honestduane

Blunt but honest software developer, programming geek, and Entrepreneur with Integrity. Formerly of MSFT, NTIQ, and his own start-ups. I'm blunt out of Love.

[honestduane]

The Button.

Reddit has an interesting social experiment about delayed gratification going on over at http://www.reddit.com/r/thebutton/ right now.

Basically if the account you own was created before they started this experiment on April 1, you can either choose to unlock and press a button on a web page, or you can explicitly abstain from pressing the button by loading the page once, unlocking it so that action is tracked, and then not pressing it at all by simply waiting for the experiment to be done.

The button has a lock to keep people from pressing it by mistake; This protects people from doing it by mistake, but also allows the people looking at the numbers to track who pressed it by making sure the people who do so knowing full well they did so explicitly. Pressing the button resets the buttons global countdown timer to 60 seconds; If at any time the button is not pressed within that time and the 60 second timer goes down to zero, the entire experiment ends. But if anybody in the world with an account that is old enough to be in this experiment presses the button within that 60 seconds of time, the global experiment continues for another 60 seconds.

The trick is this:

1. Nobody knows what will happen once the countdown is done counting down.

2. Nobody knows what pressing the button does in the long term, but in the short term you get "flair" on your account based on the timers status when you click it, as a short term reward.

3. Nobody knows what NOT pressing the button does.

I find the entire thing both amusing and interesting.  It is a great social experiment; Can the world wide user base of Reddit stop themselves from pushing the button? How many active users will choose not to push the button? Do they have the strength of will to keep themselves from pushing the button? If they do push the button, How long can they last before they give in? Are they willing to forgo the immediate pleasure and satisfaction of pushing the button and see what happens by not pressing it?  How many of Reddit's users will have the strength of will, impulse control, self control, etc to never press the button even as it sits there, taunting them with a countdown, waiting to be pressed?

I would imagine the set of people who do not push the button is going to be much smaller than the set of people who do push it. But I have also chosen not to be one of the people who pushes it. I will be a non-pusher of the button.  Because I view this experiment as a test of peoples ability to forgo immediate satisfaction, and I do not want to fail that test.

Currently if a user in this experiment gives in now they get a small, permanent   reward; So perhaps something better will happen later to the people who waited and did not press the button.   I see the small prizes you get by pushing the button now while the experiment continues, and I can't help but wonder what you get if you do not click it at all.  It must be better. So I have decided that I'm going to find out,  and be one of the few who will not push the button.  I will load the page, I will unlock the button. But I never click the button.  I will delay gratification, and I will have the strength of will to do so even if all of Reddit seems to be taking sides and is trying to get others to be like them, pushers of the button. No I’m not joking; some of people posts asking others to push the button and keep it alive are down right religious sounding.  There is even a group dedicated to keeping the button alive.  They call themselves the “Knights of the Button” and you can find them here: https://www.reddit.com/r/thebutton/comments/3174r3/announcing_the_knights_of_the_button/ Now some of you may be saying “But wait Duane, what if that means you don't get anything? I mean you could push the button right now and get sweet swag/flair on your account!”.  To you I would have to reply, respectfully, that I value not pushing the button in the hope of something better - even if all I get out of it is the knowledge that that I made it,  and that I had the strength of will to not push it as it sat there taunting me - over that immediate gratification. Now I’m just waiting to see if I made the right choice.. We should know in a week or so if my math is right.

[honestduane]

Star Trek was an attempt to say that humanity will reach maturity and wisdom on the day that it begins not just to tolerate, but take a special delight in differences in ideas and differences in life forms. […] If we cannot learn to actually enjoy those small differences, to take a positive delight in those small differences between our own kind, here on this planet, then we do not deserve to go out into space and meet the diversity that is almost certainly out there.

Gene Roddenberry

[honestduane]

On China’s attacks on GitHub

I use git-hub.  I enjoy using GtHub.  So let me get to the point:  I don’t feel like China has the right to attack Github just because GitHub happens to host a few files that help people get around what is commonly called the great firewall of china.

And let us be clear: it is China and more specifically, the Chinese Government, who is abusing its control of a private tech company based in China - their version of Google - that is attacking an American Company right now, at least based on the publicly available evidence. You see in China, all companies are owned partly by the Chinese Government, and that ownership is a minimal percentage but effectively equals a controlling stake because after all, its their government.  As a result, the Chinese Government can control any company in China if they so choose.

The reason China’s Government is attacking GitHub is because it hosts software that allows people to have free access to world news and sites like the New York Times. The Chinese government wants to control its people and the data they have access to, so it views these open source projects as a threat to its control and has attacked GitHub in the hope that they can censor GitHub into stop hosting the files.

That is right; The real goal is simply to get people to stop having access to this data. Its about using fear to create censorship.  This is public data at this point so I feel no need to debate it or question it.

As an American I’m against censorship and I’m against these cowardly actions by the Chinese Government. But you know what? I’m also a realist. 

I understand that this will not be the last time somebody objects to code Github hosts and as a result, I have been thinking a lot about this issue for the past few days while watching the attacks.

Github has responded very well to these attacks.  They did not take down the offending code, they did not bow to pressure or censorship, and they did not attack back even if nobody I know would hold it against them.  So I have some ideas that may help GitHub.  But first, I want to congratulate GitHub on being successful enough that the Chinese Government is now so scared of them that this attack on GitHub is even happening at all.  Because lets face it; if China was not scared of this small American Company they would have no other reason to attack it as they have.  So Congratulations GitHub, what you do to allow freedom of information and access to open source code keeps powerful people who abuse that power to restrict and censor data from sleeping well at night, enough that they are willing to have people in the their government be paid to attack you.  Congratulations! You are a small american company who is wining against an entire country! Keep at it!

Now for a few simple ideas:

1. Allow accounts and organizations to use custom DNS that is not part of the main www.github.com domain so that if somebody attacks an individual repro or org like this again, the DNS accessing that specific individual repro / org can be routed as needed away from the rest of the github infrastructure that is not the actual target of the attack. No, the current github.io solution isn't good enough. 2. For #1 to work the best the casual CNAME records github promotes for custom sites is not the solution here.  This needs to start as a single AA record with a very low timeout that gives a wildcard DNS so that {repro-name}.whatever.github.com resolves to the normal github infrastructure, but allows an override so that if china-hates-this-code.github.com gets attacked all traffic for it can be re-zoned even to a separate data center if needed.   Git allows for the data to be moved very easily.. so why not update your DNS to allow it as well?

3. Allow older projects to upgrade all account usage to the new domain system described in #2.  Sure, a repositories origin may need to be updated, etc, but GIT was built to allow this so its a minimal issue at best. 4. Allow an organization to REQUIRE 2 factor Authentication on all repository members in order to be, get, or remain a member of that organization.  Github currently allows us to search for members in our org that don't have it enabled (https://developer.github.com/changes/2014-01-29-audit-org-members-for-2fa/) ; but it is not enforced yet, so that is only the first step for security when China or some other communist/socialist dictator attacks a Repository.  So Please, Allow us to set a strict requirement organisation-wide that all organization members must have 2 factor auth set up and working to be invited into a org. 5. Make as part of #4 that if anybody who has 2 factor authentication set up in their account for a organization that requires it, that the millisecond that they remove that 2factor authentication from their account they are kicked from the org.  This will protect against accounts being de-secured and the hassle to the user is minimal since if they are part of that org they can get re-added easily once they re-enable it. have validated they are still the owner, etc. 6. Be more public about these attacks.  The lack of data is killing me as a security researcher. ;) 7. Better monitoring and notification on if an account is targeted by an attacker. Tell me as early as possible that my repository/account/organization is getting attacked so that I can help do what I can to mitigate the threat or back up data.

8. Allow an organization to set an explicitly more strict password policy for its members that all members of that organization must follow.  A members personal account password could thus be required to be at least as strict/secure as the rules set in that policy, and a users account that is a member of multiple organizations with different password policies would be required to use the strictest password policy from that list of possible combinations. You can mitigate the “grandfathering” of older insecure passwords into stricter policies by requiring that a password be changed when a stricter policy is detected as a user joins an organization that requires that stricter password policy than the previous groups. 9. Allow public/private access key pairs to expire on a time or event such as multiple failed access attempts or removal from a third party group/repro.  We can already get an accounts github public keys from github via the API with a simple HTTP GET request; but what if I want to limit access for a key past a specific time or event? Sure I can manually remove it but that assumes I am alive and able to do so. 10. Allow us to protect our accounts from deleting a repository or its data by requiring a special password or authentication that is separate from the general authentication/login to do so.   Right now we just need to copy and paste the repository name from the popup to delete a repro; That is a good start for protecting against accidental deletions, but what about intentional sabotage by somebody that manages to gain access to our account without our consent? More thought needs to be given to this issue. I have more ideas, but these are the one I felt like making public. Feel free to reply, share your thoughts, etc.

[honestduane]

Keep old code around, so you can fix it.

Part of being better and better at something is acknowledging that you are not perfect at it already; this craftsman mindset is what separates the people who think they have graduated and can now finish studying and learning, from the greats who have built our society and created the inventions and wonders that make the world what it is is today. Another part of being better and better at your role is that you become aware and apt at finding things, little mistakes, little optimizations, that somebody under your skill could not tell even existed.  You grow to the point where you are already the best in your circle but to you, you made mistakes even if nobody else is even aware of it.

That is craftsmanship; the search for perfection in skill, unending.

As a result, One of the things I enjoy doing is looking back at code I wrote months ago. It gives me a feeling of progress to pick out the mistakes I may have made, and gives me hope for the future. It also lets me gauge my own progress as a software craftsman, even if at times it ca be painful. In the end, what matters is I care enough to try to improve my ever evolving skill set even when nobody else is watching.

[honestduane]

Silverlight? Thats dead, right?

I just got off the phone with a Directory of Technology for a company who is looking for somebody to work on something based in Microsoft Silverlight for the next 6 months on contract that will not go perm.

Problem is, Silverlight is a considered dead technology in C# circles so at this point while they can find people who CAN do it, they are unable to find people who WILL do it, as being willing to add 6 months of a dead technology to their resume as a contract is not something most people are willing to do unless they totally love the technology.

Nobody I know loves Silver-light that much.

If you interested, let me know and I will put you in touch with the right people. I don’t get anything, it doesnt cost you anything.  I just want to connect people; The guy i spoke with honestly seemed sad about being unable to fill this role and I just want to help,

[honestduane]

You are given 10 billion dollars to create a game show. It can involve anything.What is your game show?

The money goes into a fund I control and the show is a tax write off paid for by the interest generated by the fund.

10 billion at 4% interest is a little over $33 million dollars a month. 4 weeks to a month so let make this show weekly.

Lets say I "invest" 5 million a weekly show and pay the rest to myself for life.

Show is a remix of "American Idol" and "Shark Tank". People vote on winners and the companies america votes for get funded. The shows that get funded have to give the show a non-disputable equity stake and a perm. seat on its board of directors, filled by anybody I choose.

The show would be making money handover fist. And I would be throwing money at things that may actually matter.

I would call it "American Entrepreneur".

[honestduane]

[honestduane]

Failure is only the opportunity to more intelligently begin again.

Henry Ford

[honestduane]

Rest in Peace, Leonard Nimoy. #LLAP

[honestduane]

The ayes have it.

- The FCC choosing to regulate the Internet under title two order to be able to legally enforced freedom of information.

[honestduane]

Everything I wanted to say about MongoDB has already been said by this guy, so please just read this guys post in my voice.

[honestduane]

However, I continue to try and I continue, indefatigably, to reach out. There’s no way I can single-handedly save the world or, perhaps, even make a perceptible difference - but how ashamed I would be to let a day pass without making one more effort.

Isaac Asimov

[honestduane]

Non-Zero days.

[honestduane]

Praises for our past triumphs are as feathers to a dead bird.

Paul Eldridge