The golden October in software

I have been somewhat busy over the past few weeks. It's not that nothing has happened in the world (and especially the software world), it's just that business. Anyway, without further delay some news that touched my interest in the recent past:

• The whole Volkswagen emission cheating story is certainly a globally interesting topic, not only for software people. Most of the public rage regarding the incident seems to be quite undirected noise a la "Oh, these evil manufacturers. How could they?!" but won't people stop from buying the new car anyway. So my personal prediction here is that VW won't see any dramatic drop in worldwide sales figures.
  An interesting point, however, is made by Bruce Schneier: Executives will learn their lesson from this, and the lesson is that you can get away with cheating for a long time. In a world where executives' incentives are often fixed to quarterly results, this obviously favours short-term profits by cheating over long-term strategy and brand integrity. We will certainly see more of that in the future. Also I completely support Bruce's statement on transparency and verification: Manufacturers must provide the source code (and a way to build / install it) to the public for independent review and verification.
• Chromium's tarball size has increased noticeably. Again. We are now at 327 MiB for chromium-46.0.2490.80. The earlier cry for feature freeze and cleanup remains (*surprise*) unheard.
• None of my (private) Android devices (Nexus 4, Nexus 7 2012) will receive an official update to Marshmallow from Google. This is very sad news, given that even the (original!) batteries in these devices are still doing surprisingly well.
• Flash. For the longest time, I lack the words to describe how much I loathe this prime example for how-not-to-write-software. I do use an older computer as a media center, but due to usage patterns (Chromecast, mpd, and so on), sometimes I happen not to start a browser on this thing for a week or so. The result: Every single time, and I am speaking literally here, not figuratively, I start that browser and point it to a page where flash is used, it prompts me to an upgrade. The whole flash situation has been ridiculous for years now. Please, for crying out loud: Let flash die.

Software complification [update]

You may remember my rant from a couple of weeks ago, regarding the ever-increasing complexity of modern browsers. There are two bullet points with respect to that topic:

• There are no big news, except
• Despite xz-compression, the chromium source tarball has finally broken warp three: It's now 306 MiB in size. An updated version of the illustration of the different browser size tarballs is given below.

The Windowsification of Unix

For quite a while, Microsoft Windows has exhibited a property that seems to be common in living organisms while being quite uncommon in the world of operating systems: Its ability to age and the subsequent inevitable need to die and get reborn.
To put this in more technical rather than biological terms: After a couple of months up to a low one digit number of years (in a base 3 number system) the continuous degradation of perceived performance in a Windows system, plus the ever-increasing clutter of what-the-hell-is-this-files on the C: partition becomes such a PITA that the easiest solution is to lock oneself in at home on a lonely Friday night with a sixpack of beer and reinstall Windows and all apps.
This of course was completely unknown to Unix-like folks who never really needed to reinstall their machines, mostly due to the Unix philosophy to do as much as possible with simple tools and use simple text files for configuration of the whole OS. For instance, the last time I installed my home server from scratch was more than 6 years ago and the reason was relocating overseas, not a software issue.
And then came Android. "Did you try factory reset?" is a standard question to all kinds of problems with Google's great approach at transferring the much-loathed concept of ageing software from Windows on top of a Linux-based software stack. In the past weeks, my 18-months old Android mobile phone became gradually suspiciously slow and apps started to crash more often. Yesterday it decided to give up even trying to start them: The error message "Unfortunately, the process com.google.process.gapps has stopped." appeared in very quick repetition such that it became hard to operate the device at all in order to attempt all the salvage recipes that the internet offers. Before you ask: No, I did not attempt the ones that involved sacrificing a virgin when the moon is waning gibbous; only the ones that seemed to be sensible from a technical point of view: Clearing caches, resetting apps to initial state and reapplying updates, this kind of thing, and - of course - reboot the device a bazillion times. What helps on Windows shall help on Android, right? The fuck it did. So I finally gave in, did a factory reset, and will probably spend the next weeks noticing small things that were not properly restored by Google's glorious backup-and-restore feature, starting with the local music files. Thank you Google for breaking Linux to the point that it behaves like Windows 95.

Software complification - Please make it stop

Today I have something more visual than my usual text rants: An image! Yay! Because an image is more expressive than words. Have a look a this:

This graph lists the sizes of the source tarballs of different browsers hitting the FreeBSD ports tree over the past decade. (By the way, Git, Python and Google docs were my friends in creating this.) It illustrates two major points I want to talk about:

• Starting with Firefox in 2004 (red line colour) and a tarball size of 29.7 MiB, the code base gained weight very slowly until September 2009 where it started to gain a little faster (in the graph this is roughly where the leading '0' of '01/01/2011' is placed.
  Coincidence? I don't think so. Less than a year earlier, in December 2008, Google released a public beta of Google Chrome and it became blindingly clear to most developers how powerful web apps can become if powered by the right technology. Chrome's release changed the game. It fuelled the development of new features in browsers to a velocity that we haven't seen before and sparked the development of browsers that are quite possibly the most complex piece of software you have installed on your devices.
  Then, after the open source release of Chromium (Chrome's non-commercial code parts) things really took a spin and the code base size of the leading browser implementations increased close to exponentially over the next 4 years to the point of my blog post today, at which Chromium's source can be downloaded xz-compressed into a 279.8 MiB tarball, with Firefox's tarball measuring 170 MiB in size and Seamonkey's 193.6 MiB. Without Chrome sparking this trend, for all we know we could still be at less than 40 MiB for Firefox and the slow JavaScript interpreter we all learned to hate. So far so good.
• Now comes the issue with this. Apparently for a while now we are locked into a mindset in which each new browser release has to be filled with an ever-growing list of new, cool, features. Features that, I'd argue, in part only serve edge cases and more often than not do not concern the average user. Pushing features at every cost has its price. Firefox's recent vulnerability which allowed malicious PDF documents (!) to read local hard drive files is but one example that justifies the question What the hell is missing in current browsers? Do we really need a PDF viewer built into the browser? I have no problem downloading the PDF file and open it in a PDF viewer app. The same goes for other features: Ever-increasing numbers of supported audio and video codecs, offline-applications, "Pocket" (never used it), built-in instant messaging apps, you name it. Focusing development teams (or communities) of a finite sizes strongly to features comprises the danger of omitting the necessary code refactoring, purging the code base of unused or rarely-used components, and old-fashioned maintenance releases which may improve performance, memory efficiency, security without delivering new exciting features. I am not alone here. Enjoy this well-written statement by Paul-Peter Koch who explains a lovely edge-case feature to us: Navigation transition. Quite possible that you have never heard of it before. Read the post and be stunned that this kind of stuff actually exists in your browser.
• Tiny extra point: Seamonkey, in a simplified approximation, is Firefox plus E-Mail client plus IRC client plus HTML-Editor. The graph above also shows (comparing Firefox with Seamonkey) how huge the browser code base is compared to the rest of Seamonkey's components.

So please, please, please, for heaven's sake: You Googles, Mozillas, Microsofts and players in the industry. Stop complicating things and strive for the lean, lightweight, small, fast, secure software that we really need and give the dev teams the chance to implement them.

Learning from mistakes

Learning from mistakes, I was raised in the firm belief that this is a fundamental concept of mankind to acquire knowledge. The canonical example:

• Kid is told not to touch the hot plate because it's too hot.
• Kid touches it anyways.
• Kid burns his fingers.
• Kid realises the mistake she just made.
• Kid cries in pain.
• Kid does not touch the hot plate again.

When and why did the corporate world un-learn this concept? A recent ludicrous example (links only in German, sorry). Some of you may use a Motorola Moto G phone, praised for its very good bang-for-the-buck-ratio. Unfortunately for some users, it does not come with a charger for a standard power outlet.
Last year, a few German discounters wanted to close this gap and just bundled a cheap charger with the Moto G. Too cheap, as it turned out, because the damn thing was prone to dangerous overheating and was subsequently recalled. "That happens", you might say, and you may be right.
This year, German discounters sell the successor of last year's device, the Moto G (2nd gen.), and, again, this device does not come with a charger for a standard power outlet. Again, the discounters wanted to close the gap and bundle a cheap charger with the Moto G (2nd gen.). I am sure by now you see it coming. A few days ago, these chargers have also been recalled because of - you guessed it - overheating issues. Good old friend Spock would probably right now raise his eyebrow and make his trademark statement: Fascinating.

Fasten you seat belt Dorothy, 'cause your PDF is going bye-bye

You may have heard of this already, because it is already a couple of days old, and probably you have already received a security update that patches the vulnerability that allows Firefox's built-in PDF reader to read any file that you have access to, but the fact that an exploit for this has been spotted in the wild last week chills me to the bone. We all use web browsers, on a daily basis I guess, and many developer hours go into making them such that remote sites cannot, under any circumstances, break out of that sandbox the browser provides to a web app. The fact that a malicious PDF file can be used to read any file I have permission to tells me something in that area went terribly wrong. Since it is unlikely that this is the last such vulnerability to be discovered and used against the users, you should always keep reminded that the only reason nothing evil has happened to you so far is that most of the time you are browsing sites that don't want to do anything evil to you.

It's Android's media lib again

News about one of my favourite pieces of horrible horrible terrible horrid software: Android's built-in media management has the wonderful capability of rendering your favourite phone pretty useless, just by placing a broken mkv file somewhere onto said device. The flaw has been reported to Google three months ago, but of course no fix in sight. Great. Just great.