprised that they are still around.

Re:What a lame piece of crap

On: Digital Fortress

I second the view that Digital Fortress is a lame piece of crap. Dan Brown did not do even the most basic research before writing Digital Fortress. Bruce Schneier's book Applied Cryptography has been around a long time. Even if you don't understand the C code and the mathematics, you can get a pretty good picture of why some algorithms are unbreakable, in practice. But Brown does not seem to have read anything about cryptography. He simply waves his hands and writes "quantum computing". He might as well have written "magic happens".

Now what would have been interesting would be to speculate that the NSA actually did have quantum computing. Then the interesting plot theme would be how do you keep something like that secret. But such plot complexity is not for Dan Brown.

As other Slashdotters have noted, Brown's characters are cardboard and his writing is poor. So while one might forgive someone for technical mistakes if the plot and writing were good, the combination of mediocre writing and technical howlers is pretty obnoxious.

If you want a writer who is not a specialist in computer science but gets the details right and even provides interesting insight, try Peter Watts the author of Starfish and Maelstrom.

Watts is a Phd marine biologist, so he's definitely a bright guy. So perhaps he's in a different league than Dan Brown. Watts has definitely done his research and it shows in his interesting observations about neural nets.

Watts' characters are complex and his plots are interesting, if dark. (OK, so I should probably submit a book review - Watts' has a new book coming out this year and I'll do it when the book appears, since Watts' is under appreciated)

Who is producing all those Indian engineers

On: 235,000 Fewer Programmers by 2015

There is one aspect of the discussion of offshoring US software engineering jobs that I have not seen discussed much: where are all of these Indian software engineers coming from?

India has been and remains, by US standards, a poor country. The roads are terrible and inadequate. The electric power infrastructure is so bad that companies than can afford it have their own power generation. Hunger is a big problem and much of the Indian population is still agrigarian. Violence inspired by religion is not uncommon and the ruling party in India makes use of this violence near elections. India borders Pakistan, which is considered by many the most dangerous country in the world because of its political instability and nuclear weapons. In short, India is not a country that can afford a first world level educational infrastructure of high schools, colleges and universities.

India does have the famous Indian Institutes of Technology. These are world class schools that have classicly sent Indian students on to graduate schools in the United States and Europe. Howver, IIT only graduates a few thousand students a year. In addition to the IIT grads there are Indian students who graduate from Universities in the west.

As the US and European job markets have turned bad, some Indian H1-B visa engineers are returning to India. However, it you add up all of the engineering graduates from IIT, Indians who went to foreign schools and the returning H1-B visa engineers, the sum does not seem to be sufficient to supply all of those jobs that are being moved from the West to the East. So where are all these people coming from?

Some are coming from what I call the "Matchbook School of Computer Programming". These are the kind of schools that used to advertise on the back of matchbooks in the United States. They teach basic Java, Visual Basic and ".NET" programming. Their students have no background in algorithms or design, but they can crank out simple software, especially GUI software. I've noticed that many Java programmers in the United States seem to have little command of algorithm design beyond the use of the class libraries, so the barrier to entry for Java programmers seems low.

Obviously I have no statistical information on any of this beyond the speculation I've listed above. I am certainly not writing that the problem does not exist. I am just trying to look at the real issues, with as little histeria as possible. Although much of the focus is on India, my guess is that the real problem is the combination of a set of lower wage countries: India, China, Russia and Eastern Europe. The combined number of skilled engineers (e.g., a software engineer who actually knows what N * log(N) means) is a significant threat to the US work force.

There is a lot of thoughtless blather in this whole discussion. Not only regarding the issue of where all these foreign engineers are coming from but also regarding the course that US engineers are supposed to take. The classic line, echoed in some of this discussion is "retraining". But no one answers the question: toward what? This is because no one knows.

Sometimes it is easy to forget why I went into this field long ago in the days of the punch card. I went into software engineering because I love it. I am still not ready to give up on my field (perhaps this makes me a dinosaur slated for extinction).

I have spent over twenty years building my skills as a software engineer and computer scientist. This is a hard and demanding field. I constantly read articles and books. I writes software not only at work by in my free time. Good software engineers, who can not only engineer complex systems but actually write clearly to document these systems are rare in any country. I still hold out the hope that there will be jobs in the future for people with these skills, although I admit things look bleak now. But these are bleak times. The question I try to answer is: what is a factor of these bleak times and what represents structural change?

Re:from an actual nanoscientest

On: Nanotechnology: Are Molecular Assemblers Possible?

Thanks for this great post. I think that it is one of the most informative in the long slash dot discussion. In many cases people seem to be arguing for what they want to believe rather than arguing for what seems to be possible in the foreseeable future.

It is interesting to note that one of Drexler's primary supporter's is Merkle, who also approaches nanotechnology from a theoretical point of view. Drexler et al defend their theoretical approach by claiming that nanotechnology is in the state that fision physics was in the 1930 - theoretical work, leading the way to experimental success. As the parent article notes, there is little experimental evidence to back up Drexler's theories.

And, by the way, I want to believe too. I've read "Diamond Age" and Ian MacDonald's "Terminal Cafe". Nanomachines are a great dream and I sure wish that they would save my aging ass. I'd love to live in a world where diamond is cheap or cheaper than glass. Orbital elevators, new materials.... But it does not look likely in the foreseeable future.

Send those test scores

On: What's the Worst Job Posting You've Seen?

As if the Microsoft style interview of asking you to solve endless programming problems on the white board and asking you puzzles over lunch was not enough: companies are now asking for results on standardized tests (e.g., SAT, GRE) along with your resume. These companies seem to believe that this will allow them to choose "really bright people".

As we all know, with all of the unemployed computer science and EE people, employers can be obnoxious and still get people to interview.

Even worse awaits you when you actually go to the interview. The Microsoft style interview has spread. In these interviews they don't ask about what you have done or how you solved problems on past projects.

At an interview with a major graphic chip manufacturer I had this guy come in, sit down, tell me his name and then ask me to solve a programming problem. I had another interview where someone asked a trick question whose answer was an impractical algorithm (the time complexity was exponential, when linear solutions were available with a slightly more complex data structure).

The justification for this interview style seems to be "we want to know if you can program". Actually, it's more like "we want to see if you can program on the white board". I've published a considerable body of C++ and Java source code on my web pages. But everyone I've talked to seems unwilling to looking at my work instead of asking these silly questions.

As we all know, the sad truth is that if you need a job you'll send your twenty year old test scores or what ever else the prospective employer wants. Then at the job interview you'll attempt to put up with what ever obnoxious and demeaning interview style they have. In this job market the company will have so many resumes and so many people coming through that they can find someone with the experience they are looking for who also happens to do well in their demeaning interview.

Re:Royal Bank of Canada

On: Slashback: Diebold, Peroxide, Comdex

Royal Bank of Canada is one of the large multinational banks that has an offshore presence. That is, they own a subsidiary bank in the caribbean, where bank secrecy laws apply. For the paranoid minded one could think up a plot by the Evil Empire of Redmond where money would be funneled via the offshore version of the Royal Bank of Canada into an investment fund which would then be used to invest in SCO.

There is a less paranoid explaination. That being that when it comes to investment the Royal Bank of Canada are a bunch of idiots. The RBC invested in one of Enron's deals to the tune of $517 million (US). The RBC layed off some of the risk to another bank, which contested the deal. They recently reaced a settlement. But the RBC is still out a bit over half the money. The original investment by RBC was in Enron Broadband, which was a fraud from the start (the company had revinues of less than a million dollars). The RBC did note seem to do any more "due diligence" in the Enron deal than they have with the SCO investement.

So while it is possible that the RBC is a conduit for money from the Evil Empire it is more likely that they are making another stupid investment.

Yet another example of junk "science"

On: Socionomics: the Science of History and Social Prediction

I found this review of Socionomics interesting. There has recently been some interesting work in behavioral finance, so I thought that these books might be worth reading. That is, until the Elliot Wave and Fibonacci sequences were mentioned. There is no statistical evidence for Elliot waves, or at least for a predictable periodicity of market and economic cycles. At most the Elliot Wave is another name for the capitalist economic cycles of expansion and contraction. Yes, these cycles definitely exist. But they don't reoccur in the same way. Put another way, there is no predictability that anyone with a command of statistics and mathematical technique has found.

Only chartist cranks believe this stuff. And a quick Google search shows that the author, Robert R. Prechter is, in fact, a chartist crank. He runs a company called "Elliot Wave International" which apparently sells a newsletter for other chartist cranks.

There are people on Wall Street that believe in Elliot Waves. I saw a self-produced documentary on a very successful trader named Paul Tudor Jones. He and one of his colleagues are shown pouring over a chart and babbling on about Elliot waves. It then shows Jones trading. The market starts to move against his position. He then whips out his lucky gym shoes and his lucky inflatable dinosaur (I'm not making this up!) In the end Jones managers to profit from his positions. It it Elliot waves or was it the lucky inflatable dinosaur?

Successful traders have been notably unable to explain how they do what they do. Even a bright intellectual like George Soros has never been able to explain his method in terms that had any meat or meaning. His son once mentioned that after watching his father trade for years he thought that it was Soros' back that was the key - it started to hurt when it was time to get out of a position.

Successful traders seem to have a talent for merging information from a variety of sources and the ability to act on these almost unconscious patterns. So some of them may claim they follow Elliot waves, but it has no more meaning the the lucky inflatable dinosaur.

One poster claimed that Prechter has predicted this or that. Well, so has the Jenne Dixon (the psychic astrologer who wrote for the National Enquirer). Anyone who makes lots of predictions will be right sometime.

One of the problems in this whole area of discussion is that people switch topics when they argue that Elliot waves exist. For example, the presence of short term trends is sometimes used as evidence for Elliot waves. This is not true. There is a lot of work at Wall Street investment funds on doing statistical prediction in the markets (this is called statistical arbitrage). But none of this has to do with Elliot waves or Fibonacci series. Wall Street has one ideology: making money. They don't care what works. If it could be shown that voodoo worked they would do it. There was a fad for Elliot waves. It did not make money in a reliable fashion and now no major investment funds uses these techniques. They are discredited.