Things Spenser is reading

[mindofadeveloper]

Tzu-li and Tzu-ssu were boasting about the size of their latest programs. ‘Two-hundred thousand lines,’ said Tzu-li, ‘not counting comments!’ Tzu-ssu responded, ‘Pssh, mine is almost a million lines already.’ Master Yuan-Ma said, ‘My best program has five hundred lines.’ Hearing this, Tzu-li and Tzu-ssu were enlightened.

-- Master Yuan-Ma, The Book of Programming

There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies.

-- C.A.R. Hoare, 1980 ACM Turing Award Lecture

Read the full article on writing clean code

[gregbabula]

Web Components & the Future of CSS

CSS is what got Philip Walton into web development. When he found out about Web Components, a light bulb went off and he started to think about how these tools were going to make writing CSS so much better. This talk at is about those things.

[mindofadeveloper]

A few weeks ago, I heard that my slow and unreliable ISP was raising their prices, and I decided to look around for a better ISP. I found one in the form of Novus, which has fibre runs to towers around the Vancouver area. I signed up; they came to the building and placed the necessary patch cable in the basement telecommunications room; and I had 50/10 Mbps internet access costing less than my previous 25/2.5 Mbps.

Then I went onto Novus' account management website and found my bandwidth utilization graph. "Cool", I thought, "they're using RRDtool. I wonder if they're generating the standard day/week/month/year graphs, or just the monthly graph." Right click, open in new tab, look at URL. "Huh, that's interesting, it's just a path to a .gif file, not a CGI invocation. Well, maybe they're rewriting usage_graphs to the directory with the graphs for whichever user is logged in. What do I get if I issue a request for the directory itself?"

Click through to read about how Novus handled a hole in their security

[mindofadeveloper]

This is an annotated version of my 31C3 talk on Thunderstrike, a significant firmware vulnerability in Apple's EFI firmware that allows untrusted code to be written to the boot ROM and can resist attempts to remove it. There is also an hour long video of the talk if you prefer to watch instead of read. If you just want the tl;dr version, you can skip to the summary of the talk or check out the FAQ.

Click through to read the full article

[mindofadeveloper]

Practicing effective self-review

It's nearly midnight. The end of a long coding session. Your code seems to work pretty well; all tests pass and it doesn't blow up when you use it. It was a hard-fought battle, and you’re feeling g...

Click through to read the full article

[mindofadeveloper]

How to maintain the balance between adding new features and refactoring existing code? Here are some rules of thumb for choosing when to refactor and how much.

Click through to read the full article

[phonebloks]

VIDEO: PROJECT ARA UPDATE

By Dave Hakkens, Phonebloks

We went to NK Labs in Boston to see the progress of the Ara prototype. Here is an update video to show you how it looks. Enjoy!

[nfarina]

Let's Talk About Beacons

If you’ve been following the tech scene lately, you may have heard a thing or two about “Beacons”. What are Beacons?

Beacons are hardware devices emitting a unique signature that can be picked up by your smartphone. They are typically small and powered by coin-cell batteries, making them easy to stick almost anywhere.

What we call a Beacon today was originally invented and popularized by Apple way back in 2013 when they introduced the iBeacon API. In fact, referring to these devices as just “Beacons” is a bit funny, considering no one was talking about Beacons before iBeacons existed. It’s a lot like discussing the “tablet market” back when the tablet market consisted entirely of iPads.

Read More

[mindofadeveloper]

Live coding in VR with the Oculus Rift, Firefox WebVR, JavaScript and Three.js

I built a live-coding web app for the Oculus Rift where you code in JavaScript using Three.js and watch the world change around you in real-time. It's quite ...

Click through to watch the video

[securityreactions]

When you realize the new vulnerability you're reading about affects your company.

by anonymous submission

[mindofadeveloper]

10 Top Mistakes Angular.js Developers Make

AngularJS expert Mark Meyer runs down the top 10 mistakes made by AngularJS developers, from code organization to bloated controllers.

As a developer who is just becoming comfortable with AngularJS, this post brought up a few issues I've already started to encounter.

Click through to read the full article

[devopsreactions]

What happens when I am allowed to rewrite code from scratch

by @osnipassos

[mindofadeveloper]

On Wednesday of last week, details of the Shellshock bash bug emerged. This bug started a scramble to patch computers, servers, routers, firewalls, and other computing appliances using vulnerable versions of bash. Since then [Cloudflare] we've been monitoring attacks we've stopped in order to understand what they look like, and where they come from. Based on our observations, it's clear that hackers are exploiting Shellshock worldwide.

Click through to read the full article

[mindofadeveloper]

We want to find regular expression delimiters that enable us to avoid inserting additional escape sequences into our patterns. This is ideal when we want to inject foreign patterns where we can't guarantee which characters will be used.

Paul Morris has a great breakdown of the various regex delimiters that can be used, and why some are better than others. At his recommendation, I've been using {...} and have found my patterns to be much more readable.

Click through to read the full article

[mindofadeveloper]

Using Machine Learning and NodeJS to detect the gender of Instagram Users

The goal of this article is to provide a very practical guide to deploying a machine learning solution at scale. Not everything is proven right or optimal, and as with …

Totems (an analytics and marketing platform for Instagram) developed a Neural Network to determine gender of an Instagram user. Of the users I tested, it was able to successfully (and with a probability of 0.98+) determine the gender.

Click through to read the full article

[mindofadeveloper]

There have been hundreds of posts written on the dangers of using curl <url> | sh to install (Node|Ruby|Composer|etc), and a common response is that you can view the source before executing it. Darian Moody has written a quick PoC on why viewing the source in your browser is not enough to ensure something does what you expect.

To cut straight to the chase, this attack works on the theory that the content of the .sh files are easily checked for safety and that the version of the file viewed in a browser window is identical to that which would get downloaded via curl. The problem with this assumption is that a given browser and curl do not send the same user-agent by default and therefore someone with knowledge of this could take advantage of this and compromise the .sh file (jumping through other loops do to that first obviously).

Click through to read the full article

[mindofadeveloper]

What is the core difference between Gulp and Grunt? Mark Dalgleish has put together some great slides explaining the ins-and-outs, and some of the history behind both.

Click through to read the full article