Robert Heaton

This made me think of two tangentially related things about code quality and reading which are each 10 years old!

Peter Seibel repeatedly tried to start "code reading groups", but found that they didn't quite work, because while everyone agreed that there was much to be learned from code bases, and that many advised "reading" code, most real code doesn't support "reading" so much as "decoding" or perhaps interactively exploring.

https://gigamonkeys.com/code-reading/

Robert Heaton had a fun post about code reviewing without being able to actually read the specifics of the code. With only a blurry view of the structure of code, one can get a sense of its likely virtues and opportunities for improvement. https://robertheaton.com/2014/06/20/code-review-without-your-eyes/

Kind of in the spirit of both, I love code where you don't _have_ to read most of it because:

- class names, generic parameters, etc, make it clear what classes represent

- method names and signatures make it clear how they're to be used; there are no surprises or gotchas in the specifics of the implementation that foist cognitive complexity onto callers, etc

- the right amount / granularity of structure exists, such that when you do need to read something, the section is moderately sized; there's not some enormous, entangled method that's actually doing 5 things at once. Modularity limits the scope of reading.

But also, when you do need to understand implementation specifics, good code acknowledges that…

> You just get the malware Javascript served.

Which happens on any link you click on Reddit, Hacker News or Facebook. Unless you don't click on them and only visit website that you consider trustworthy, you get the exact same risk. Actually even if you may feel that a link is trustworthy, it doesn't even means it actually is, like it happened for the past Firefox 0-day exploit. This guy nearly got it by trusting that [0].

[0] https://robertheaton.com/2019/06/24/i-was-7-words-away-from-being-spear-phished/

> That's not theoretical (like your "but HN could deliver malware, too), that's reality.

My textual example was to discredit the Forbe example. I have an hard time understanding your point about it being theoretical. Are you actually refering to my other example about links from HN that could contains malicious Javascript? That's to know if you check links or you click on them arbitrarily with all the risk that come with it.

My point is that malicious Javascript is extremely rare and when it does happen, it's targeted and doesn't use ad network. Theses vulnerabilities are gold mine and it makes no sense to put it on an ad network and hope that you'll get enough out of it before it get caught and removed/fixed. Selling it to the highest bidder or targeting a specific group of people make much more sense.

If you have any example of where an actual malware was spread using ads, I would be happy to learn about it.

I'm also curious to know if you block Javascript and if…

Same here. It may be basic and crappy, but if you want to read an unsuccessful blog with no attempt at monetization or ads or even visitor counting, mine[1] is where you should feel right at home.

But I guess the author means a platform, not loose websites without a collective 'new' feed. I remember looking for one when wanting to make a new blog and I haven't found a platform that felt right, at least back then (probably ~2015). Heck, I couldn't even find software to install: everything is either super heavy stuff that requires caching or at least a beefy CPU to survive the HN homepage (with custom software, HN can be survived on an ancient Atom CPU even if you use PHP (also pre-PHP7) and do multiple SQL queries per pageload) or some static generators that I wasn't looking for.

Edit: While we're at it, another blog I read is Robert Heaton's one[2], and I'm subscribed to a few others but they don't seem to post anymore since I stopped getting email notifications. I remember Coding Horror[3] was also nice to read but he posts very infrequently now (for those who don't know, that's by the co-founder of Stack Overflow). Finally, Cryptography Engineering[4] might be nice if you're into that sort of thing. But I suppose those can all be mostly considered successful in that they all have a following.

[1] https://lucgommans.nl/blog

[2] https://robertheaton.com

[3] https://blog.codinghorror.com

[4] https://blog.cryptographyengineering.com

Nobody has suggested it directly, yet, but I want to take this opportunity to remind people that the "Stylish" extension for injecting custom CSS onto your favorite websites has a history of abuse. It's owned by an advertising company that consumes all your browsing data. [1]

You should instead use "Stylus", which has none of those problems. In spite of all of that, Stylus has only 400,000 users according to the Chrome extension store, compared to 2M for Stylish. There's a lot of people out there accidentally using malware.

For example, here is a nice-looking dark mode for HN which can be installed into Stylus. [2] (I can't personally vouch for it, as I don't use it.)

[1]: https://robertheaton.com/2018/08/16/stylish-is-back-and-you-still-shouldnt-use-it/

[2]: https://userstyles.org/styles/157400/hacker-news-bluish-gray-2020

See also: Robert Heaton's series of project prompts "Programming Projects for Advanced Beginners."

https://robertheaton.com/2018/12/08/programming-projects-for-advanced-beginners/

The project goals are not as lofty as those proposed by nishanth_v's friend, but Mr. Heaton goes the extra mile to turn each project idea into a step by step mini-curriculum with lots of extension points.

Then, he goes another extra mile by allowing readers to email in their buggy projects, and running a companion series where he teaches people how to debug / fix / improve their code by refactoring reader's attempts at the "...Advanced Beginners" projects.

Recommended.

Oh, but it gets better. When the furor over the app usage collection hit, they disabled the data collection via remote server 'kill switch' (the driver hits an XML file.)

About a month later, after the furor died down - they flipped it right back on.

https://robertheaton.com/2020/02/05/wacom-drawing-tablets-track-name-of-every-application-you-open/

Super fucking scummy.