I disagree with the idea that the problem has to do with "non-security minded programmers". Certainly they exist, but the issue more often than not is that security is more expensive than non-security, so companies don't give their developers enough time to actually do security.
When it's all said and done with, software needs to be consistent and meet the expectations of its users.
If it does that, the question of a framework or high level documentation or user stories don't matter. Those are tools used to help achieve the above govals, but if you can do so without the use of the tools then the tools aren't all that useful for that particular project.
I sometimes think people miss the forest for the trees. I make the same argument about tests and TDD, the goal isn't tests, the goal is stable, maintainable software. If you can do that without tests, then you don't need tests, and that's ok.
I don't know, I used to feel that way but over the last few years I've changed my mind. The reason is because I got a hosting company as a client and I've seen some shit.
I've written the tools they use for automated VPS creation/deployment. The wrench in the works is that this company offers the ability to install/configure a lot of different pieces of software and software combinations, not just the usual to get enough going for the customer to log into the VPS. Slowly over the last few years I've started to realize my trust and hope in software that isn't written by me has plummeted as a direct result of this experience. I'm talking about software with a configuration web API where only half the confurable options will actually configure via the given web API and instead you find yourself tracking down and diving into the individual files and updating those instead (and figuring out how to restart their services such that they don't overwrite your changes and accept them). It's just not acceptable, and they charge money for that implementation. I've been told that one of the major features in their new version is that their own web app will start calling the web API so their implementations will actually work in this version. Am I the only one who finds that a ridiculous feature?
long story short, I think there's an assumption in your post that the people writing the software give a shit about correctness and ease of use, when in reality a lot of software only cares about getting money in their pocket. If that means shipping with a web API that's broken and announcing the proper functioning of said API as a feature for the next version, then so be it.
What ends up happening is that you, as a developer, have to deal with the bad decisions made by other people and at some point you start preferring to just write it yourself. To give you an example, PoSH SSH (Powershell SSH). Version 1.6 had no timeout functionality, so it was possible for an SSH session to never end. 1.7 added a timeout functionality, only the default timeout was set to 60 seconds, you can only change the timeout on a session basis, and it's not possible to get back the old 1.6 behavior of having no timeout (sending a timeout of 0 just immediately returns with a timeout error). The best you can do is set the timeout to Int.Max.
The thing is, most of the differences are a bit of a pain, but nothing more, except for the decision to change the default behavior in 1.7 to be different than 1.6. This guarantees that anyone who upgrades gets rocked by this change. And for no good reason. If someone wants a shorter timeout in 1.7, they can make that adjustment while they're writing new code. It's just a bad decision made out of convenience and probably some emotional feeling of "goodness" that results from the default behavior being "right" or "correct" with the new timeout behavior.
Another issue in 1.7 is that if the connection goes away, it will hang until the timout gets hit. I went diving into the code to see what was going on, and in their busy wait loop they never actually check if the session breaks unexpectedly, so if it does break it sits in that loop until the timeout is hit. I discovered this because my automated tools were SSHing into some linux VPS's and issueing a restart command. But because the timeout is on a session basis rather than command basis, it isn't as simple as just adjusting the timeout. I had to actually start maintaining my own version (I did report the issue to PoSSH SSH, but I don't think it's been fixed).
In general, the quality of the PoSH SSH library is such that I'm actually in the middle of changing from PoSSH SSH to the putty tools for my SSH/SCP needs. It's actually more consistent for me to escape and parse the cmd input/output than it is for me to use PoSH SSH, and that's damning.
I'm not asking for 9 9's of availability from these libraries, but my personal goal when I write code is for it to work consistently, and to be loud in its failures so we know that more work is needed to work consistently. But PoSH SSH's design is such that it's easier to meet those goals using external CLI tools than to use the Powershell library.
This turned into a bit of a rant, but this is something that's been on my mind more and more over the past few years as I find myself dealing with such a myriad of different pieces of software with this client.
Why are you thinking about free speech in terms of things that need to be penalized (or rewarded)?
I encourage everyone to avoid answering that question, it presupposes that the mindset that resulted in such a question is valid on some level and worthy of engagement.
Facebook was never really an important part of my life, it was more something I was kind of "forced" into because everyone else used it for communication, planning, etc.
However, I stone cold quit about 6-8 months ago because the election nonsense was ramping up and it got bad. I mean baaaaad. Both sides talking nonsense about the other.
I just didn't want to deal with the emotional toll of having to sift through that nonsense every damned day, and since FB wasn't really something that was important to me, it was extremely easy to just walk away. I'll log back in occasionally, and every time I do I remember immediately what caused me to quit.
For example, if someone is a die hard trump or hillary fan to the point that a reasonable conversation just isn't possible, I start trolling. It's just a declaration that you've completely lost any respect I have for you as a person.
I considered switching to Emacs once, but the slower startup time was a complete deal breaker for me.
Emacs isn't even really slow at starting up, it's just noticeably slower than vim and I have this thing about editors that are slow to startup... I use notepad as my primary text editor on windows because it starts up instantly.
I've never found a vim emulator in another editor that felt right. It's always a second class citizen and there's always something that breaks the illusion due to the way the vim keybindings interact with some other part of the editor.
I prefer to not use vim emulators in non-vim software specifically for that reason.
I have no issues with the way you worded that, I would have defended you had dang stepped in to complain about it (and in fact I've done exactly that in the past, which is when dang started harassing me). I was more pointing out the hypocrisy of dang.
I ended the conversation for exactly the reason I cited, a distinct lack of imagination. Anyone who immediately reaches for "you must be a novice programmer" isn't really someone I'm interested in conversing with.
Especially since anyone who stopped to think about it for more than two seconds would realize a "novice programmer" would find the yoda conditionals easier specifically because they're still learning to read code.
No one in their right mind would claim an adult reader would be better at having random bits of text in their novels read from right to left in the middle of their left to right text. Most reasonable people are going to agree that it's easier for a young person just learning to read to pick up on that.
Yet there you were, making exactly that claim for programming.
It indicated a reactionary comment with a complete lack of critical thinking on your part and I just have no interest in spending my time speaking with a person whose thought processes work in that manner.
And if that offends you, then so be it. I personally do think you were simply being passive aggressive and that's why you didn't stop to think about what you were actually saying.
Which is your right to do, and I would defend you for it. But it doesn't mean I'm willing to continue engaging you.
please stop following me around dang. One would think you would be warning the person who implied I was a novice programmer, but that would require consistency and fairness.
either ban me or leave me alone until I do something that's actually ban worthy please.
And to be clear, so there is no confusion here.
Your guidelines state the following:
> When disagreeing, please reply to the argument instead of calling names. E.g. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
According to your guidelines, his comment:
> If your train of thought is interrupted every time you encounter them, you are way too novice a programmer.
Should have been something such as:
> If your train of thought is interrupted every time you encounter them you probably don't see yoda conditionals very often.
Please, do me favor, go warn him as well.
consistency and fairness.
Or just ban me since we both know that's what you want to do.
And this is comign from a rabid i3 user.