×
Programming

Are Trendy Developers Ignoring Tradeoffs and Over-Engineering Workplaces? (github.io) 211

An anonymous reader shares an article titled "Does IT Run on Java 8?"

"After more than ten years in tech, in a range of different environments, from Fortune 500 companies, to startups, I've finally come to realize that most businesss and developers simply don't revolve around whatever's trending on Hacker News," argues one Python/R/Spark data scientist: Most developers -- and companies -- are part of what [programmer] Scott Hanselman dubbed a while ago as the 99%... "They don't read a lot of blogs, they never write blogs, they don't go to user groups, they don't tweet or facebook, and you don't often see them at large conferences. Lots of technologies don't iterate at this speed, nor should they.

"Embedded developers are still doing their thing in C and C++. Both are deeply mature and well understood languages that don't require a lot of churn or panic on the social networks. Where are the dark matter developers? Probably getting work done. Maybe using ASP.NET 1.1 at a local municipality or small office. Maybe working at a bottling plant in Mexico in VB6. Perhaps they are writing PHP calendar applications at a large chip manufacturer."

While some companies are using Spark and Druid and Airflow, some are still using Coldfusion... Or telnet... Or Microsoft TFS... There are reasons updates are not made. In some cases, it's a matter of national security (like at NASA). In others, people get used to what they know. In some cases, the old tech is better... In some cases, it's both a matter of security, AND IT is not a priority. This is the reason many government agencies return data in PDF formats, or in XML... For all of this variety of reasons and more, the majority of companies that are at the pinnacle of succes in America are quietly running Windows Server 2012 behind the scenes.

And, not only are they running Java on Windows 2012, they're also not doing machine learning, or AI, or any of the sexy buzzwords you hear about. Most business rules are still just that: hardcoded case statements decided by the business, passed down to analysts, and done in Excel sheets, half because of bureacracy and intraction, and sometimes, because you just don't need machine learning. Finally, the third piece of this is the "dark matter" effect. Most developers are simply not talking about the mundane work they're doing. Who wants to share their C# code moving fractions of a cent transactions between banking systems when everyone is doing Tensorflow.js?

In a footnote to his essay, Hanselman had added that his examples weren't hypothetical. "These people and companies all exist, I've met them and spoken to them at length." (And the article includes several tweets from real-world developers, including one which claims Tesla's infotainment firmware and backend services were all run in a single-location datacenter "on the worst VMware deployment known to man.")

But the data scientist ultimately asks if our online filter bubbles are exposing us to "tech-forward biases" that are "overenthusiastic about the promises of new technology without talking about tradeoffs," leading us into over-engineered platforms "that our companies don't need, and that most other developers that pick up our work can't relate to, or can even work with...

"For better or worse, the world runs on Excel, Java 8, and Sharepoint, and I think it's important for us as technology professionals to remember and be empathetic of that."
Open Source

Microsoft Open-Sources a Crucial Algorithm Behind Its Bing Search Services (techcrunch.com) 55

An anonymous reader quotes a report from TechCrunch: Microsoft today announced that it has open-sourced a key piece of what makes its Bing search services able to quickly return search results to its users. By making this technology open, the company hopes that developers will be able to build similar experiences for their users in other domains where users search through vast data troves, including in retail, though in this age of abundant data, chances are developers will find plenty of other enterprise and consumer use cases, too. The piece of software the company open-sourced today is a library Microsoft developed to make better use of all the data it collected and AI models it built for Bing .

With the Space Partition Tree and Graph (SPTAG) algorithm that is at the core of the open-sourced Python library, Microsoft is able to search through billions of pieces of information in milliseconds. Vector search itself isn't a new idea, of course. What Microsoft has done, though, is apply this concept to working with deep learning models. First, the team takes a pre-trained model and encodes that data into vectors, where every vector represents a word or pixel. Using the new SPTAG library, it then generates a vector index. As queries come in, the deep learning model translates that text or image into a vector and the library finds the most related vectors in that index. The library is now available under the MIT license and provides all of the tools to build and search these distributed vector indexes. You can find more details about how to get started with using this library -- as well as application samples -- here.

GNU is Not Unix

GDB 8.3 Released (gnu.org) 38

"Release 8.3 of GDB, the GNU Debugger, is now available," according to an announcement on the info-gnu mailing list:

GDB is a source-level debugger for Ada, C, C++, Go, Rust, and many other languages. GDB can target (i.e., debug programs running on) more than a dozen different processor architectures, and GDB itself can run on most popular GNU/Linux, Unix and Microsoft Windows variants. GDB is free (libre) software. GDB 8.3 includes support for new native configurations (also available as a target configuration) for RISC-V GNU/Linux and RISC-V FreeBSD.

The announcement warns that Native Windows debugging "is only supported on Windows XP or later," and that "the Python API in GDB now requires Python 2.6 or later."
Microsoft

Microsoft is Bringing Visual Studio To the Browser, Unveils .NET 5 (venturebeat.com) 30

Krystalo writes: At its developer conference Build today, Microsoft previewed new Visual Studio features for remote work, the .NET roadmap, and launched ML.NET 1.0. In April, Microsoft launched Visual Studio 2019 for Windows and Mac. Two notable features were Visual Studio Live Share, a real-time collaboration tool included with Visual Studio 2019, and Visual Studio IntelliCode, an extension offering AI-assisted code completion. At Build 2019, Microsoft shared that IntelliCode's capabilities are now generally available for C# and XAML in Visual Studio 2019 and for Java, JavaScript, TypeScript, and Python in Visual Studio Code. And IntelliCode is now included by default in Visual Studio 2019, starting in version 16.1 Preview 2. The company also previewed an algorithm that can locally track your edits -- repeated edit detection -- and suggest other places where you need that same change. But that's just the tip of the iceberg. Microsoft is experimenting with features that let developers work from anywhere, on any device. The company today announced a private preview for three such new capabilities: Remote-powered developer tools, cloud-hosted developer environments, and a browser-based web companion tool. If the future of work is remote, Microsoft wants to be ready.

[...] Microsoft also announced that it is skipping .NET 4 to avoid confusion with the .NET Framework, which has been on version 4 for years. Going forward, developers will be able to use .NET to target Windows, Linux, macOS, iOS, Android, tvOS, watchOS, WebAssembly, and more. .NET Core 3 will be succeeded by .NET 5, featuring new .NET APIs, runtime capabilities, and language features. Calling it .NET 5 makes it the highest version Microsoft has ever shipped and indicates that the company hopes it is the future for the .NET platform. .NET Core 3 closes much of the remaining capability gap with .NET Framework 4.8, enabling Windows Forms, WPF, and Entity Framework 6. .NET 5 will build on this work, Microsoft says, combining .NET Core, .NET Framework, Xamarin, and Mono (the original cross-platform implementation of .NET) into a single platform. .NET 5 will provide both Just-in-Time (JIT) and Ahead-of-Time (AOT) compilation models. JIT has better performance for desktop/server workloads and development environments. AOT has a faster startup and a small footprint, which is required for mobile and IoT devices. .NET 5 will offer one unified toolchain supported by new SDK project types and a flexible deployment model (side-by-side and self-contained EXEs).

Programming

'Why I Prefer Go Over Python or Java' (yourbasic.org) 230

Stefan Nilsson, a computer science professor at the KTH Royal Institute of Technology, recently explained "why I prefer Go to Java or Python," arguing that Go "makes it much easier for me to write good code." Go is a minimalist language, and that's (mostly) a blessing. The formal Go language specification is only 50 pages, has plenty of examples, and is fairly easy to read. A skilled programmer could probably learn Go from the specification alone. The core language consists of a few simple, orthogonal features that can be combined in a relatively small number of ways. This makes it easier to learn the language, and to read and write programs. When you add new features to a language, the complexity doesn't just add up, it often multiplies: language features can interact in many ways. This is a significant problem -- language complexity affects all developers (not just the ones writing the spec and implementing the compiler).

Here are some core Go features:

- The built-in frameworks for testing and profiling are small and easy to learn, but still fully functional. There are plenty of third-party add-ons, but chances are you won't need them.

- It's possible to debug and profile an optimized binary running in production through an HTTP server.

- Go has automatically generated documentation with testable examples. Once again, the interface is minimal, and there is very little to learn.

- Go is strongly and statically typed with no implicit conversions, but the syntactic overhead is still surprisingly small. This is achieved by simple type inference in assignments together with untyped numeric constants. This gives Go stronger type safety than Java (which has implicit conversions), but the code reads more like Python (which has untyped variables).

- Programs are constructed from packages that offer clear code separation and allow efficient management of dependencies. The package mechanism is perhaps the single most well-designed feature of the language, and certainly one of the most overlooked.

- Structurally typed interfaces provide runtime polymorphism through dynamic dispatch.

- Concurrency is an integral part of Go, supported by goroutines, channels and the select statement.

The professor points out that the Java® Language Specification is 750 pages, and blames much of its complexity on feature creep (for example, inner classes, generics, and enum). And he also applauds the strict compatibility guarantees of Go 1 for the core language and standard packages, as well as its open source, BSD-style license, and Go's code transparency.

"There is one standard code format, automatically generated by the fmt tool," he writes, arguing that "Your project is doomed if you can't read and understand your code."
Python

Python Creator Guido van Rossum Blames His Resignation Partly On Social Media (www.tfir.io) 137

"Swapnil Bhartiya, the founder of TFIR, sat down with Guido van Rossum, the creator of Python, to talk about the origin of the language and why he stepped down from the leadership of the very project he created," writes sfcrazy.

In the interview, van Rossum emphasizes that he still remains one of the core developers, and provides this update: "We're going to set up a new form of governance. We haven't decided yet what that will be. There is actually an interesting time ahead where we currently have about five of six different proposals for new governance systems, and in November there's going to be a vote among the core developers about that. And then there will be another vote that will actually determine specifically who is going to form the leadership. So we're starting out by choosing a constitution, and then using the rules set out in the selected constitution, we're going to vote for a leadership..."
He talks more about his resignation when asked if there's ever been an after-the-fact debate about decisions he's made: "Well, that certainly happens too. What led to my resignation was a form of that, where on social media -- and I've got a feeling that social media are sort of getting out of hand... But for me personally, social media definitely sort of caused additional stress. And I did not enjoy it when core developers were sort of sending tweets where they were questioning my authority or the wisdom of my decisions, rather than saying it to my face and having an honest debate about things...

"It might just have to do with the fact that I've had this role for 28 years... And all that time, I've been sort of the final decider, the final arbiter. I'm getting older, I'm not always available... I just want to spend less time feeling stressed about what is the community -- I have this attitude where everything that was being said on some of the mailing lists, python-ideas, python-dev, touched me. I felt involved in everything, because ultimately every idea would end on my desk for deciding. And I just thought that that should be a responsibiity that should either be shared or transferred... Given that I've been on the project for such a long time, and some of the currently active core developers are good personal friends that I've known for 20 years or more, I am completely confident that the more experienced core developers that we currently have, plus the newer core developers that we have, together will be able to weather any kind of storm that might come Python's way. Yes I resigned from the title suddenly, but there were a lot of responsibilities that I had already completely delegated. I mean, I barely touch the code base, I barely reviewed submissions.

At one point van Rossum compares the future of Python to that of a grown-up child, in that "You're supposed to raise your child for independence..."

So what's he doing now? " I was and still am a principal engineer at Dropbox, which is actually where I spend most of my time."
Python

Netflix Says Python Programming Language is Behind Every Film You Stream (zdnet.com) 202

The next time you're streaming on Netflix, you can thank popular programming language Python and the developers who use it for much of the experience. From a report: According to Python developers at Netflix, the language is used through the "full content lifecycle", from security tools, to its recommendation algorithms, and its proprietary content distribution network (CDN) Open Connect, which ensures that content is streamed from network devices that are as close as possible to end users. Ahead of the Python Software Foundation's PyCon conference next week in Cleveland, the streaming giant has been detailing how it uses the open-source language.
Programming

Why Modern C++ Still Isn't As Safe As Memory-Safe Languages Like Rust and Swift (alexgaynor.net) 463

Alex Gaynor is a software engineer at Mozilla working on Firefox, after previously serving as a director of both the Python Software Foundation and the Django Software Foundation.

In a new blog post today, he argues that memory unsafe languages, "principally C and C++," induce an exceptional number of security vulnerabilities, and that the industry needs to migrate to memory-safe languages like Rust and Swift by default. One of the responses I frequently receive is that the problem isn't C and C++ themselves, developers are simply holding them wrong. In particular, I often receive defenses of C++ of the form, "C++ is safe if you don't use any of the functionality inherited from C" or similarly that if you use modern C++ types and idioms you will be immune from the memory corruption vulnerabilities that plague other projects. I would like to credit C++'s smart pointer types, because they do significantly help. Unfortunately, my experience working on large C++ projects which use modern idioms is that these are not nearly sufficient to stop the flood of vulnerabilities...

Modern C++ idioms introduce many changes which have the potential to improve security: smart pointers better express expected lifetimes, std::span ensures you always have a correct length handy, std::variant provides a safer abstraction for unions. However modern C++ also introduces some incredible new sources of vulnerabilities: lambda capture use-after-free, uninitialized-value optionals, and un-bounds-checked span.

My professional experience writing relatively modern C++, and auditing Rust code (including Rust code that makes significant use of unsafe) is that the safety of modern C++ is simply no match for memory safe by default languages like Rust and Swift (or Python and JavaScript, though I find it rare in life to have a program that makes sense to write in either Python or C++). There are significant challenges to migrating existing, large, C and C++ codebases to a different language -- no one can deny this. Nonetheless, the question simply must be how we can accomplish it, rather than if we should try.

The post highlights what he describes as "completely modern C++ idioms which produce vulnerabilities" -- including an example of dangling pointers "despite our meticulous use of smart pointers throughout..."

"Even with the most modern C++ idioms available, the evidence is clear that, at scale, it's simply not possible to hold C++ right."
Python

Historic 'Summit' with the Creators of Python, Java, TypeScript, and Perl (packtpub.com) 84

"At the first annual charity event conducted by Puget Sound Programming Python on April 2, four legendary language creators came together to discuss the past and future of language design," reports PacktPub.

- Guido van Rossum, the creator of Python
- James Gosling, the founder, and lead designer behind the Java programming language
- Anders Hejlsberg, the original author of Turbo Pascal who has also worked on the development of C# and TypeScript
- Larry Wall, the creator of Perl

You can watch the video here -- the speaker introductions start about 50 minutes into the video-- or read PacktPub's summary of the event: Guido van Rossum said designing a programming language is very similar to the way JK Rowling writes her books, the Harry Potter series... He says JK Rowling is a genius in the way that some details that she mentioned in her first Harry Potter book ended up playing an important plot point in part six and seven... When designing a language we start with committing to certain details like the keywords we want to use, the style of coding we want to follow, etc. But, whatever we decide on we are stuck with them and in the future, we need to find new ways to use those details, just like Rowling...

When James Gosling was asked how Java came into existence and what were the design principles he abided by, he simply said, "it didn't come out of like a personal passion project or something. It was actually from trying to build a prototype.... It started out as kind of doing better C and then it got out of control that the rest of the project really ended up just providing the context." In the end, the only thing out of that project survived was Java...

Larry Wall wanted to create a language that was more like a natural language. Explaining through an example, he said, "Instead of putting people in a university campus and deciding where they go we're just gonna see where people want to walk and then put shortcuts in all those places." A basic principle behind creating Perl was to provide APIs to everything. It was aimed to be both a good text processing language linguistically but also a glue language....

Similar to the views of Guido van Rossum, Anders Hejlsberg adds that any decision that you make when designing a language you have to live with it. When designing a language you need to be very careful about reasoning over what "not" to introduce in the language.

There was also some discussion of types -- Gosling believes they help improve performance, while Hejlsberg said types are also useful when building coding tools. "It turns out that you can actually be more productive by adding types if you do it in a non-intrusive manner and if you work hard on doing good type inference and so forth." In fact, Hejlsberg told the audience that the TypeScript project was inspired by massive "write-only" JavaScript code bases, while a semantic understanding (including a type system) makes refactoring easier.

Guido van Rossum acknowledged that TypeScript "is actually incredibly useful and so we're adding a very similar idea to Python. We are adding it in a slightly different way because we have a different context.... I've learned a painful lesson, that for small programs dynamic typing is great. For large programs, you have to have a more disciplined approach. And it helps if the language actually gives you that discipline, rather than telling you, 'Well, you can do whatever you want.'"

In the video Larry Wall says the Perl 6 team had also noticed the limitations of loose typing, and added a robust type system to Perl 6 to "help with programming in the large."

This was the first annual benefit for CSforALL, a group promoting high-quality computer science classes at every grade level.
Python

Mozilla To Bring Python To Browsers (venturebeat.com) 111

An anonymous reader quotes a report from VentureBeat: In a step toward its goal of building out a data science development stack for web browsers, Mozilla today detailed Pyodide, an experimental Python project that's designed to perform computation without the need for a remote kernel (i.e., a program that runs and inspects code). As staff data engineer Mike Droettboom explained in a blog post, it's a standard Python interpreter that runs entirely in the browser. And while Pyodide isn't exactly novel -- projects like Transcrypt, Brython, Skulpt, and PyPyJs are among several efforts to bring Python to browsers -- it doesn't require a rewrite of popular scientific computing tools (like NumPy, Pandas, Scipy, and Matplotlib) to achieve adequate performance, and its ability to convert built-in data types enables interactions among browser APIs and other JavaScript libraries.

Pyodide is built on WebAssembly, a low-level programming language that runs with near-native performance, and emscripten (specifically a build of Python for emscripten dubbed "cpython-emscripten"), which comprises a compiler from C and C++ to WebAssembly and a compatibility layer. Emscripten additionally provides a virtual file system (written in JavaScript) that the Python interpreter can use, in which files disappear when the browser tab is closed. To use Pyodide, you'll need the compiled Python interpreter as WebAssembly, JavaScript from emscripten (which provides the system emulation), and a packaged file system containing the files required by the Python interpreter. Once all three components are downloaded, they'll be stored in your browser's cache, obviating the need to download them again.
The report notes that "the Python interpreter inside the JavaScript virtual machine runs between one to 12 times slower in Firefox and up to 16 times slower on Chrome."
Programming

The Most Loved and Most Disliked Programming Languages Revealed in Stack Overflow Survey (stackoverflow.com) 268

angel'o'sphere shares a report: The annual Stack Overflow survey is one of the most comprehensive snapshots of how programmers work, with this year's poll being taken by almost 90,000 developers across the globe. This year's survey details which languages developers enjoy using, which are associated with the best paid jobs, which are most commonly used, as well as developers' preferred frameworks, databases, and integrated development environments.

Python's versatility continues to fuel its rise through Stack Overflow's rankings for the "most popular" languages, which lists the languages most widely used by developers. This year's survey finds Python to be the fastest-growing major programming language, with Python edging out Android and enterprise workhorse Java to become the fourth most commonly used language. [...] More importantly for developers, this popularity overlaps with demand for the language, with Julia Silge, data scientist at Stack Overflow, saying that jobs data gathered by Stack Overflow also shows Python to be one of the most in-demand languages sought by employers.

[...] Rust may not have as many users as Python or JavaScript but it has earned a lot of affection from those who use it. For the fourth year running, the language tops Stack Overflow's list of "most-loved" languages, which means the proportion of Rust developers who want to continue working with it is larger than that of any other language.[...] Go stands out as a language that is well paid, while also being sought after and where developers report high levels of job satisfaction.
Full report here.
Space

LIGO Spots Another Gravitational Wave Soon After Powering Back On (newscientist.com) 46

New submitter nichogenius writes: The latest observation run of LIGO and VIRGO only started April 1st, but has already observed another black hole merger. The LIGO detectors have been offline since the 25th of August, 2017 for a series of upgrades. The latest observational run is the first run where gravitational wave events are being publicly announced as they happen rather than being announced weeks or months later. Few details of the merger are available at this time, but there is some information available on LIGO's twitter and raw details can be obtained from LIGO's event database page.

Gravitational detection events are being publicly broadcast using NASA's VOEvent system. If you know a bit of python, you can setup your own VOEvent client using the pygcn module with example code available in this tutorial.

Programming

Most Popular Programming Languages: C++ Knocks Python Out of Top Three in New Study (techrepublic.com) 161

C++ has knocked machine-learning favorite Python out of the top 3 in the TIOBE Index of popular programming languages. From a report: It marks a reversal of fortune for C++, which, after years of occupying third place in the index, was pushed down to fourth place by Python in September last year. First and second place in the list remain unchanged, with Java in pole position and C at number two. The TIOBE Index attempts to estimate the popularity of languages worldwide based on results from major search engines. The index is sometimes criticized for being a rather blunt measure, likely to be influenced by a range of factors beyond a language's popularity, but its rankings are broadly in line with others, with a similar mix of languages albeit arranged in a different order.

In an analysis alongside the latest figures, TIOBE attributes the comeback of C++ to a surge in its popularity, rather than a fall in the use of Python. "This is certainly not because Python is in decline: Python is scoring all time highs almost every month. It is just that C++ is also getting more and more popular," it writes. The report credits this growing interest in C++ to C++11, the version of the language released in 2011 that TIOBE said made C++ "much simpler, safer and more expressive."

Education

Lego Education's Newest Spike Prime Programmable Robots Aim For the Classroom (cnet.com) 18

Lego Education, the education-focused arm of the veteran Denmark company, is making its biggest product debut in three years, unveiling Spike Prime, a new kit that aims to mix the company's familiar bricks with motors, sensors and introductory coding lessons. The company is targeting kids aged between 11 to 14. From a report: Lego Mindstorms have been around for years. The Mindstorms EV3 robotics kit remains a staple of many learning centers and robotics classrooms. Lego's newest kit looks more like Lego Boost, a programmable kit that aimed to win over families in 2017 and was compatible with regular Lego bricks. It's compatible with Lego Boost, Lego Technic sets and classic Lego pieces, but not with Lego's previous Mindstorms accessories. Lego Mindstorms EV3 is remaining alongside Lego Spike Prime in Lego Education's lineup, and looks like it's aiming more at the high school crowd, while Lego Spike Prime could bridge to that higher-end projects.

The Spike Prime set is created specifically for grades six to eight. It uses an app that uses visual Scratch programming and aims to adopt the Python programming language by the end of the year, according to Lego Education executives. The robots made by Spike Prime look cute, and Lego Boost-like, but not necessarily as complicated as some Mindstorm kits. The central processing hub that drives the Lego Spike Prime robotics creations has six input and output ports, and connects with sensors including an RGB color and light sensor, a force-sensitive touch sensor, and an ultrasonic distance sensor for measurement and navigation.

AI

Three Pioneers in Artificial Intelligence Win Turing Award (nytimes.com) 28

An anonymous reader shares a report: In 2004, Geoffrey Hinton doubled down on his pursuit of a technological idea called a neural network. It was a way for machines to see the world around them, recognize sounds and even understand natural language. But scientists had spent more than 50 years working on the concept of neural networks, and machines couldn't really do any of that. Backed by the Canadian government, Dr. Hinton, a computer science professor at the University of Toronto, organized a new research community with several academics who also tackled the concept. They included Yann LeCun, a professor at New York University, and Yoshua Bengio at the University of Montreal.

On Wednesday, the Association for Computing Machinery, the world's largest society of computing professionals, announced that Drs. Hinton, LeCun and Bengio had won this year's Turing Award for their work on neural networks. The Turing Award, which was introduced in 1966, is often called the Nobel Prize of computing, and it includes a $1 million prize, which the three scientists will share.
More: The Godfathers of the AI Boom Win Computing's Highest Honor; Hinton Says We Need To Start Over; Bengio is Worried About Its Future; and Deep Learning May Need a New Programming Language That's More Flexible Than Python, LeCun Says.
Programming

Which Programming Language Has The Most Security Vulnerabilities? (techrepublic.com) 330

A new report from the open source security company WhiteSource asks the question, "Is one programming language more secure than the rest?"

An anonymous reader quotes TechRepublic: To answer this question, the report compiled information from WhiteSource's database, which aggregates information on open source vulnerabilities from sources including the National Vulnerability Database, security advisories, GitHub issue trackers, and popular open source projects issue trackers. Researchers focused in on open source security vulnerabilities in the seven most widely-used languages of the past 10 years to learn which are most secure, and which vulnerability types are most common in each...

The most common vulnerabilities across most of these languages are Cross-SiteScripting (XSS); Input Validation; Permissions, Privileges, and Access Control; and Information Leak / Disclosure, according to the report.

Across the seven most widely-used programming languages, here's how the vulnerabilities were distributed:
  • C (47%)
  • PHP (17%)
  • Java (11%)
  • JavaScript (10%)
  • Python (5%)
  • C++ (5%)
  • Ruby (4%)

But the results are full of disclaimers -- for example, that C tops the list because it's the oldest language with "the highest volume of written code" and "is also one of the languages behind major infrastructure like Open SSL and the Linux kernel."

The report also notes a "substantial rise" across all languages for known open source security vulnerabilities over the last two years, attributing this to more awareness about vulnerable components -- thanks to more research, automated security tools, and "the growing investment in bug bounty programs" -- as well as the increasing popularity of open source software. And it also reports a drop in the percentage of critical vulnerabilities for most languages -- except JavaScript and PHP.

The report then concludes that "the Winner Of Most Secure Programming Language is...no one and everyone...! It is not about the language itself that makes it any more or less secure, but how you use it. If you are mitigating your vulnerabilities throughout the software development lifecycle with the proper management approach, then you are far more likely to stay secure."

Coincidentally, WhiteSource sells software which monitors open source components throughout the software development lifecycle to provide alerts about security (and licensing) issues.


Data Storage

It's Scary How Much Personal Data People Leave on Used Laptops and Phones, Researcher Finds (gizmodo.com) 116

A recent experiment by Josh Frantz, a senior security consultant at Rapid7, suggests that users are taking few if any steps to protect their private information before releasing their used devices back out into the wild. From a report: For around six months, he collected used desktop, hard disks, cellphones and more from pawn shops near his home in Wisconsin. It turned out they contain a wealth of private data belonging to their former owners, including a ton of personally identifiable information (PII) -- the bread and butter of identity theft. Frantz amassed a respectable stockpile of refurbished, donated, and used hardware: 41 desktops and laptops, 27 pieces of removable media (memory cards and flash drives), 11 hard disks, and six cellphones. The total cost of the experiment was a lot less than you'd imagine. "I visited a total of 31 businesses and bought whatever I could get my hands on for a grand total of around $600," he said.

Frantz used a Python-based optical character recognition (OCR) tool to scan for Social Security numbers, dates of birth, credit card information, and other sensitive data. And the result was, as you might expect, not good. The pile of junk turned out to contain 41 Social Security numbers, 50 dates of birth, 611 email accounts, 19 credit card numbers, two passport numbers, and six driver's license numbers. Additionally, more than 200,000 images were contained on the devices and over 3,400 documents. He also extracted nearly 150,000 emails.

AI

Deep Learning May Need a New Programming Language That's More Flexible Than Python, Facebook's Chief AI Scientist Says (venturebeat.com) 263

Deep learning may need a new programming language that's more flexible and easier to work with than Python, Facebook AI Research director Yann LeCun said today. From an interview: It's not yet clear if such a language is necessary, but the possibility runs against very entrenched desires from researchers and engineers, he said. LeCun has worked with neural networks since the 1980s. "There are several projects at Google, Facebook, and other places to kind of design such a compiled language that can be efficient for deep learning, but it's not clear at all that the community will follow, because people just want to use Python," LeCun said in a phone call with VentureBeat. "The question now is, is that a valid approach?" Further reading: Facebook joins Amazon and Google in AI chip race.
Python

Python Developer Survey Shows Data Analysis More Popular Than Web Development (jetbrains.com) 42

Over 20,000 programmers from more than 150 different countries provided answers for the second annual Python Developers Survey (conducted by the Python Software Foundation and JeBrains).

An anonymous reader submitted this condensed version of their results: 84% of Python users in our survey use Python as their main language...up 5 percentage points from 79% in 2017. But half of all Python users in the survey also use JavaScript, and 47% more say they use HTML/CSS. Reported use of Bash/Shell has also grown from 36% in 2017 to 45% in 2018. [Later 93% of respondents said that their activities included Software testing/Writing automated tests.] Python users who report that they also use Go and SQL have both increased by 2 percentage points, while many other languages (including C/C++, Java, and C#) have decreased their share...

When asked "What do you use Python for?" data analysis has become more popular than Web development, growing from 50% in 2017 to 58% in 2018. Machine learning also grew by 7 percentage points. These types of development are experiencing faster growth than Web development, which has only increased by 2 percentage points when compared to the previous year...

Almost two-thirds of respondents selected Linux as their development environment OS. Most people are using free or open source databases such as PostgreSQL, MySQL, or SQLite... Twenty-something was the prevalent age range among our respondents, with almost a third being in their thirties. [31% more were between the ages of 30 and 39.]

AI

AI-Driven Python Code-Completion Tool 'Kite' Attracts $17M In Investments (venturebeat.com) 87

An AI-enhanced tool that suggests code snippets for Python developers in real time just raised $17 million in VC funding to expand its R&D team "with a focus on accelerating developer productivity."

An anonymous reader quotes VentureBeat: "Our mission is to bring the latest advancements in AI and machine learning (ML) to make writing code fluid, effortless, and more enjoyable," explained [founder Adam] Smith. "Developers using Kite can focus their productive energy toward solving the next big technical challenges, instead of searching the web for code examples illustrating mundane and frequently repeated code patterns...."

Instead of relying on the cloud to run its AI engine, Kite now runs locally on a user's computer, letting developers use it offline and without having to upload any code. (Kite still trains its machine learning models with thousands of publicly available code sources from highly rated developers.) Furthermore, running locally allows Kite to fully operate with lower latencies... In addition to ditching the cloud, the new version of Kite brings a feature the team calls Line-of-Code Completions. Until now, Kite's machine learning models could only suggest the next "token" in a line of code. Line-of-Code Completions can complete entire function calls with a single keystroke... The team boasts that Kite is "the only developer product on the market to offer such advanced completions."

"Today, Kite is used by more than 30,000 Python developers worldwide," reports VentureBeat, adding it locally-based ML plugin is available for top Python IDEs including Visual Studio Code, Atom, Sublime Text, PyCharm, IntelliJ, and Vim.

Kite's investors include the CEO of GitHub, as well as the founders of Dropbox, Paypal, and Twitch.tv, and the company hopes to eventually support more languages, starting with either Java, JavaScript, or Go.

Slashdot Top Deals