For AI it is different, it is just the beginning, leading companies are not even profitable and may never be if the majority hate this technology. VC funding will not last forever and corporate customers will not spend without limit like VC did.

I am not saying that "people are always right", but if an unexpected majority of people hates it, it does not help to keep a business running.

Origins of AI hate:

  * "my boss wants me to use AI but he does not understand my job nor how AI works"
  * "AI will kill all of us"
  * "AI will destroy my job (or my colleague's job if I use AI better than him)".
  * I cannot pay my electricity bills because of AI labs.
  * ...

I cannot remember a technology that arose so much hate, and for good reasons given how it is presented. I am tempted to think that AI hate or reasonable skepticism (vs unreasonable propaganda) can, maybe, reduce funding and will keep specialized AI for real problem solving (producing tons a LOC per day is not one of them, I think).

I am asked to help a fullstack dev team (Spring+Angular) to skill up in term of security.

I am skeptical about fullstack profiles, how many fullstack devs knows in depth display:flex and in the same time transaction isolation level ?

So as fullstack devs they are not supposed to become cyber-security experts in their company but since they don't have a cyber-security expert they must level up so they don't put their company at risk. Even if they hire one they must know all the basics that are related to development so they will be able to follow their cyber-security expert recommendations. They are not newbies, for instance they know about sql injection.

Here is my checklist (I'll help them to learn all of that), what to you think ? There will be half theory and half practice.

Introduction

  * Cryptography and security: two distinct domains.
  * Wording: hashing, encryption, key, certificate, signature, foward secrecy, CVC, zero thrust.
  * OWASP Top Ten 2025 and CWC Top 25 2025.
  * Security at the network level, security at the application level;
  * Tools to detect vulnerabilities: SAST, DAST et IAST ;
  * A few algorithms: SHA, AES, RSA, Elliptic curve encryption. Use cases and performances;
  * « Think like a hacker », case study: Spring4Shell (CVE-2022-22965).

  * embedded webserver configuration:
    ◦ TLS activation (key generation, certificate, server configuration, handshake steps)
    ◦ limits on HTTP requests (headers size, parameters, body size, parts)
    ◦ unfair use mitigation (rate limiting, timeouts, virtual threads usage);
    ◦ log management
  * Authentication :
    ◦ password protection: hashing, salt, cost, algorithms (Bcrypt, Scrypt, Argon, Pbkdf2)
    ◦ cookie authentication
    ◦ token authentication (generation, signature, validation, revocations);
    ◦ hybrid authentication (Cookie + JWT) with token relay;
  * Attacks (XSS, CRSF, log injection, sql injection, authorization bypass...) and how to mitigate them;
  * Definition of a CORS policy;
  * Introduction to mutual TLS for internal calls between API (est-west traffic).

    * Keywords of encryption: confidentiality, authenticity, integrity, non-repudiation;
    * Description of a public key infrastructure, with or without KMS, with or without HSM.
    * Chicken and egg problem, key exchange with Diffie Hellman ;
    * Exchange of encrypted data with CMS (Cryptographic Message Syntax) ;
    * database encryption: file encryption or row level encryption.

    * SBOM generation and upload on DependencyTrack;
    * scan as a step in the CI pipeline;
    * secrets management in production
        ◦ vault (Hashicorp vault) and/or Spring Cloud Config server ;
        ◦ decryption on application startup with Jasypt ;
        ◦ introduction to secret management with Kubernetes.

    * hash SRI and content security policy (CSP) for script inclusion;
    * strict template checking;
    * data sanitization;
    * CSRF mitigation (involves the API and the Angular client);
    * guards configuration;
    * protection, usage and renewal of JWT.
    * ensure integrity of the HTTP Client.

Do you think I forget something ? Thanks for your feedback !

Comments URL: https://news.ycombinator.com/item?id=49408476

Points: 2

# Comments: 0

For most people, GPS did not improve sense of direction, spellchecking did not help to write without making mistake, deepl did not help to be better in foreign languages. But replacing a bicycle by a motorcycle forces to acquire new skills without losing any, and we can find many example of symbiosis between "The man and the machine" (Lindbergh wrote a book named "WE"). AI could be something like that, after all it is human knowledge reachable in a conversational and contextual manner.

So AI can be used to learn: "tell me what's wrong in my code, or if it can be improved". I also tend to think that the more we code, the more we give AI valuable piece of knowledge to learn from, the best code it can produce, the less the produced code seems alien. It can be a win/win, all depend on the mindset. I like to code and even if I am skeptical about many aspects of AI I can share the workload with a robot, as an exercise or if the time or budget is constrained.

But you're right, the goal is not to write test but to ensure delivery of a reliable software. However each software is a prototype, something that has never been made before (unlike a manufactured car or chainsaw) so the customer must be ready to some unexpected behaviors when the software is released.

Since tests are often sloppy or does not cover every edge case, I see a real value for GenAI. It also forces to write good spec: very clear about inputs and the invariants for each use case. I think that AI (especially GenAI) should first be a solution to existing problem, lack of tests and good specs is often one of them.

"I did it like that because it's cleaner" is a non sense. A program must be maintenable, efficient, observable, testable, scalable, performant, readable, secured. Each criteria can be objectively measured in a kind of radar diagram and can be maximized as long as it does not sacrifice another criteria. Form follows function.

Even "simple" (from KISS) is too vague, fortunately in the conference "simple made easy" Rich Hickey defines what is simple: not interleaved. simple comes from sin plex, the opposite of con plex. Not always easy to make something simple.

However I don't see anything wrong with SOLID. Separation of concerns is how a modern society or a football team works, and S brings D because specialization involves good relationships ("no man is an island" wrote John Donne ), and D is strongly related to L. I has no drawbacks.

However I don't separate data from business logic anymore (no data access layer). Business logic applies on data, not on objects that hide data. Translating a ER diagram into anemic classes while the DBA do the same in the DB does not have any value and forces to use obstruction pattern like repository. If entity classes have properties and methods (a Plane class that has a 'takeOff' and 'land' methods for instance) it is different but must most backend I see don't implement entity classes that way. Because their classes represent data, not animated concept. Player class with a shoot method might makes sense for a video game, User class with a addComment method for a CRUD app makes less sense to me.

That's a key point. Keeping knowledge and know how inside the company is strategic. For most people GPS did not result in better sense of direction, spellchecking did not help to write without making mistakes, and delegating translation to deepl does help to be better in a foreign languages. I don't see the gain for an individual, a company, a society if a technology reduces the ability to think, do stuff, understand complex problem, working hard at something. Hiring junior also matters, what is boring for a senior dev is useful for a junior, like the "wax on wax off" in Karatekid. Then when the senior dev retired the junior is not junior anymore and the know how is still here. I want to to transfer my knowledge to a junior, not to anthropic or google or openai.

Ideally, working hand in hand with an AI could be like driving a motorcycle vs riding a bicycle. Both are fine, but you go much faster with a motorcycle and you don't lose any ability. But prompting a motorcycle auto-pilot by voice sound a bit stupid and boring. Insane use of energy rarely comes into the equation, which is a bit weird. Personally it is why I am never tempted to use AI. However I see value in AI for finding weakness in a code (inverse of flattery), writing tests with all the edge cases based on specs since tests are often sloppy, asking a fresh view on a very difficult problem. I'd love to hear about the equivalent of move#32 in game 2 (AlphaGo vs Lee Sedol) in a difficult programming task. But I think that massive delegation of code writing is how you lose the knowledge and the know how: what keeps us sharp.

Final word: I asked once a review to claude, the codes involved a db transaction. Nothing complicated, Claude said everything was fine. However the transaction isolation level was not set (I did it on purpose, like if I did not know about isolation levels). He did not ask me if it was my intention to keep the default level. I would have preferred a challenging feedback: why did you chose the default isolation level ? Is it on purpose ? Do you know that the default depend on the db ? Do you know about isolation ? Tell me about the business use case and I'll explain which one would be the best.

Java is more used than C#, they can wait before delivering a new feature (given their leader position) but cannot deliver a flawed implementation that would stay in the language forever. Glad to have virtual threads and the backward compatibility that comes with it instead a Async version of sync methods + async and await keywords all over the code and Task as a return type in my interfaces methods to allow implementations to do non blocking I/O calls if they need.

I use Java and C# and appreciate them both.

  - Junior asks to senior: what did you we use an ORM ?
  - senior answers: because it's cleaner.
  - junior: ???

  - maintenable;
  - performant, scalable;
  - efficient;
  - resilient;
  - observable;
  - testable (and tested);
  - secured;
  - readable for new devs that come on board.

"maintenable" can be also defined, since a project is mostly in maintenance mode during its lifetime (which means the project is successful, which is good !). The ability to incorporate new features without breaking architecture or even without breaking a single method signature is a good starting point.

Being super careful with abstractions. Here someone wrote something like that: "abstraction often hides how what you want is simple". True, ORM I am looking at you. In most case data should be threaten as first class citizen, it also fosters good collaboration with the DBA.

Thinking beyond "the happy path" without falling in premature optimization is also a challenge. A nice one, once again to it avoids to go head first in implementing a good idea without considering drawbacks.

I also tend to imagine that the one that will work on my code had a very bad day so it must be pleasant to read what I wrote. Comments here and there, locale variable here and there even if they can be avoided, variable naming, etc...

Being selective about frameworks. They are good servant but bad leaders. "Be an engineer, not a frameworker" says an article.

/books/1 could return 200 or 404 depending on the existence of the book#1, here it make sense because if /books/1 does not exist the API must tell it explicitly. However 404 belongs to the 4XX family which means "client error", is it an error to ask for a non existing book ? If you enter in a bookshop and ask for a book they don't have you did not "make a mistake". It's not like if you asked for a chainsaw. But in an API, especially with hypermedia, you are not supposed to request a resource that does not exist (unless the API provides a link to an existing resource that is was deleted before the caller try to reach it).

If you invent a formal language that is easy to read and easy to write, it may look like Python... Then someone will probably write an interpreter.

We have many languages, senior people who know how to use them, who enjoy coding and who don't have a "lack of productivity" problem. I don't feel the need to throw away everything we have to embrace what is supposed to be "the future". And since we need good devs to read and LLM generated code how to remain a good dev if we don't write code anymore ? What's the point of being up to date in language x if we don't write code ? Remaining good at something without doing it is a mystery to me.

Using a formal language also help to enter in a kind of flow. And then details you did not think about before using the formal language may appear. Everything cannot be prompted, just like Alex Honnold prepared his climbing of El Capitan very carefully but it's only when he was on the rock that he took the real decisions. Same for Lindbergh when he crossed the Atlantic. The map is not the territory.

Everyday I have access to my computer, and since nothing is absolutely urgent I can book train tickets from home, read hacker news from home, etc... I spend several hours per day at home with my laptop so when I am outside I don't need to be online.

I don't listen music when outside since I feel more connected to where I am (sea shore, forest, city, etc...) if I don't listen music.

I nearly don't need take pictures anymore and when I do I have a camera.

I never had an account on social medias and even if I did I would have disable all notifications.

No need for a GPS, usually I know where I am going and if I don't I check on a map before and remind the path (exit metro station, first on left, second on right, done), if I get lost I ask to someone, then happen a true connection to a human being. Road trips: paper maps, I traveled alone from San Diego to New-York like that, including reaching a specific address in Chicago and then in New-York with a paper map. And I like the voice of my wife telling me "in 2km we must take the D25 on the right" (names of secondary roads in France starts with D).

We have a sailboat so we need gps when we sail and we have a rugged tablet. We also use it at home as a remote control for the DAC with Qobuz and for video calls with family with Signal. A smartphone can makes sense in several occasion, like does out tablet, but I don't feel the need to have one (a kind of mini computer) in my pocket all the time.

And since urgent calls can only comes from my wife or from the school (we have a son), when we are together with our son we don't take our dumbphone (nokia 105) with us.

I think anyone can buy a dumbphone for 20$ or € and try for a week.

Each API has its database which contains the accesskey for each user, if this data is stolen the attacker can send HTTP POST requests to API with valid access key. To reject these forged request a code can be sent to the user in the invitation message while each database has a bcrypt hash of the code along the access key. When an API receives a POST requests it can check if the code present in the request body matches with the hash he has in its database. So having the access key is not enough to send request, someone who steal a db cannot do anything with the data and cannot propagate false data to other APIs.

Without the proxy the client would request a specific instance of the API (university 1, university 2, NGO 1, NGO 2), which then would be responsible for forwarding the data to the other. What if he changes the code and forward a false data:

user A votes for candidate X (HTTP POST request received by API deployed at university 1). API deployed at university A is compromised (by the university itself or not) and the information persisted in the DB is "user A votes for candidate Y". This information is then forwarded to other API.

If a proxy like NGINX is responsible for request forwarding the problem is solved (assuming that all parties trust nginx and its "mirror" module). https://nginx.org/en/docs/http/ngx_http_mirror_module.html

I am working on a voting system for a local community, people will vote with their smartphone, tablet or computer. They previously receive a link to the vote form with an access key in the url.

Once someone has voted he cannot see is vote (like in real world polling station), which partly avoid the "cash for vote" problem. "Partly" because someone can still force someone else to vote like he wants. For this, my idea was to allow to vote multiple times but with idem-potency: only the first or the last vote is recorded in the database. "you can give me 5$ to vote like you want, once back home I vote for the one I want".

But since voters cannot check if their vote has been properly recorded they must trust the system.

Block chain that involves several parties (an NGO, an university, etc...) could be an idea but nothing prevent the API that receives the votes and insert records in the blockchain to insert fake data. Code audit (+ CI/CD audit + DNS records audit) can help.

My idea: each party (NGO 1, NGO 2, university 1, university 2, etc...) deploy the API and its database. The source code is obviously open.

Then, a proxy receives the HTTP request and forward them to each API. The goal is to reach eventual consistency.

Outages may occur, if API deployed at university 1 is unreachable some data will be missing in its database. A retry policy at the proxy level can help but only for short time network failure, not for several minutes or hours outage.

So differences between databases at the end of the election will probably happen and should be corrected. If consensus is met on chunks of data (example: 2/3 of the databases have the same data for each 1 hour period) then we can get reach eventual consistency.

The proxy becomes the weak link. Each party should must have access to its configuration for audit purpose and must also have access to the DNS records.

At the ends the voters don't have to understand all these details, they trust the system because they trust the parties who participates.

What do you think ?

Thanks !

Comments URL: https://news.ycombinator.com/item?id=45157509

Points: 1

# Comments: 6

First write after a lot of reads...

I've been using ORM for years in Java and C# and came to the conclusion that the only reason we use these tools are because most Java and c# developers think that the business logic applies on objects and not data.

So when they/we see a entity-relationship diagram we think that must reify these entities as classes. This results, most of the time, in classes with accessors (and nothing else, so OOP purist are also a little bit skeptical when they see theses classes without any behaviors). And then we need a ORM to map this classes with the tables.

But everyone else on the project (dba, domain experts) think that the business logic we write uses data stored in the db, not objects. And if we start thinking like them, the only thing we need is something to manipulate the data and apply business logic on it.

For example if I need to get a piece of information on a bank account to accept or reject a withdrawal:

C# with Dapper:

  var accountInfo = (await dbConnection.QueryAsync<(double balance, int overdraft)>("select balance, overdraft from Account where id=@id", new {id = "..."})).SingleOrDefault();

  record AccountInfo(double balance, int overdraft){}
  Optional accountInfo = jdbClient.sql("select balance, overdraft from Account where id=?").params("...").query(AccountInfo.class).optional();

with an orm (Java with JPA):

  Account account = entityManager.find(Account.class, "..."); // Account is an entity class

of course you can do that with JPA:

  record AccountInfo(double balance, int overdraft){}
  Optional accountInfo = entityManager.createQuery("select balance, overdraft from Account where id=:id", Object[].class)
    .setParameter("id", "...")
    .getResultStream()
    .findAny()
    .map(a -> new AccountInfo(Double.parseDouble(a[0].toString()), Integer.parseInt(a[1].toString())));

Same for lazy loading, which selects all the columns of the lazy loaded entity while you often need one or two properties.

Becoming an expert with an ORM consists in knowing how to use its leaky abstraction so the sql query is the one you would have written without orm. Not very fulfilling (there are tons of more useful things to learn for a programmer) nor useful for the project.

More over, the choice of a database is (or could be) guided by business requirements. If a project benefits from a MongoDB database the developer should have access to the mongodb language, if it needs a graph database the developers should have access to the its query language, etc... It also fosters good relations with the DBA (I can ask for help to write a query) while ORM and their sub-optimal queries breaks the confidence between developers and DBA.

Of course the DB may change in the future (but most of the time it is here to stay) and vendor specific syntax will then break, but running tests against the new db will show which queries must be adjusted. Markers could also be written for vendor specific queries: /specific/ at the end of the string so they are easy to find.

An ORM is useful if you reify the domain model in classes with behaviors or if you sell a product that must be database agnostic. But for most project it is not a requirement.

What to you think ? Thanks !

Comments URL: https://news.ycombinator.com/item?id=40515475

Points: 2

# Comments: 0

It is about rules elaborated by an educated society. Not perfect rules, but at least rules that preserve what this society consider "important". Many example show that humans that live in a given place are very well aware of how important is a "healthy" ecosystem and give rights to "a good life" to this ecosystem: Wanganui river in New-Zeland, lac Erie in US (this attempt failed), constitution of Ecuador, etc... Elinor Ostrom wrote interesting about this rules (governing the commons), she had the nobel prize for that.