But I would look up the right way to find the system installation if I were writing production code, or even personal-use code, that needed to know where it was. I also wouldn't walk the filesystem looking for a program I was relying on (and assuming filenames and installation locations, but evidently not with a definitive standard location in mind). If I had to do that, I would know there was something horribly wrong with my own design. Although I should probably already be clued into that if my chat program is having to fool with GPU arcana like that.

Either some programmer has put thousands of other people's reliability and resources at risk by intentionally taking on something they're unqualified for and don't have the time to do right... or some manager has pushed somebody into that position.

If you mean that the reality of commercial software is that it's written by half-qualified people under unreasonable time pressure, why should we have "empathy" for the people who make it that way?

> Discord Applying Forced Arbitration - opt-out before it is too late!

> https://news.ycombinator.com/item?id=40252525

We're talking about a corporation handling our private communications, not a group of unpaid volunteers. Corporations act out of greed. That's the way capitalism works and we shouldn't pretend otherwise. Two decades ago, there were lots of empathy for the company that promised to "not be evil" and just look at how well that went. Accountability is what we should be pushing for, not empathy for those who abuse us.

The code in question supposedly gathers system information to send back to Discord. It's sensitive information gathered for Discord's own sake. Maybe, just maybe, they should be more aware of what their own code is doing at the very least when doing such things.

Anyone attempting, or purporting to do this job should know this, and if they don't know this, then that very fact is the unforgivable thing.

I say this as someone who has barely programmed anything for windows. I managed to make a custom version of putty for work that replaced the registry for a text file for settings, and made it lauchable to make saved sessions portable. And I managed the amazing engineering feat of producing a .exe that wraps a twain scanner library. No ui, just a cli that copies argv to the library calls. And I wrote a powershell script that talks to a device over rs232.

Thats about it. More than my mom could do but all in all essentially nothing.

The criticism of this utter shit is not elitism.

When I first had that work project to hack on putty, at first I took a look just to see if I could figure it out. I immediatly decided I could not figure it out in any reasonable time.

So I tried to hire a freelancer to do it. Pay someone who actually does this, right?

You know what they did? For $3k usd in 2005 or so? They fucking called regedit. As in they executed the regedit exe in a system call to import a text reg file. The settings are still stored in the registry, and I already knew how to run regedit to export and import .reg files. I could have done that much by just wrapping my exe in a bat file that runs regedit before launching putty, and that would have been a better engineered result than putting it in a system call, because it would be more flexible since the bat could be modified infinitely later without recompiling.

They were working on c code that already had code examples in it for working with the registry directly, and for reading and writing files, and yet when they needed to read a file to load settings, they ran an external executable that reads a file and puts the contents into the registry.

And putty actually has a fairly modular settings module! The registry stuff isn't baked in all over the place. There is a single c file that does all of the settings storage and retrieval. You can essentially swap the whole file out with anything else.

Am I some supergenius just because I knew enough to not try to do a job I didn't know how to do?

Am I a supergenius just because I was able to at least read code even if I couldn't write it, enough to see what it was doing and that it was a shit way to get the outward appearance of what I asked for?

How come you aren't completely offended and scandalized by solutions like these? What code that I rely on are you writing right now?

We do indeed all have dirty underwear but this is not a case of "not an expert". That is inexcusably misrepresenting the essence of the criticism here.

Regarding the QR code vulnerability, how do you know if you are scanning a harmful QR code?

Honesty I wished every HN post linking to Twitter was just changed to a threadreader link because otherwise only registered Twitter users can see the content being posted.

(The powershell bit seems to be used for something else however, so that’s just ancillary stupidity)

And that's the correct approach. Whenever I pick a task, I make sure I either know the matter in question or need to study it - in which case I inform my co-workers and especially the Tech Lead this needs to be taken into account.

Frankly, even if it was an internal piece of software used just by a few hundred/thousand people, I would be ashamed of doing it this way because I would be afraid it could have negative impact on my career in this organization.