mask.of.sanity writes: Oracle could have saved mountains of cash and bad press if Click-to-Play was enabled before Java was hosed by an armada of zero day vulnerabilities, Adobe security boss Brad Arkin says. The simple fix introduced into browsers over the last year stopped the then zero day blitzkrieg in its tracks by forcing users to click a button to enable Java.

jones_supa writes: The Internet Explorer team at Microsoft recently detailed changes to the JavaScript engine coming in Windows 10. A significant change is the addition of a new tier in the Just-in-Time (JIT) compiler. In Windows 10, the Chakra JS engine now includes a second JIT compiler that bridges the gap between slow, interpreted code and fast, optimized code. It uses this middle-tier compiler, called Simple JIT, as a "good enough" layer that can move execution away from the interpreter quicker than the Full JIT can. Microsoft claims that the changes will allow certain workloads to "run up to 30% faster". The move to a two-tiered JIT compiler structure mirrors what other browsers have done. SpiderMonkey, the JavaScript engine in Firefox, has an interpreter and two compilers: Baseline and IonMonkey. In Google Chrome, the V8 JavaScript engine is also a two-tiered system. It does not use an interpreter, but compiles on a discrete background thread.

theodp writes: Having declared U.S. kids clueless about coding, Facebook and Microsoft are now turning their attention to Europe's young 'uns. "As stewards of Europe's future generations," begins the Open Letter to the European Union Ministers for Education signed by Facebook and Microsoft, "you will be all too aware that as early as the age of 7, children reach a critical juncture, when they are learning the core life skills of reading, writing and basic maths. However, to flourish in tomorrow's digital economy and society, they should also be learning to code. And many, sadly, are not." Released at the launch of the European Coding Initiative — aka All You Need is Code! (video) — in conjunction with the EU's Code Week, the letter closes, "As experts in our field, we owe it to Europe's youth to help equip them with the skills they will need to succeed — regardless of where life takes them."

jfruh writes: It used to be that you could get an Oracle database certification and declare yourself Oracle-certified for the rest of your career. That time is now over, causing a certain amount of consternation among DBAs. On the one hand, it makes sense that someone who's only been certified on a decade-old version of the product should need to prove they've updated their skills. On the other, Oracle charges for certification and will definitely profit from this shift."

An anonymous reader writes: Milen Dzhumerov, a software developer for OS X and iOS, has posted a concise breakdown of the problems with the Mac App Store. He says the lack of support for trial software and upgrades drives developers away by preventing them from making a living. Forced sandboxing kills many applications before they get started, and the review system isn't helpful to anyone. Dzhumerov says all of these factors, and Apple's unwillingness to address them, are leading to the slow but steady erosion of quality software in the Mac App Store.

"The relationship between consumers and developers is symbiotic, one cannot exist without the other. If the Mac App Store is a hostile environment for developers, we are going to end up in a situation where, either software will not be supported anymore or even worse, won't be made at all. And the result is the same the other way around – if there are no consumers, businesses would go bankrupt and no software will be made. The Mac App Store can be work in ways that's beneficial to both developers and consumers alike, it doesn't have to be one or the other. If the MAS is harmful to either developers or consumers, in the long term, it will be inevitably harmful to both."

An anonymous reader writes: Developer Paul Chiusano thinks much of programming culture has been infected by a "worse is better" mindset, where trade-offs to preserve compatibility and interoperability cripple the functionality of vital languages and architectures. He says, "[W]e do not merely calculate in earnest to what extent tradeoffs are necessary or desirable, keeping in mind our goals and values -- there is a culture around making such compromises that actively discourages people from even considering more radical, principled approaches." Chiusano takes C++ as an example, explaining how Stroustrup's insistence that it retain full compatibility with C has led to decades of problems and hacks.

He says this isn't necessarily the wrong approach, but the culture of software development prevents us from having a reasoned discussion about it. "Developing software is a form of investment management. When a company or an individual develops a new feature, inserts a hack, hires too quickly without sufficient onboarding or training, or works on better infrastructure for software development (including new languages, tools, and the like), these are investments or the taking on of debt. ... The outcome of everyone solving their own narrow short-term problems and never really revisiting the solutions is the sea of accidental complexity we now operate in, and which we all recognize is a problem."

Florian Mueller is a blogger, software developer and former consultant who writes about software patents and copyright issues on his FOSSPatents blog. In 2004 he founded the NoSoftwarePatents campaign, and has written about Microsoft's multi-billion-dollar Android patent licensing business and Google's appeal of Oracle's Android-Java copyright case to the Supreme Court. Florian has agreed to give us some of his time in order to answer your questions. As usual, ask as many as you'd like, but please, one per post.

theodp (442580) writes "Well, the College Board has posted the 2014 AP Computer Science Test scores. So, before the press rushes out another set of Not-One-Girl-In-Wyoming-Took-an-AP-CS-Exam stories, let's point out that no Wyoming students of either gender took an AP CS exam again in 2014 (.xlsx). At the overall level, the final numbers have changed somewhat (back-of-the-Excel-envelope calculations, no warranty expressed or implied!), but tell pretty much the same story as the preliminary figures — the number of overall AP CS test takers increased, while pass rates decreased despite efforts to cherry pick students with a high likelihood of success. What is kind of surprising is how little the test numbers budged for most states — only 8 states managed to add more than 100 girls to the AP CS test taker rolls — despite the PR push by the tech giants, including Microsoft, Google, and, Facebook. Also worth noting are some big percentage decreases at the top end of the score segments (5 and 4), and still-way-too-wide gaps that exist between the score distributions of the College Board's various ethnic segments (more back of the envelope calcs). If there's a Data Scientist in the house, AP CS exam figures grabbed from the College Board's Excel 2013 and 2014 worksheets can be found here (Google Sheets) together with the (unwalkedthrough) VBA code that was used to collect it. Post your insight (and code/data fixes) in the comments!"

An anonymous reader writes with a report at Ars Technica about how a small bug can lead to a security problem. In this case, the problem is that quotation marks — or the lack of them — can be significant. From the Ars article: "The scenario... requires a 'standard' user with access rights to create a directory to a fileserver and an administrator executing a vulnerable script," Frank Lycops and Raf Cox, security researchers with The Security Factory, said in an e-mail interview. "This allows the attacker to gain the privileges of the user running the script, thus becoming an administrator." While the attack falls short of the severity of the Shellshock family of Linux shell vulnerabilities, the two researchers stressed that it's a good example of how untrusted input can be used to execute commands on a system. The researchers identified at least one popular script with the vulnerability. When the script attempts to set the starting directory for system administration work, it inadvertently runs the command appended to the malicious directory's name as well. ... The solution is to use proper coding practices—in this case, the judicious use of quotation marks. Quotation marks are used in the shell environment to make sure that the data inside the quotes is not interpreted by the program as a command.

lars_doucet (2853771) writes Flash CC now has an SDK for creating custom project file formats; this lets you use the Flash IDE to prepare and publish content for (not-the-flash-player) compile targets. Among these new platforms is OpenFL, a fully open-source re-implementation of the Flash API that exports to Javascript and C++ (no Flash Player!), among other targets: When Adobe demoed the custom project feature at Adobe MAX the other night, they brought out Joshua Granick (lead maintainer of OpenFL) to show off a custom OpenFL project format that lets you make Flash Art in Flash CC, then compile it out to Flash, HTML5, and native C++ (desktop+mobile) targets. Maybe Adobe heard us after all?

rastos1 writes: In a recent blog, software developer Bruce Dawson pointed out some issues with the way the FSIN instruction is described in the "Intel® 64 and IA-32 Architectures Software Developer's Manual," noting that the result of FSIN can be very inaccurate in some cases, if compared to the exact mathematical value of the sine function.

Dawson says, "I was shocked when I discovered this. Both the fsin instruction and Intel's documentation are hugely inaccurate, and the inaccurate documentation has led to poor decisions being made. ... Intel has known for years that these instructions are not as accurate as promised. They are now making updates to their documentation. Updating the instruction is not a realistic option."

Intel processors have had a problem with math in the past, too.

An anonymous reader writes: On 10 October 1994, Opera CTO Hakon Lie posted a proposal for Cascading HTML style sheets. Now, two decades on, CSS has become one of the modern web's most important building blocks. The Opera dev blog just posted an interview with Lie about how CSS came to be, and what he thinks of it now. He says that if these standards were not made, "the web would have become a giant fax machine where pictures of text would be passed along." He also talks about competing proposals around the same time period, and mentions his biggest mistake: not producing a test suite along with the CSS1 spec. He thinks this would have gotten the early browsers to support it more quickly and more accurately. Lie also thinks CSS has a strong future: "New ideas will come along, but they will extend CSS rather than replace it. I believe that the CSS code we write today will be readable by computers 500 years from now."

michaelcole writes: Its name is BitHammer. It searches out and bans BitTorrent users on your local sub-net.

I'm a digital nomad. That means I travel and work, often using shared Wi-Fi. Over the last year, I've been plagued by rogue BitTorrent users who've crept onto these public hostpots either with a stolen/cracked password, or who lie right to my face (and the Wi-Fi owners) about it.

These users clog up the residential routers' connection tables, and make it impossible to use tools like SSH, or sometimes even web browsing. Stuck for a day, bullied from the Wi-Fi, I wrote BitHammer as a research project. It worked rather well. It's my first Python program. I hope you find it useful.

Nerval's Lobster writes As developers embrace new programming languages, older languages can go one of two ways: stay in use, despite fading popularity, or die out completely. So which programming languages are slated for history's dustbin of dead tech? Perl is an excellent candidate, especially considering how work on Perl6, framed as a complete revamp of the language, began work in 2000 and is still inching along in development. Ruby, Visual Basic.NET, and Object Pascal also top this list, despite their onetime popularity. Whether the result of development snafus or the industry simply veering in a direction that makes a particular language increasingly obsolete, time comes for all platforms at one point or another. Which programming languages do you think will do the way of the dinosaurs in coming years? With COBOL still around, it's hard to take too seriously the claim that Perl or Ruby is about to die. A prediction market for this kind of thing might yield a far different list.

whoever57 writes Google has asked the Supreme Court to review the issue of whether APIs can be copyrighted. Google beat Oracle in the trial court, where a judge with a software background ruled that APIs could not be copyrighted. but the Appeals court sided with Oracle, ruling that APIs can be copyrighted. Now Google is asking the Supreme Court to overturn that decision. (Also of interest.)

d33tah notes the announcement of Google Code-In 2014 and Google Summer of Code 2015. A call to all students: if you have ever thought it would be cool to write code and see it make a difference in the world, then please keep reading. We are excited to announce the next editions of two programs designed to introduce students to open source software development, Google Summer of Code for university students and Google Code-in for 13-17 year old students.

An anonymous reader writes The Linux 3.17 kernel was officially released today. Linux 3.17 presents a number of new features that include working open-source AMD Hawaii GPU support, an Xbox One controller driver, free-fall support for Toshiba laptops, numerous ARM updates, and other changes.

FrnkMit writes: Challenging a previous Code.org story on tech diversity, a Forbes.com writer interviewed 716 women who left the technology field. Her conclusion: corporate culture, and the larger social structure, is the primary cause for these women leaving the industry and never looking back. Specific issues include a lack of maternity policies in small companies, low pay which barely covers day care, "jokes" from male coworkers, and always feeling like the "odd duck." In reality, there are probably many intertwined causes: peer pressure at the high-school and college level, female-unfriendly geek culture, low pay, a lack of accommodations for pregnant/nursing mothers, the myth of "having it all," stereotype threat, and repeated assertions that women aren't biologically suited to writing software and therefore there's no problem at all.

First time accepted submitter ndykman (659315) writes The Independent reports that a MS developer has suggested a real reason behind the Windows 10 name: old code. More specifically, code that looks for "Windows 9" to determine the Windows version. Fine for Windows 95 or Windows 98, but not so great for a new operating system. The article includes a link that shows that yes, this would be a problem.

theodp writes: "The biggest reason for a lack of diversity in tech," says Code.org's Hadi Partovi in a featured Re/code story, "isn't discrimination in hiring or retention. It's the education pipeline." (Code.org just disclosed "we have no African Americans or Hispanics on our team of 30.") Supporting his argument, Partovi added: "In 2013, not one female student took the AP computer science exam in Mississippi." (Left unsaid is that only one male student took the exam in Mississippi). Microsoft earlier vilified the CS education pipeline in its U.S. Talent Strategy as it sought "targeted, short-term, high-skilled immigration reforms" from lawmakers. And Facebook COO and "Lean In" author Sheryl Sandberg recently suggested the pipeline is to blame for Facebook's lack of diversity. "Girls are at 18% of computer science college majors," Sandberg told USA Today in August. "We can't go much above 18% in our coders [Facebook has 7,185 total employees] if there's only 18% coming into the workplace."