×
Education

How Should High Schools Teach Computer Science? (acm.org) 151

A high school computer science teacher claims there's an "unacknowledged failure" of America's computer science (CS) classes at the high school and junior high school level. "Visit classrooms and you'll find students working with robotic sensors, writing games and animations in Scratch, interfacing with Arduino microcontrollers, constructing websites, and building apps with MIT App Inventor...

"Look underneath the celebratory and self-congratulatory remarks, however, and you'll find that, although contemporary secondary education is quite good at generating initial student interest, it has had much less success at sustaining that engagement beyond a few weeks or months, and has frankly been ineffectual in terms of (a) measurable learning for the majority of students; (b) boosting the number of students who take a second CS course, either in high school or college; and (c) adequately preparing students for CS college study."

Long-time Slashdot reader theodp writes: In " A New Pedagogy to Address the Unacknowledged Failure of American Secondary CS Education ," high school computer science teacher Scott Portnoff argues that a big part of the problem is the survey nature of today's most popular high school CS course offerings — Exploring Computer Science (ECS) and AP Computer Science Principles (AP CSP) — both of whose foundational premise is that programming is just one of many CS topics. "Up until a decade ago," Portnoff explains, "introductory high school computer science classes were synonymous with programming instruction, period. No longer."

This new status quo in secondary CS education, Portnoff argues, resulted from baseless speculation that programming was what made Java-based AP CS A inaccessible, opposed to, say, an uninspiring or pedagogically ineffective version of that particular curriculum, or a poorly prepared instructor. It's quite a departure from the 2011 CSTA K-12 Computer Science Standards, which made the case for the centrality of programming in CS education ("Pedagogically, computer programming has the same relation to studying computer science as playing an instrument does to studying music or painting does to studying art. In each case, even a small amount of hands-on experience adds immensely to life-long appreciation and understanding").

This teacher believes that programming languages are acquired rather than learned, just like any other human language — and concludes the solution is multi-year courses focused on one programming language until proficiency is fully acquired.

For this reason, for the last seven years he's also been making his students memorize small programs, and then type them out perfectly, arguing that "the brain subconsciously constructs an internal mental representation of the syntax rules implicitly by induction from the patterns in the data."
Businesses

AWS Launches 'Amazon Honeycode', a No-Code App Building Service (zdnet.com) 43

"Amazon Web Services on Wednesday launched Amazon Honeycode, a fully-managed service that enables companies to build mobile and web applications without any programming," reports ZDNet: Customers can use the service to build apps that leverage an AWS-built database, such as a simple task-tracking application or a more complex project management app to manage multiple workflows. "Customers have told us that the need for custom applications far outstrips the capacity of developers to create them," AWS VP Larry Augustin said in a statement.

Low-code and no-code tools have been growing in popularity in recent years, enabling people with little or no coding experience to be able to build the applications they need. Other major cloud companies like Salesforce offer low-code app builders. With IT teams stretched thin during the COVID-19 pandemic, low-code tools can prove particularly useful.

Customers "can get started by selecting a pre-built template, where the data model, business logic, and applications are pre-defined and ready-to-use..." Amazon explains in a press release. "Or, they can import data into a blank workbook, use the familiar spreadsheet interface to define the data model, and design the application screens with objects like lists, buttons, and input fields.

"Builders can also add automations to their applications to drive notifications, reminders, approvals, and other actions based on conditions. Once the application is built, customers simply click a button to share it with team members."
Medicine

CA Governor Newsom Announces COVID-19 Modeling Website, Open-Source Tools For 'Citizen Scientists' (cbslocal.com) 89

Long-time Slashdot reader PCM2 shares a report from CBS News: Gov. Gavin Newsom on Thursday announced a new COVID-19 modeling website as well as new open-source tools designed to help California residents understand the data informing local health departments and empower what he called "citizen scientists." The governor introduced the new coronavirus modeling website [...] as a way for residents to see the raw data that is driving the decisions of state and county officials with full transparency.

The new website features three sections: a "Nowcast" section that provides the most current information on how fast COVID-19 is spreading in the state and by county; a "Forecasts" section that provides short-term COVID-19 forecasts in the state and by county; and a "Scenarios" section that projects the possible long-term impacts under different scenarios and responses to COVID-19, again for the whole state and by county.
"We want to open up our site to 'netizen-tists' ... of citizen-scientists, people that are out there doing coding every single day," said Newsom. "We want to give them access through an open-source platform to all of the available data that we have, that I have, that our health professionals have, in a way that we don't believe has been done before anywhere in the United States. This is a deep dive for transparency and openness. This is a new resource that we are making available today."
Programming

Michael Hawley, Programmer, Professor and Pianist, Dies at 58 (nytimes.com) 17

Michael Hawley, a computer programmer, professor, musician, speechwriter and impresario who helped lay the intellectual groundwork for what is now called the Internet of Things, died on Wednesday at his home in Cambridge, Mass. He was 58. From a report: The cause was colon cancer, said his father, George Hawley. Mr. Hawley began his career as a video game programmer at Lucasfilm, the company created by the "Star Wars" director George Lucas. He spent his last 15 years curating the Entertainment Gathering, or EG, a conference dedicated to new ideas. In between, he worked at NeXT, the influential computer company founded by Steve Jobs after he left Apple in the mid-1980s, and spent nine years as a professor at the Massachusetts Institute of Technology Media Lab, a seminal effort to push science and technology into art and other disciplines. He was known as a scholar whose ideas, skills and friendships spanned an unusually wide range of fields, from mountain climbing to watchmaking. Mr. Hawley lived with both Mr. Jobs and the artificial intelligence pioneer Marvin Minsky, published the world's largest book, won first prize in an international competition of amateur pianists, played alongside the cellist Yo-Yo Ma at the wedding of the celebrity scientist Bill Nye, joined one of the first scientific expeditions to Mount Everest, and wrote commencement speeches for both Mr. Jobs and the Google co-founder Larry Page.

Two of Mr. Hawley's Media Lab projects -- Things That Think and Toys of Tomorrow -- anticipated the Internet of Things movement, which aims to weave digital technology into everything from cars to televisions to home lighting systems. Led by companies like Amazon, Google, Intel and Microsoft, the movement is now a $248 billion market, according to the market research firm Statista. Mr. Hawley developed "a pattern of ideas that emerged long before the Internet of Things," Nicholas Negroponte, founder of the Media Lab, said in an email. "I would call that pattern not artificial intelligence, but intelligence in the artificial," he wrote. Mark Seiden, an independent computer security consultant who met Mr. Hawley in the early 1980s when they were both working at IRCAM, a music lab in Paris, and eventually hired him at Lucasfilm, compared Mr. Hawley's exploits to those of George Plimpton, the writer whose participatory kind of journalism had him masquerading as a boxer, a professional football player, a circus performer and a stand-up comedian.

Perl

Perl 7 Announced As Evolving Perl 5 With Modern Defaults (phoronix.com) 86

Taking place this week is the virtual Perl + Raku "Conference in the Cloud" as a result of the COVID-19 pandemic causing the event to go virtual. A big announcement out of it is Perl 7. From a report: Perl 7 basically amounts to Perl 5 with more modern defaults and foregoing some of the extensive backward compatibility support found with Perl 5. News of Perl 7 comes a few days after the release of Perl 5.32. Perl 7 succeeds Perl 5 due to the Perl 6 initiative previously for what is now known as the Raku programming language. So to avoid confusion, similar to the PHP 6 debacle, Perl 7 is the next version. For the most part though Perl 7 is close to Perl 5.32 with changed defaults and is more forward looking with less commitment to backward compatibility support.
Television

Amazon Is Looking To Add Live TV To Prime Video (protocol.com) 33

Amazon is looking to add 24/7 live programming to its Prime Video service, according to Protocol. The new channels could include live news, music and sports as well as scheduled movies and TV show showings. From the report: Speaking under the condition of anonymity, an industry insider told Protocol that Amazon has been "actively pursuing" deals to license live and linear programming. "You should assume they're talking to everybody," he said. By adding live programming to Prime Video, Amazon could differentiate itself from services like Netflix and Disney+ that are focused exclusively on on-demand video. The move is also a response to the growing popularity of linear streaming services like Pluto and Xumo, and ultimately could be part of a different take on live TV: Instead of licensing the same costly programming bundles as traditional cable services, Amazon may be looking to combine its existing on-demand content and a much more narrow take on must-see live TV.

Amazon has been experimenting with live programming for Prime Video over the past several years, which included licensing NFL Thursday Night Football as well as the English Premier League. In the future, it may also stream live concerts, political debates and news programming, according to a job listing for Amazon's Prime Video live events team. "This is a transformative opportunity, the chance to be at the vanguard of a program that will revolutionize Prime Video," that job listing reads. Beyond individual live events, Amazon is also looking to license complete 24/7 feeds. "Linear TV enables customers to watch 24/7 streams of their favorite TV stations airing programs including sports, news, movies, award shows, special events and TV shows," one job listing details. Another specifically singles out live broadcasters and cable networks as potential partners.

Businesses

Apple Approves Hey Email App, But the Fight's Not Over (theverge.com) 14

After rejecting an update last week, Apple has approved a new version of the subscription email app Hey. From a report: The approval, which came last week, ahead of today's Apple Worldwide Developer Conference, is meant to lower the temperature after Apple's initial app rejection drew widespread condemnation from lawmakers and other developers. But the approval is also only temporary in spirit, meant to give Hey developer Basecamp time to develop a version of the app more in line with Apple's policies -- and Basecamp's approach to that challenge is very aggressive, as a letter posted to its website today details.
Programming

David Heinemeier Hansson Explains What It Takes to Write Great Code (evrone.com) 66

The "bespoke development" site Evrone.com (an IT outsourcing company) interviewed Ruby on Rails creator David Heinemeier Hansson (who is also co-founder and CTO of Basecamp -- and a racecar driver) shortly before he spoke at RubyRussia, Evrone's annual Moscow programming conference.

And they asked him an interesting question. As a man who's seen lots of Ruby code, "what makes code good or shitty? Anything that is obvious for you at first glance?" David Heinemeier Hansson: If the code is poorly written, usually it smells before you even examine the logic. Indentation is off, styles are mixed, care is simply not shown. Beyond that, learning how to write great code, is a life long pursuit. As I said in my RailsConf 2014 keynote, we're not software engineers, we're software writers. "Writing" is a much more suitable metaphor for what we do most of the time than "engineering" is. Writing is about clarity and presenting information in a clear-to-follow manner so that anybody can understand it.

There's no list of principles and practices that somebody can be taught and then they will automatically produce clear writing every time. If you want to be a good writer, it's not enough just to memorize the dictionary. Just knowing the words available to you, knowing the patterns of development is not going to make you a good developer. You have to develop an eye. You have to decide that the most important thing for your system is clarity. When you do decide that, you can start developing an eye.

The only way to become a good programmer, where, by definition, I define good programmers as somebody who writes software with clarity, is to read a lot of software and write a lot of software.

In 2016, David Heinemeier Hansson answered questions from Slashdot readers.
Programming

Has the Time Finally Come for Generics in Golang? (thenewstack.io) 60

An anonymous reader quotes technology columnist Mike Melanson: The debate around adding generics to the Go programming language has been going on for years now, often with much resistance, but it's starting to look like one proposal finally has some backing and general acceptance from the greater Go community — much to the surprise of some involved.

Introduced this week in a blog post looking at the next step for generics, penned by Golang team members Ian Lance Taylor and Robert Griesemer, the first update in nearly a year on the topic explains that the generics design draft previously submitted for feedback has been refined, resulting in an updated design draft... For the time being, the team has introduced an experimentation tool that "permits people to type check and run code written using the version of generics described in the design draft" by translating generic code into ordinary Go code. It is meant to give users a feel of how the proposed design would, if accepted work, and they note that it will be implemented differently if so.

As for the proposal itself, it offers several levels of detail, from an abstract, to a high-level overview, to the full level of detail you might expect from such a document. As with everything Go, the design is intended to be fully backward compatible with Go 1, and the authors note that "as the term generic is widely used in the Go community, we will use it below as a shorthand to mean a function or type that takes type parameters.

"Don't confuse the term generic as used in this design with the same term in other languages like C++, C#, Java, or Rust; they have similarities but are not the same."

The article also notes that Go's package repository is now open source.
Programming

Stack Overflow Explores Why Developers Love TypeScript More Than Python (stackoverflow.blog) 93

Stack Overflow asked 65,000 programmers for their favorite programming language, and this year Microsoft's TypeScript knocked Python from the #2 spot. So they interviewed Microsoft's principal engineering lead for the language "to find out what about TypeScript makes it so dang lovable." Q: Do you remember why the team came up with TypeScript, why you wanted to release something like this?

A: When I joined the team, there were a lot of people at Microsoft who wanted to develop JavaScript at what we call "application scale." Teams like TFS and Office wanted to build large JavaScript applications. A lot of those people had familiarity with statically-typed languages — C++, C#, Java, that kind of thing. They wanted to have that static typing available both for conceptual scalability and for the tooling...

Q: Was there a point where you saw an adoption point of no return? Was there something that came along where people were like, oh, yeah, we do TypeScript now?

A: Oh, it was definitely Google announcing that they were going to use TypeScript with Angular. That's kind of lost to time now. But if you look at the graphs for TypeScript, literally any graph — GitHub stars, downloads, pull requests — you can see the exact point when that Angular announcement came out. And the graph just changes. It never looks back... TypeScript shores up that last rough edge on JavaScript and gives you something that's just really fun to work with and runs everywhere. I think if TypeScript were a language that was built on top of a less universal language or a less fun language, I don't think it would be as successful. It's really taking something that's great and making it better...

I think my favorite thing that I see is people on the Internet saying, 'I did this huge refactoring in TypeScript and I was refactoring for three hours. And then I ran my code and it worked the first time.' In a dynamic language, that would just never, ever happen....

I would just say to people, if static types aren't a good fit for you, for either your programming style or the problem you're working on, just skip it. That's fine. It's okay. I won't be offended. If someone can get a thirty thousand line application that gets its job done without static types, I'm very impressed. That just seems really difficult. But kudos to those people who make it work. Python's the same way. Very few people have working Python type annotations, but Python is incredibly popular. I think the data speaks for itself — I think Python is number three in the survey... I guarantee you that a very small proportion of those Python developers have static types. Whatever your problem domain is, that might be the best fit for you.

Programming

Microsoft's GitHub Offers Open-Source Developers 'One Linter to Rule Them All' (zdnet.com) 33

"GitHub says it's open-sourcing its in-house linting tool, the GitHub Super Linter, to clean up code," reports ZDNet: Having a tool that checks source code for programming blunders and other errors is useful for developers. Now Microsoft-owned GitHub has released the 'Super Linter' to help developers avoid the hassles of setting up code repositories with multiple linters...

GitHub describes it as a "simple combination of various linters, written in bash, to help validate your source code" for the purpose of preventing broken code from being uploaded to a 'master' branch, the key branch that other branches in a tree are merged to... The Super Linter Action lets developers 'lint' or check their code base using popular linters for Python, JavaScript, Go, XML, YAML, and more programming languages. As such, GitHub engineer Lucas Gravley describes the Super Linter as the "one linter to rule them all".

"The GitHub Super Linter was built out of necessity by the GitHub Services DevOps Engineering team to maintain consistency in our documentation and code while making communication and collaboration across the company a more productive experience," says Gravley... "When you've set your repository to start running this action, any time you open a pull request, it will start linting the code case and return via the Status API. It will let you know if any of your code changes passed successfully, or if any errors were detected, where they are, and what they are," explains Gravley.

The Super Linter doesn't fix problems but does flag them, so developers can then go back and fix them before they reach the master branch.

Intel

Intel Will Soon Bake Anti-malware Defenses Directly Into its CPUs (arstechnica.com) 57

The history of hacking has largely been a back-and-forth game, with attackers devising a technique to breach a system, defenders constructing a countermeasure that prevents the technique, and hackers devising a new way to bypass system security. On Monday, Intel is announcing its plans to bake a new parry directly into its CPUs that's designed to thwart software exploits that execute malicious code on vulnerable computers. From a report: Control-Flow Enforcement Technology, or CET, represents a fundamental change in the way processors execute instructions from applications such as Web browsers, email clients, or PDF readers. Jointly developed by Intel and Microsoft, CET is designed to thwart a technique known as return-oriented programming, which hackers use to bypass anti-exploit measures software developers introduced about a decade ago. While Intel first published its implementation of CET in 2016, the company on Monday is saying that its Tiger Lake CPU microarchitecture will be the first to include it. ROP, as return-oriented programming is usually called, was software exploiters' response to protections such as Executable Space Protection and address space layout randomization, which made their way into Windows, macOS, and Linux a little less than two decades ago. These defenses were designed to significantly lessen the damage software exploits could inflict by introducing changes to system memory that prevented the execution of malicious code. Even when successfully targeting a buffer overflow or other vulnerability, the exploit resulted only in a system or application crash, rather than a fatal system compromise.
Programming

GitHub, Android, Python, Go: More Software Adopts Race-Neutral Terminology (zdnet.com) 413

"The terms 'allowlist' and 'blocklist' describe their purpose, while the other words use metaphors to describe their purpose," reads a change description on the source code for Android -- from over a year ago. 9to5Mac calls it "a shortened version of Google's (internal-only) explanation" for terminology changes which are now becoming more widespread.

And Thursday GitHub's CEO said they were also "already working on" renaming the default branches of code from "master" to a more neutral term like "main," reports ZDNet: GitHub lending its backing to this movement effectively ensures the term will be removed across millions of projects, and effectively legitimizes the effort to clean up software terminology that started this month.

But, in reality, these efforts started years ago, in 2014, when the Drupal project first moved in to replace "master/slave" terminology with "primary/replica." Drupal's move was followed by the Python programming language, Chromium (the open source browser project at the base of Chrome), Microsoft's Roslyn .NET compiler, and the PostgreSQL and Redis database systems... The PHPUnit library and the Curl file download utility have stated their intention to replace blacklist/whitelist with neutral alternatives. Similarly, the OpenZFS file storage manager has also replaced its master/slave terms used for describing relations between storage environments with suitable replacements. Gabriel Csapo, a software engineer at LinkedIn, said on Twitter this week that he's also in the process of filing requests to update many of Microsoft's internal libraries.

A recent change description for the Go programming language says "There's been plenty of discussion on the usage of these terms in tech. I'm not trying to have yet another debate." It's clear that there are people who are hurt by them and who are made to feel unwelcome by their use due not to technical reasons but to their historical and social context. That's simply enough reason to replace them.

Anyway, allowlist and blocklist are more self-explanatory than whitelist and blacklist, so this change has negative cost.

That change was merged on June 9th -- but 9to5Mac reports it's just one of many places these changes are happening. "The Chrome team is beginning to eliminate even subtle forms of racism by moving away from terms like 'blacklist' and 'whitelist.' Google's Android team is now implementing a similar effort to replace the words 'blacklist' and 'whitelist.'" And ZDNet reports more open source projects are working on changing the name of their default Git repo from "master" to alternatives like main, default, primary, root, or another, including the OpenSSL encryption software library, automation software Ansible, Microsoft's PowerShell scripting language, the P5.js JavaScript library, and many others.
Robotics

Lego Unveils New 'Robot Inventor' Mindstorms Kit (pcmag.com) 42

After seven years, Lego has finally unveiled a new Mindstorms kit, reports PC Magazine -- the Lego Mindstorms Robot Inventor, available this fall for $359: The Robot Inventor kit lets kids (or adults) build five different robot models out of 949 pieces, ranging from a four-legged walker to a bipedal wheeled robot that can give high-fives. All of these robots can be programmed to perform different tricks, like grabbing items, firing plastic projectiles, avoiding obstacles, and playing various sports with a ball.

The kit includes four low-profile, medium-angular motors; a color and light sensor; and a distance sensor, which work together with the Intelligent Hub block to power these robots and execute commands. Of course, like all Mindstorms kits, you can build your own robotic creations with the tools at hand, and add Lego Technic and System pieces for more complex projects.

The Intelligent Hub serves as the brain of Lego Mindstorms, and the block that houses the Mindstorms Robot Inventor Kit is the most advanced one yet. It features six input/output ports for sensors and motors, a six-axis gyro/accelerometer, a speaker, and a five-by-five LED matrix. The Intelligent Hub and all robots built with it can be controlled wirelessly over Bluetooth with the Lego Mindstorms Robot Inventor app for Android, iOS, Windows 10, and macOS. The app supports programming in both the tile-based Scratch language and in Python, for more complex projects that require the precision of written code.

Programming

Bjarne Stroustrup Releases 168-Page Paper on How C++ Thrived (acm.org) 101

Bjarne Stroustrup, the 69-year-old Danish creator of C++, just released a 168-page paper (published under a Creative Commons Attributions-NoDerivatives license) in the Proceedings of the ACM on Programming Languages, detailing the growth of C++ from its 21st birthday in 2006 up through the year 2020.

It begins by noting that by 2006, C++ "contained parts that had survived unchanged since introduced into C in the early 1970s as well as features that were novel in the early 2000s..." Originally, I designed C++ to answer to the question "How do you directly manipulate hardware and also support efficient high-level abstraction?" Over the years, C++ has grown from a relatively simple solution based on a combination of facilities from the C and Simula languages aimed at systems programming on 1980s computers to a far more complex and effective tool for an extraordinary range of applications... [T]his is also the story of the people involved in the evolution of C++, the way they perceived the challenges, interpreted the constraints on solutions, organized their work, and resolved their inevitable differences.
From the abstract: From 2006 to 2020, the C++ developer community grew from about 3 million to about 4.5 million. It was a period where new programming models emerged, hardware architectures evolved, new application domains gained massive importance, and quite a few well-financed and professionally marketed languages fought for dominance. How did C++ -- an older language without serious commercial backing -- manage to thrive in the face of all that?

This paper focuses on the major changes to the ISO C++ standard for the 2011, 2014, 2017, and 2020 revisions... Themes include efforts to preserve the essence of C++ through evolutionary changes, to simplify its use, to improve support for generic programming, to better support compile-time programming, to extend support for concurrency and parallel programming, and to maintain stable support for decades' old code... Specific language-technical topics include the memory model, concurrency and parallelism, compile-time computation, move-semantics, exceptions, lambda expressions, and modules.

"I hope other languages learn from C++'s successes," the paper concludes. "It would be sad if the lessons learned from C++'s evolution were limited to the C++ community."
AI

Python Overtakes Java? JetBrains Releases 'State of Developer Ecosystem' Survey (jetbrains.com) 67

The creators of the Kotlin programming language — the Czech software development company Jetbrains — announced results from their annual "State of the Developer Ecosystem" survey. This year's survey involved 19,696 developers in 18 countries, and found that:
  • JavaScript is the most used overall programming language. Websites are the most common type of application developers work on.
  • Python has overtaken Java in the list of programming languages used in the last 12 months. And it is also the most studied language. In the last 12 months 30% of respondents have started or continued to learn Python — even more than last year.
  • Go, Kotlin, and Python are the top 3 languages developers are planning to adopt or migrate to.

JetBrains also gathered some statistics from programmers for a special section on Lifestyle and Fun:

  • 65% said they preferred laptops, while 33% preferred desktops.
  • 52% said they contributed to charity.
  • 20% said they owned a cat; another 20% said they owned a dog.
  • 16% said they owned cryptocurrency.

And when asked if they contributed to open-source projects:

  • 44% said "No, but I would like to."
  • 20% said "I have only contributed a few times."
  • 16% said "Yes, from time to time (several times a year)."
  • 11% said "Yes, regularly (at least once a month)."
  • 4% said "No, and I would not like to."
  • 3% said "I work full-time on open-source code and get paid for it."
  • 2% said "I work full-time on open-source code but do not get paid for it."

Also interesting were the answers to the question: If your country's government replaced your courts with AI, would you trust it? The results were:

  • Probably not (26%)
  • Definitely not (24%)
  • Maybe (26%)
  • Probably yes (20%)
  • Definitely yes (5%)

Google

Playing Around With the Fuchsia OS (quarkslab.com) 102

Security and software development company Quarkslab played around with Google's new Fuchsia operating system, which could one day replace Android on smartphones and Chrome OS on laptops. The researchers "decided to give a quick look at Fuchsia, learn about its inner design, security properties, strengths and weaknesses, and find ways to attack it." Here's what they concluded: Fuchsia's micro kernel is called Zircon. It is written in C++. [...] Contrary to every other major OS, it appears rather difficult to target the Zircon kernel directly. A successful RCE (Remote Code Execution) on the world-facing parts of the system (USB, Bluetooth, network stack, etc) will only give you control over the targeted components, but they run in independent userland processes, not in the kernel. From a component, you then need to escalate privileges to the kernel using the limited number of syscalls you can access with the handles you have. Overall, it seems easier to target other components rather than the kernel, and to focus on components that you can talk to via IPC and that you know have interesting handles.

Overall, Fuchsia exhibits interesting security properties compared to other OSes such as Android. A few days of vulnerability research allowed us to conclude that the common programming bugs found in other OSes can also be found in Fuchsia. However, while these bugs can often be considered as vulnerabilities in other OSes, they turn out to be uninteresting on Fuchsia, because their impact is, for the most part, mitigated by Fuchsia's security properties. We note however that these security properties do not -- and in fact, cannot -- hold in the lowest layers of the kernel related to virtualization, exception handling and scheduling, and that any bug here remains exploitable just like on any other OS. All the bugs we found were reported to Google, and are now fixed.

Again, it is not clear where Fuchsia is heading, and whether it is just a research OS as Google claims or a real OS that is vowed to be used on future products. What's clear, though, is that it has the potential to significantly increase the difficulty for attackers to compromise devices.

Bug

Brave Browser Mistake Adds Its Referrer Code For Cryptocurrency Sites (yahoo.com) 26

The following report appeared on Yahoo! Finance: Privacy-focused browser Brave was found to autocomplete several websites and keywords in its address bar with an affiliate code. Shortly after a user published his findings, Brave CEO and co-founder Brendan Eich addressed the incident and called it "a mistake we're correcting." Eich said that while Brave is a Binance affiliate [a cryptocurrency exchange], the browser's autocompleting feature should not have added any new affiliate codes.

"The autocomplete default was inspired by search query clientid attribution that all browsers do, but unlike keyword queries, a typed-in URL should go to the domain named, without any additions," Eich wrote in the thread. "Sorry for this mistake — we are clearly not perfect, but we correct course quickly," he added.

Android Police reports the mistake occured more than 10 weeks ago — and that referrer codes were also included for other cryptocurrency-related sites: The browser's GitHub repository reveals the functionality was first added on March 25th, and the current list of sites includes Binance, Coinbase, Ledger, and Trezor. Brave Software receives a kickback for purchases/accounts made with those services — for example, Coinbase says that when you refer a new customer to the service, you can earn 50% of their fees for the first three months.

The nature of these affiliate programs also allows the referrer — in this case, Brave Software — to view some amount of data about the customers who sign up with the code. Coinbase's program provides "direct access to your campaign's performance data," while Trezor offers a "detailed overview of purchases."

Brave CEO and co-founder Brendan Eich (who also created the JavaScript programming language) tweeted, "For what it's worth there's a setting to disable the autocomplete defaults that add affiliate codes, in brave://settings first page. Current plan is to flip default to off as shown here. You can disable ahead of our release schedule if you want to.

"Good to hear from supporters who'll enable it."
Space

How SpaceX Uses Linux, Chromium, C++ and Open Source Libraries (zdnet.com) 69

Long-time Slashdot reader mrflash818 ("Linux geek since 1999") shared a ZDNet article pointing out that SpaceX's Falcon 9 rocket has an onboard operating system that's "a stripped-down Linux running on three ordinary dual-core x86 processors. The flight software itself runs separately on each processor and is written in C/C++."

Interestingly, back in 2018 a Slashdot headline asked whether C++ was "a really terrible language," and Elon Musk replied on Twitter with his single-word answer. "Yes."

ZDNet points out that "ordinary" processors are often needed because of the multi-year development time for the spacecraft they power. Their article notes that the International Space Station actually runs on 1988-vintage 20 MHz Intel 80386SX CPUs: Of course, while those ancient chips work for the station's command and control multiplexer/demultiplexer, they're not much good for anything else. For ordinary day-in and day-out work, astronauts use HP ZBook 15s running Debian Linux, Scientific Linux, and Windows 10. The Linux systems act as remote terminals to the control multiplexer/demultiplexer, while the Windows systems are used for email, the web, and fun.

Usually, though, chips that go into space aren't ordinary chips. CPUs that stay in space must be radiation-hardened. Otherwise, they tend to fail due to the effects of ionizing radiation and cosmic rays. These customized processors undergo years of design work and then more years of testing before they are certified for spaceflight. For instance, NASA expects its next-generation, general-purpose processor, an ARM A53 variant you may know from the Raspberry Pi 3, to be ready to run in 2021...

The Dragon spacecraft's touchscreen interface is rendered using Chromium and JavaScript. If something were to go wrong with the interface, the astronauts have physical buttons to control the spacecraft.

Today the SpaceX software team answered questions on Reddit, revealing they use Chromium with a reactive library developed in-house, and that "All of our on-board computers either run Linux (with the PREEMPT_RT patch) or are microcontrollers that run bare-metal code...." Later they emphasized that for the Falcon 9 and Dragon software, "All of the application-level autonomous software is written in C++. We generally use object oriented programming techniques from C++, although we like to keep things as simple as possible.

"We do use open source libraries, primarily the standard C++ library, plus some others. However, we limit our use of open source libraries to only extremely high quality ones, and often will opt to develop our own libraries when it is feasible so that we can control the code quality ourselves."
Programming

Stack Overflow Investigates Why Developers Love Rust So Much (stackoverflow.blog) 83

This year Stack Overflow's Developer Survey of 65,000 programmers found that Rust was their most-loved programming language -- for the fifth year in a row. To understand why, they interviewed the top contributor to the site's Rust topic. ("The short answer is that Rust solves pain points present in many other languages, providing a solid step forward with a limited number of downsides...") But Stack Overflow also reached out to the Rust core team, including Berlin-based developer Erin Power, asking about any barriers to entry, and why they think Rust was the survey's most-loved language. ("I think it's because Rust makes big promises, and delivers on them...")

And finally, they got responses from Stack Overflow users in their Rust chatroom and forums, noting "Rust users are a passionate bunch, and I got some fascinating insights along with some friendly debates..." Many current programming discussions revolve around whether to use a fast, low-level language that lets you handle memory management or a higher-level language with greater safety precautions. For fans of Rust, they like that it does both.... While some languages just add polish and ease to existing concepts, several users feel that Rust is actually doing new things with a programming language. And it's not doing new things just to be showy; they feel these design choices solve hard problems with modern programming...

Stack Overflow user janriemer: "A quote from Chris Dickinson, engineer at npm, sums it up perfectly for me, because I have thought the same, without knowing the quote at that time: 'My biggest compliment to Rust is that it's boring, and this is an amazing compliment.' Rust is a programming language that looks like it has been developed by user experience designers. They have a clear vision (a why) of the language and carefully choose what to add to the language and what to rework, while listening to what the community really wants. There are no loose ends, it's all a coherent whole that perfectly supports a developer's workflow."

Stack Overflow's post also quotes Jay Oster, a software architect at the infrastructure-as-a-service company PubNub, who argues Rust "ticks all the boxes":
  • Memory safe
  • Type safe
  • Data race-free
  • Ahead-of-time compiled
  • Built on and encourages zero-cost abstractions
  • Minimal runtime (no stop-the-world garbage collection, no JIT compiler, no VM)
  • Low memory footprint (programs run in resource constrained-environments like small microcontrollers)
  • Targets bare-metal (e.g. write an OS kernel or device driver; use Rust as a 'high level assembler')"

He also describes Rust as "akin to wandering around in complete darkness for an entire career, and suddenly being enlightened to two facts:

  • You are not perfect. You will make mistakes. Those mistakes will cause you a lot of problems.
  • It doesn't have to be this way.

Slashdot Top Deals