News for hackers. Stuff that matters.
Re:Engineering code quality in Firefox by alephnan on Tuesday April 21, 2020 @06:49PM (#22940155)
We had an "open-ended" project in an undergraduate Computer Security course to discover a 0-day in Firefox. The professor (a researcher, not lecturer, by trade) didn't really have a curriculum, and said this artifact accounted for 70-80% of our grade.

Trying to compile Firefox was already a challenge. That, and each compile took an hour. IIRC, Firefox is built on some esoteric architecture / design pattern that's definitely beyond the scope of design patterns undergraduate students are familiar with.

By the end of the term, no one discovered a 0-day, unsurprising considering half the class didn't even try. There were 90 students in the class, and I ended up being the only person to produce a JS payload that would crash Firefox in one of the newer HTML5 libraries. It's neither a zero-day or exciting or profitable vulnerability though.

Realizing everyone in the class would fail, the professor changed the grade of this project to only account for 30% of the grade. I spent most of my time on this project while disregarding the rest of the busy work for the class. In the end, I got a C grade while my peers who didn't even attempt to tackle this project received higher grades.

Re:Engineering code quality in Firefox by juskrey on Wednesday April 22, 2020 @12:55AM (#22942347)
He is neither a researcher nor teacher - typical academic parasite. Makes a bet on trendy advanced task and, if it works, lets you be a coauthor. If it does not - no big deal some naive student spent 1/2 year on something virtually impossible w/o deep industry experience.
Re:Engineering code quality in Firefox by random42 on Wednesday April 22, 2020 @04:34AM (#22943433)
No need to get nasty.

You don't know him at all, apart from a short anecdotal incident, where even OP does not portray him in a bad light.

Re:Engineering code quality in Firefox by alephnan on Wednesday April 22, 2020 @01:03AM (#22942385)
Actually, they were an industry researcher coming in as a guest lecturer.
Re:Engineering code quality in Firefox by juskrey on Wednesday April 22, 2020 @01:10AM (#22942424)
Are you sure he doesn't employ the same tactics instead of actual research? (I am generally suspicious of anyone who voluntary pursues academia)
Re:Engineering code quality in Firefox by dbmueller on Wednesday April 22, 2020 @01:50AM (#22942657)
> I am generally suspicious of anyone who voluntary pursues academia

That's very unfair imo. The majority of people I know in academia don't fit this profile at all. There is obviously disappointing stuff happening, but people generally still are working/teaching in good faith.

Re:Engineering code quality in Firefox by LoveMortuus on Wednesday April 22, 2020 @05:32AM (#22943751)
>but people generally still are working/teaching in good faith.

It depends on university. On mine, most professors just see it as a job, something that one must endure until it's over. And when you bring to attention that what they're lecturing is incorrect or not proven they don't really care, again not all, but most, at least on my university. Just today I reminded the professor that there is a difference between a theory and hypothesis, their response was that they don't know if the theories they're teaching were tested or proven, but they are teaching this because that's what's written in the book...

That made me really sad, it's already hard to stay motivated to not leave the university because you need a certificate of a higher education to be taken seriously, but such behaviour from professors makes it even harder.

I've already expressed my worries to those in control of courses and they say that they understand but can't do much to change things because the curriculum that we have was accepted by the government.

Here in Slovenia people that work in the universities are paid by the government regardless of how happy or unhappy the students are, which is probably the reason for the situation in which we are...

Re:Engineering code quality in Firefox by avian on Wednesday April 22, 2020 @08:43AM (#22944912)
As a fellow Slovenian, former student and now someone who's spent years professionally in academia, let me try to show your experience from a different perspective. I don't know anything about your professor except the anecdote you shared, so I'm not defending them. I'm just trying to shine a different light "on the situation in which we are" that you as a student perhaps didn't (yet) have a chance to see. I'm also writing this because I feel like your view is pretty common among our students.

How our universities work is that as a researcher a part of your duty to the university is teaching students. Unfortunately, fields of research and study subjects in most cases aren't aligned. Nobody will be researching basic subjects that must be taught to the students, and on the other hand a very specialized field of research might not be taught to anything but a small post-graduate course. This means that often professors will end up teaching an undergraduate course that has next to nothing to do with their field of study. In the end, someone must be teaching those introductory courses and for some subjects being taught the university might not have any professional researchers at all.

Professors are researchers first and teachers second. This is most likely the reason why it appears that teaching is "something that one must endure until it's over". Your professor might be a brilliant world-class researcher in their field and they pursue it with passion, but they might be teaching e.g. linear algebra to undergraduates twice a week based on "what's written in the book" to keep their job. As it turns out, teaching and research are quite different skills and they often don't coincide. When they do, you get some really amazing professors and I'm sure you have some on your course as well.

It's not a perfect system, but I've spent enough time in foreign universities where research staff was on-the-hook all the time and liable to get fired if students weren't happy with them. It's such a constantly stressful environment that I was amazed that people managed to do any kind of research at all. In the end, it's a trade-off. You can't have a university without either top-end research or teaching and we might have chosen a slightly different trade-off between these two than the countries you seem to look up to.

Anyway, I hope I've given you a new way to look at things and I hope you will stay at your university for more than just to get the "take me seriously" papers.

Re:Engineering code quality in Firefox by juskrey on Wednesday April 22, 2020 @02:43AM (#22942911)
The main problem in academia is that people still can be harmful even being in good faith. (remember that "road to hell" saying, right?)
Re:Engineering code quality in Firefox by dbmueller on Wednesday April 22, 2020 @03:06AM (#22943008)
> people still can be harmful even being in good faith

That's a general truth. You make it sound like people choose academia to somehow cheat the system and profit from free student's work or whatever. Make a real case for you thesis then.

Re:Engineering code quality in Firefox by juskrey on Wednesday April 22, 2020 @03:11AM (#22943022)
People choose academia to be within (zero-sum) system and project the same expectations to students, while real life success is about being out of any system. Hence the harm.
Re:Engineering code quality in Firefox by exdsq on Wednesday April 22, 2020 @03:59AM (#22943267)
People don't 'choose academia to be within a zero-sum system and project the same expectations to students'. My partner and most of my friends are or have been in academia and the one common thing is a real passion for their subject of choice and industry doesn't offer the same flexibility to focus on it.

Being suspicious of those who voluntarily become academics is odd.

Re:Engineering code quality in Firefox by sgift on Wednesday April 22, 2020 @06:30AM (#22944108)
Talks about zero-sum. Uses things based on the results of said zero-sum system. Makes you laugh and cry at the same time.
Re:Engineering code quality in Firefox by juskrey on Wednesday April 22, 2020 @06:36AM (#22944137)
Real life results of academia are largely propaganda (tuition billions well spent). They are not even good in figuring out why/how things work and replicating success (additionally proven by Soviets).
Re:Engineering code quality in Firefox by sgift on Wednesday April 22, 2020 @07:14AM (#22944343)
Your language of choice - Clojure according to your HN bio - works on a product where important parts (e.g. Generics and the Java collection framework) were done by academia. One of the most popular compilers (LLVM) was done in academia (and still is in parts!). Most of the optimizations compilers use were done by academia.

Your work stands on the work of countless academic researchers and you run around "What did academia EVER do for us?" - the Monty Python sketch about Romans comes to mind.

Re:Engineering code quality in Firefox by juskrey on Wednesday April 22, 2020 @07:25AM (#22944400)
This is especially laughable, since I have seen how that works on practice: take something everyone already does, write 1000 of PhDs on that, add to academic history book, now wikipedia and voila.

If any of IT projects came from academia to the market, it's only because certain people were picked up by businesses that were onto something already.

Re:Engineering code quality in Firefox by exdsq on Wednesday April 22, 2020 @11:32AM (#22946634)
I don't mean this in a derogatory way but from your bio it sounds like you work in full-stack web development - maybe with some data processing. Sure, this stuff doesn't really come from academia. But there are other bits of tech where academia does play a large part and your viewpoint is just not correct. One example that contradicts your second paragraph away is I spent several years at a consultancy that helped academics commericalise their own research - mostly medical tech but some computer vision stuff too. There's loads of great work businesses coming out of academia - you might just not be in a position to see it.
Re:Engineering code quality in Firefox by juskrey on Wednesday April 22, 2020 @11:54AM (#22946911)
Coincidentally, before current full stack freelancing stuff, I've spent around two years in augmented reality, often having to dig through tons of published research, only to realize pretentious lab methods do not work outside. We ended up adopting some methods from hacky teens on DIY forums, but never that..
Re:Engineering code quality in Firefox by readwind on Wednesday April 22, 2020 @02:10AM (#22942760)
Don't be salty, man, no offence, academics need love too. I'm not even by far academic, academical, but, let's keep it cool, man. No offence or intent to be hostile.
Re:Engineering code quality in Firefox by vikramkr on Tuesday April 21, 2020 @06:52PM (#22940163)
That makes no sense as a class design - are there so many zero days in firefox that are so easy to find that you can expect undergrads to casually find enough that you can base 70% of the class grade on it?
Re:Engineering code quality in Firefox by jimbob45 on Tuesday April 21, 2020 @07:09PM (#22940305)
Every teacher wants to be the next Jaime Escalante. Sometimes they take their idealism too far.
Re:Engineering code quality in Firefox by dmoy on Tuesday April 21, 2020 @07:48PM (#22940538)
I'm gonna go out on a limb and say that a research professor at presumably a large research university doesn't give two shits about being the next jaime escalante. The reality is probably that they're more focused on research, and don't care much about actually teaching. You see quite a bit of that.
Re:Engineering code quality in Firefox by Hello71 on Tuesday April 21, 2020 @08:15PM (#22940710)
my guess is that the prof wanted to plagiarize the work as their own.
Re:Engineering code quality in Firefox by foota on Tuesday April 21, 2020 @07:16PM (#22940346)
Any change to the grading scheme of a class should be Max(old grade, new grade). One of my profs once offered a re-test opportunity such that you would have had an incentive to do worse on the exam for certain original scores. Drove me up the wall.
Re:Engineering code quality in Firefox by snazz on Tuesday April 21, 2020 @07:45PM (#22940528)
I also think that just keeping the new grade is a valid retake scheme. Although it's less forgiving for the students, it encourages them to make absolutely certain that they know the content for the retake. Anything with a square root curve where you have to pinpoint your retake score perfectly to maximize the final grade is unfair and encourages the wrong thing.
Re:Engineering code quality in Firefox by foota on Tuesday April 21, 2020 @08:20PM (#22940744)
Yep, that's also fine by me. Although ideally (and especially if it's required to do a retake!) this would be set out ahead of time. Many profs don't seem to understand the kind of time and grade tradeoffs students need to make. Once had a prof come in to a class with a bunch of seniors with many other high priority classes that wouldn't release the grade weighting at all. They didn't understand that people need to know that kind of thing to know whether they need to do really well on something or if it's the kind of thing that can be dropped or half assed when push comes to shove.
Re:Engineering code quality in Firefox by bobongo on Wednesday April 22, 2020 @10:32AM (#22945971)
From these,

> ... I ended up ... neither a zero-day ...

> Realizing everyone in the class would fail, the professor changed the grade of this project to only account for 30% of the grade.

> I ... disregarding the rest of the busy work for the class.

It sounds like OP could not find a zero day (old_grade=0) and did not do any other homework (new_grade=0), therefore should have received max(0, 0), but received a C.

Re:Engineering code quality in Firefox by bhearsum2 on Tuesday April 21, 2020 @10:02PM (#22941276)
I'm curious what year this was. When I was in college (~2005) we had an entire class based around contributing to Mozilla (both Gecko and other parts - https://wiki.cdot.senecacollege.ca/wiki/DPS909). The very first assignment in that course was compiling Firefox. Which, especially on Windows, was a herculean task at the time. I believe this sort of experience helped to spawn https://wiki.mozilla.org/MozillaBuild and other developer experience projects.

Things are much better these days, but there is still much inherent complexity in a project like Firefox.

Re:Engineering code quality in Firefox by vkou on Tuesday April 21, 2020 @06:53PM (#22940167)
I'm sorry that your professor treated their instruction as an open-ended research project.
Re:Engineering code quality in Firefox by thayne on Wednesday April 22, 2020 @12:29AM (#22942188)
> Trying to compile Firefox was already a challenge. That, and each compile took an hour.

At first glance, this sounds terrible. But when compared to software projects of comparable size, Firefox is hardly unique. Compare to compiling Chromium for example, or even the Linux kernel.

Re:Engineering code quality in Firefox by swiley on Wednesday April 22, 2020 @07:38AM (#22944482)
Those are all very different levels of difficulty IMO:

Linux is almost trivially easy, only slightly harder than the usual configure && make and has very few dependencies.

Firefox is pretty painful but it's doable with a decent amount of care and bandwidth.

Chromium is a fairly typical google project where the recommended first step to building it is to become a google employee but some alternative workarounds are also available if that's not practical.

Re:Engineering code quality in Firefox by happosai on Thursday April 23, 2020 @06:49AM (#22954573)
Nah building is fine, just follow the steps from Debian/Ubuntu/whateverdistro . But trying to contribute is fun. By the time you've danced all the hoops to allow you to contribute, some Google employee has already refactored the code around the bug. Then you have to be fast enough to get your updated patch applied before someone else has reorganized the code again...

At some point I started wondering if indeed I'd get the fix in faster by starting to practice whiteboard interviews.

Re:Engineering code quality in Firefox by eholk on Friday April 24, 2020 @02:09PM (#22971220)
> ...some Google employee has already refactored the code around the bug. Then you have to be fast enough to get your updated patch applied before someone else has reorganized the code again...

For what it's worth, this is how it work's if you're a Google employee too.

Re:Engineering code quality in Firefox by ohazi on Wednesday April 22, 2020 @01:12PM (#22947831)
The first time I had a reason to build Chromium was ten years ago. I was using a 32-bit machine with 4 GB of RAM, and that's where the story ends.
Re:Engineering code quality in Firefox by freeboson on Wednesday April 22, 2020 @09:24PM (#22951927)
Do you have to build chromium with blaze? Or does it use e.g. cmake or something?
Re:Engineering code quality in Firefox by jbroman on Wednesday April 22, 2020 @10:54PM (#22952418)
It's uses gn, a build system developed for Chromium. That said, on an Ubuntu system the steps to build Chromium are fairly well-documented and straightforward, as long as you have an appropriately beefy system (unfortunately it's a long wait and a fair amount of RAM is required, and Googlers tend to use a distributed build system).

https://chromium.googlesource.com/chromium/src/+/master/docs...

Re:Engineering code quality in Firefox by tedmielczarek on Thursday April 23, 2020 @08:17AM (#22955120)
gn is of course a meta-build system, the initials stand for "generate ninja". ninja does the actual build execution. The Firefox build system has a similar homegrown frontend called mozbuild, which generates Makefiles for the actual build.
Re:Engineering code quality in Firefox by sondr3 on Wednesday April 22, 2020 @03:19AM (#22943054)
I think at scale (according to Wikipedia the 5.6 release has ~33M lines of code) the Linux kernel might be one of the easiest (and quickest) projects to compile[1].

[1]: https://techgage.com/wp-content/uploads/2019/11/Compile-Perf...

Re:Engineering code quality in Firefox by gpderetta on Wednesday April 22, 2020 @05:58AM (#22943931)
I haven't compiled my own kernel in at least 15 year but I remember it was quite easy (is make menuconfig still the way to go?). I did have much more free time though.
Re:Engineering code quality in Firefox by haihaibye on Wednesday April 22, 2020 @08:06AM (#22944646)
Surely most of those lines of codes are optional modules and device drivers - so aren't compiled for most users or this test?
Re:Engineering code quality in Firefox by Polylactic_acid on Wednesday April 22, 2020 @01:58AM (#22942698)
I had to compile linux once and I found the process to be trivial. My distro had a guide for how to do it and then how load the kernel in to grub and it was basically just copy/paste
Re:Engineering code quality in Firefox by alephnan on Wednesday April 22, 2020 @12:50AM (#22942311)
Right. I did not mean this as knock against Firefox.

At one of the FAANG I previously worked at, it took an hour to compile JavaScript.

Re:Engineering code quality in Firefox by freeboson on Wednesday April 22, 2020 @09:18PM (#22951887)
The syllabus where a grade is broken down by percentages is (at US institutions) considered to be like a contract. If the course originally had it at "70-80%", then it cannot be changed mid-semester without being acceptable to you. It's fairly incredible for this to happen (at a US institution).
Re:Engineering code quality in Firefox by totony on Thursday April 23, 2020 @04:53AM (#22954036)
Whenever you have trouble compiling something, just look at how gentoo approaches it. They're the last bastion making sure OSS is actually buildable.

Them are their users most likely are the #1 source of build documentation, bug reports and fixes in OSS

Re:Engineering code quality in Firefox by dontbenebby on Wednesday April 22, 2020 @01:34AM (#22942568)
You can’t arbitrarily change the syllabus to a student’s detriment. I’d have argued up the chain.
Re:Engineering code quality in Firefox by kiplkipl on Wednesday April 22, 2020 @05:30AM (#22943735)
They'd have ignored you. I went through something similar myself. The barrier to exit for students is so high that colleges have little incentive to care about pleasing them.
Re:Engineering code quality in Firefox by veeralpatel979 on Tuesday April 21, 2020 @08:39PM (#22940857)
what college was this if you don't mind sharing? I recall a similar thing happening at the college I went to