where is software quality heading to? - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: October 14, 2025, 04:26:56 pm
content: The Great Software Quality Collapse: How We Normalized Catastrophe:https://techtrenches.substack.com/p/the-great-software-quality-collapse

author: radiolistener
author_rank: Super Contributor
timestamp: October 14, 2025, 06:03:05 pm
content: The Great Software Quality Collapse — YouTube edition: the site now eats absurd amounts of CPU time. On a tablet, video playback constantly stutters, and the whole device often reboots just from having a YouTube tab open. I remember it worked ok about 2-3 years ago, with minimum cpu load.

author: Nominal Animal
author_rank: Super Contributor
timestamp: October 14, 2025, 09:11:57 pm
content: Heh. I've been saying this for over a decade now, and been called names for doing so.The gutter is the answer to the question. It is a direct consequence of the pressures applied, and perfectly expected. Applies to everything, not just to software. There just isn't any real pressure to do any better, so doing better is actually a waste of valuable resources (because it would save resources onlyelsewhereand therefore not in the interests of the developer/manufacturer/vendor).

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 14, 2025, 09:32:39 pm
content: I'll once again mention Wirth's "A plea for lean software" that he wrote some 30 years ago.

author: brucehoult
author_rank: Super Contributor
timestamp: October 14, 2025, 11:52:00 pm
content: Often open-source projects are far more efficient than commercial ones. They are a labour of love and developers will spend unlimited time improving efficiency. In most of the commercial world managers want something to be "done" so that the programmer can move on to the next thing. It doesn't matter if it's buggy -- they can get extra budget (and people) for maintenance. They get rewarded for hitting deadlines .. with crap.There are exceptions. Primarily in system software where code is used constantly by billions of people. Individual apps .. usually no one cares. Web sites ... don't make me laugh ... not unless you're Google or Facebook.I've managed to find a few jobs where size, speed, and quality were regarded as important, and if I had a day where I deleted 100 lines of code that was good productivity.At Innaworks we created a Java J2ME to native Arm compiler for Qualcomm "BREW" phones. The rest of the phone world was Java. Developers (mostly games) wrote for Java phones then when they were finished shipped the code to India to be returned some months later converted to C++, with added bugs. Our "AlcheMO" software, which we provided as SaaS via tools integrated into customer makefiles, let developers incorporate BREW phones into their every day development and testing cycle with a few minutes turn-around. Several customers did A/B comparison and our Java compiler and custom libraries (I did the GC, threads, and all the basic classes for arrays, strings, hash tables etc) consistently beat the outsourced hand conversion services in code size, memory usage, and speed ... as well of course as taking minutes instead of months and not adding bugs.At Samsung the entire task of the team I was in the first couple of years was to take standard AOSP and continuously find optimisations, primarily to make programs launch at least 20% faster (for which we were prepared to spend a reasonable amount of RAM and flash), but other optimisations were desired too.There has been a ton of work -- and literally billions of dollars spent -- at Apple, Mozilla, and Google in the last two decades making JavaScript go faster -- so that web site developers can piss the performance away again. I was part of the Mozilla team doing that for a while.It's really quite remarkable, I think, that you can use as shitty a language as JavaScript to write an emulator for something like an Amiga and have it run at full original speed in a web browser. Javascript programs now run as fast as C++ programs compiled without a "-O" flag (i.e. with "-O0").

author: pcprogrammer
author_rank: Super Contributor
timestamp: October 15, 2025, 06:10:36 am
content: No surprise to me. I have seen memory leakage problems long ago with the rise of new programming languages that offer memory management for you. While testing and debugging problems found often resided in library code and a work around was needed to fix it.Another issue is that everybody nowadays think they can write software and with management or recruitment officers having less knowledge on the matter are not able to make good judgement on who is capable or not.Also have a feeling that outputting updates has become a productivity marker, and due to this we are flooded with them.AI is not going to make this any better either. Sure it can be helpful but one still has to know about writing software and how things work to fix the wrongs of the AI.

author: coppercone2
author_rank: Super Contributor
timestamp: October 15, 2025, 06:18:01 am
content: need cheaper ram

author: madires
author_rank: Super Contributor
timestamp: October 15, 2025, 11:02:34 am
content: Sorry, prices are up. Also for enterprise HDDs (AI hype).

author: tszaboo
author_rank: Super Contributor
timestamp: October 15, 2025, 11:24:08 am
content: Or that the calculator app on Windows now has a splash screen because it doesn't load fast enough.Honestly, just stop adding features nobody asked for.

author: paulca
author_rank: Super Contributor
timestamp: October 15, 2025, 11:26:33 am
content: Castles of sand upon concrete."Code was never the hard part."The pendulum of software longevity demands/aspirations and realities."We just can't have nice things."Younger generations in the work force today have never owned a keyboard until they started work. They wouldn't know what "hover" was or what a "tooltip", "keyboard short cut", "tab order" were to begin with. They have no degree, no 2nd level qualification, they just passed a code review and managed to produce a front end in Angular or Android studio at home.

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 15, 2025, 11:28:07 am
content: Quote from: tszaboo on October 15, 2025, 11:24:08 amalso mspaint, notepad, etc...copy it from win7.

author: paulca
author_rank: Super Contributor
timestamp: October 16, 2025, 12:25:48 pm
content: I think from the OP blog article the one that impact me most is "over abstraction".In my case Java Sprintboot REST APIs with Angular UI. "Micro-service architecture".To summarise the problem. Java and uni's via OOP teach an out dated style of application development based on monolithic mega applications. In these functionality is separated vertically into layers.In micro-service applications however the boundaries are meant to lie in the platform, at the "pod boundary" or "network boundary". The services are meant to be as good as disposable, ie, small, isolated, replaceable, rewritable. They do NOT need internal layers.Yet all our "micro" services require 1-2Gb of RAM. They each have their own multi-layer, dependency injected, code auto-generation, state separation and translation architecture.The UI sends us a JSON blob via REST, HTTPS. We round trip authenticate the request token. We deserialise the payload into an object which is auto-generated. That object a DTO (data transfer object) is then translated into the domain layer via a "mapper". This becomes the "Input object" another "struct in a pretty dress" value object. The "Input" is used to invoke the process, which will load all nested, related information, all "JOIN" data between a dozen tables about the entities in question. These come back in "Entity" format from the ORM persistence layer.However, as "Peristence" is a special kind of service the actual request to load data has to be serialised into a request payload to another service, again, going via mappers from domain->DTO->API->Network and up the stack, DB queries and back down the stack of DTOs mappers, network requests.All of this data is converted with 1000s of string operations into "domain objects". Objects and classes with "business terms", "business language". The operation is performed, say to add a year to a renewal date. Then the whole process is basically reversed.You are looking at 90% or more overhead from just:Parse operation type from Payload JSON.Extract renewal DateAdd a year.Update DB column specifically and directly with a simple update query.Modify JSON in place and return.Single service, 50 lines tops with basic REST template, JSON parser and JDBC.In my opinion, if you need to see the source code for an abstraction it's NOT WORTH HAVING. it is a burden not a help. Not only do you need to understand your own problems, but now you need to understand everyone elses and how you fit into them. Can you actually reuse their abstraction? No? Do you duplicate it? Rewrite it?Its not that abstractions are "bad" it's that they are "done because they are to be done". People leave Uni with all the bells and whistles for OOP megaliths and none of the ability to ask, "What is the cost, overheads and cognitively?" and "Do we actually need it?" Also, for the love of god stop with the "Maybe later will might need .... so lets just add the whole framework for it now, just as a part of course anyway. No! STOP!We need people in Uni's and other education to be taught more than one paradigm. We need "System's theory" for one.Input, Process, Output.Your requirements give you the inputs and outputs, you just gotta figure out how to get from A to B in ideally the most practical and efficient way.It might surprise (or not) many electronics folks that this is NOT at all what happens today in most software. Instead it's all about "modelling", buildig extensive models of the business domain, mutating them and then generating the output.

author: metrologist
author_rank: Super Contributor
timestamp: October 16, 2025, 07:38:20 pm
content: I have the "latest Windows 11 update makes MS Word randomly open a new blank document a dozen or so times a day bug" and apparently we need to wait for MS to fix the bug.

author: MrMobodies
author_rank: Super Contributor
timestamp: October 16, 2025, 11:39:18 pm
content: I use to use Edge for things back in the early 2020's like for Amazon Prime video. Late that year they did this rubbish in the favourites and history menu so I reverted to a backup until Amazon stop supporting that build and decided to migrate to Vivaldi for that.I found that one someone's old laptop recently. Edge opened up and I thought I wonder if this is the later build with those stupid things it. So opened task manager, then open favourite's and yes they appeared and caused it to spike to full utilization for about 3 seconds and hardly much things in there.The same reason why I instantly gave up on LTSC 2021 as an option and upgrade to LTSC 2019 in early 2022as soon as I saw this crap appear and flash in new widget menu thing on the left for ages and some of the other menus where it'd become a bit unresponsive. I find that DAMN ANNOYING! as well due to the distraction seeing things flash like that especially in my peripheral vision.If it takes sooo long to load the contents that they decide they need to put something over it goes to show they don't care about the overhead and impact on performance and also shown by how these things that they implemented above causes a massive spike to CPU usage just to display that flashing and for it to then disappear..... the stupidity! that they copied from web pages and form over function approach.Joke: Looks to me like someone's EGO and their decorations was put to come first ahead of and at the expensive of everything else.When I see those things they just make me mad with the combination of the annoyance they cause and the stupidity. Something like that should never be needed. If anything why not just delay loading of the contents or hide them until they are all prepared to be shown or better yet let them appear gradually which has to be better than bogging it down even more with stupid animations.It seems to me that it's heading to the graphical designers as they are copying things off web pages and putting in parts of the operating system.

author: Simmed
author_rank: Frequent Contributor
timestamp: October 18, 2025 12:54:18 am
content: ai slopsoftware bloatwhats new ?

author: JPortici
author_rank: Super Contributor
timestamp: October 18, 2025 06:07:01 am
content: Quote from: paulca on October 16, 2025, 12:25:48 pmNot at all, but even though i develop software i've come up from developing firmware so i have a concern/disgust for useless frameworks and layering of shit (libraries) to make the sand castle a bit stronger.I'm having the new guy do his things in his own preferred way. He's, after all, to become acquainted with our stuff and forcin him to do things our way already would be too much.After the first project we made a comparison. Mine would take one 20th of resources, we investigated together on what the bloat was and how to remove it and went down to one third.Then on the next project we reached a point in which the framework became useless because it would not implement an essential feature we needed. We could add libraries and hope they would play nice together, or write blocks of native code but they were especially hard to interface so he's now deep diving into writing native apps (our are usually not really complicated, but require device specific features that are never abstracted)There is hope(It's not that i don't use frameworks, i just use the right ones. Show the colleague that it's possible and not that difficult to go out the beaten path of mediocrity and he'll follow, if he's worth a damn)

author: paulca
author_rank: Super Contributor
timestamp: October 18, 2025 09:29:03 am
content: Quote from: JPortici onYesterdayat 06:07:01 amThe industry is full of one trick ponies. People who picked one tech to focus their CV on and have no interest in understanding anything else. In fact they would argue that their language/framework combo is the perfect one for every single task you present them with.Having done 100+ interviews for senior devs the question I found the hardest to get a proper answer for wasn't:"Sell Spring framework to me. I am the tech lead, you think we should use Spring for the project, sell it to me. What does it bring that is of benefit?"The one that was hard to get an answer for was:"Now give me reasons why you might not want to use Spring. What disadvantages and costs are associated with it and it's maintenance?"Mostly blank stares and "Umm....", stunned bunnies.If you don't understand the cost of the framework, you do not understand the framework.My boss in work has been trying to upgrade Spring security for 3 months now. I have tried to point out if "those above" demand CVE compliance we will be upgrading Spring security every 2 weeks but they keep spinning up new Java Spring boot multigig death stars "micro" services. It's comical. Like watching a bunch of people put 3" wood screws in with hammers.

author: JPortici
author_rank: Super Contributor
timestamp: October 18, 2025 10:08:48 am
content: Quote from: paulca onYesterdayat 09:29:03 amPlease, do not assume i don't try new stuff before dismissing it! or that i have a single language/framework combo up my sleeve.It's only by trying and comparing processes and results that we can effectively understand the strenghts and weaknesses, because on paper any language or framework is the only one you'll ever need, promise!

author: paulca
author_rank: Super Contributor
timestamp: October 18, 2025 11:16:09 am
content: Quote from: JPortici onYesterdayat 10:08:48 amIndeed. There are absolutely "needs" for all the bells and whistles and frameworks. However I feel they just get leveraged as a "matter of course" in far too many places resulting in overheads and cognitive cost that was unnecessary.The same can be said for "Design patterns".To put it into a more topic form. Consider "DigitalWrite()" on Arduino. Most experienced MCU devs know it's as slow as a dog. A lot of MCU devs would just go ahead and raw write the register.I would akin this with something like:StringUtils.isBlank() / StringUtils.isEmpty() or it's more complex variants.These are in several different forms from vendors like Google Guava, Apache Commons, etc.In some circumstances you are probably better off using those as the "by hand" variants are prone to errors, omissions and asymmetrical evaluations (with holes). They are also ugly if you are checking dozens of strings/fields.However. If instead of relying on "robust" detection of empty strings, you set some rules.Proponents of "StringUtils" will point out that:theString.length() < 1Will result in a null pointer exception if the string is null. Just raise your hand and say, "Strings cannot be null - a null string IS A fatal error. Move on, next.""What if it only contains a space or white-space character?" - Then no, it's not empty. Next.And so on. This is why the industry is struggling back and forth between hard fixed, redefined binary protocols and "free form, semi-structured" data like XML/JSON. Both have pros and cons. The former nips a MASSIVE amount of validation in the bud by heavily containing the contents to definitions. If the underlying messages structure and builders themselves will "null pointer exception" if you put a "null reference" in a string field, then you don't need to validate they are null anywhere else.When you define the problem and solve it on paper or in you head or white boards first, before you hit code face, you can actually remove at least 50% of the code by setting up simple "adminstrative" boundaries and "ways of working". You can embed the functionality into the data itself rather than constantly fight it.However.... if you attempt this in modern day Java, you would be crucified and forced to add the null check or call string utils dependency (100Mb).Similar dumb shiz. "All parameters must be final". I always respond with, "So why does java have a final keyword for params then in the first place?". Then ask them to explain what "final" actually does, which they get wrong 90% of the time. Then I ask them to explain what side effects are and accept that all java code is heavily side effect coupled and most of the core APIs use side effect action.Speaking of which.System.out - wait... what? Is that a public member? OMFG! BURN THEM! BURN THEM!System.getOut()Is that's more what the modern Java man would demand? How DARE the language creators blasphemy the gods of OOP this way!Static? A static getter? Get out!System.getInstance().validateSession( x-> getSecurityContext(x).validateSession().getPrinciple())).getOutstreams().collectAsList().takeFirst();Now we talking.

author: PlainName
author_rank: Super Contributor
timestamp: October 18, 2025 11:28:50 am
content: Now you know why sticking with Windows 7 isn't the death knell the W10+ fans intimate. In fact, they're probably more at risk

author: paulca
author_rank: Super Contributor
timestamp: October 18, 2025 11:43:37 am
content: Quote from: PlainName onYesterdayat 11:28:50 amThe only problem with sticking with an OS from the good old days is that it kinda sets you in stone and basically puts you off line.I wouldn't want to run a Windows7 PC with an internet connection for example. That won't bother me if I have a dedicated and probably expensive bit of pro software on it thats 10 years old, doesn't need an internet connection and so has none.This I fear is the boundary that MCU and firmware developers are beginning to face. "Business" is demanding quick to market, fix it later, disposable trash and so IoT and embedded devices are more and more often coming with Wifi or with base stations with Wifi. This is revealing that "security" hasn't really been high on the list.The believe that "Well, if you have phyical access to the device, it's game over anyway, right?" no longer holds valid when your device is "connected" and holds things like CA Cert keys for web services. There have been actual examples and I have hacked a device myself to access it's self signed key so that I could pretend to be it's update server and flash it with my firmware. Other devices have been found to have the actual valid access tokens for remote webservices saved into EEPROM or flash. With those keys you can access the backend services and it's an open door. Etc. etc.EDIT: This by the way was the "Sky TV DRM hack" used by most pirate box providers. The crypto key that decoded your authentication information was in flash memory. All the pirates needed was to clone a hash/key from a device which was unlikely to loose its auth, like an engineering test key. I got this question in a job interview with the company that made the box. "Do a security review of this product description and a technical evaluation.". I high lighted the vulneribility is that all auth is broadcast 24/7 and all you need is one of the keys to gain that keys service auth.Just look at any leading MCU manu's road map. Look at leading STM32s and how many hardware security and encryption features are being packed in there. I would suggest becoming familar with them. One aspect is providing a way to lock memory from the device itself, requiring remotely fetch keys to unlock it at run time. Allowing manufacturers to disable the device and also prevent memory dumpers from getting at valuable data.The next one is worse to be honest. Internationalisation. Multi-language. Unicode etc. You simple cannot avoid heavy lift frameworks when you get here.

author: PlainName
author_rank: Super Contributor
timestamp: October 18, 2025 12:09:09 pm
content: QuoteI wouldn't want to run ANY Windows PC with adirectinternet connection. But behind a firewall and/or NAT what, exactly, is the problem? Beyond FUD, I mean.

author: paulca
author_rank: Super Contributor
timestamp: October 18, 2025 12:21:37 pm
content: Quote from: PlainName onYesterdayat 12:09:09 pmIt depends on the firewall. If you merely mean a NAT router, ala "Wifi box", then no. That is not enough.If you mean a tight "Deny all" bidirectional layer 3 firewall, aka "Desktop firewall" or "Application firewall", then maybe, if you are strict.Browsers and background processes will be the primary vector of attack. As most people today exist in NAT'd networks attacks have no stopped. They just became more complex. Usually involving silent trojan sleeper agents. Occasionally, when nobody is looking they wake up and notify their master and disappear into obscurity and the clutter. When their master wants them to provide access to your PC they just catch that notification connection and respond to enable access. Not just to your PC, but to thousands like it. It starts working for them and you still have no idea its happening.They are usually not after you or your information, unless it's randsom ware. It will be your computer and its internet connection they want to hack or attack something bigger.Anti-virus, anti-malware, with upto date defs, an upto date browser etc. etc. etc. are a must.

author: PlainName
author_rank: Super Contributor
timestamp: October 18, 2025 12:33:30 pm
content: QuoteSure. The same would apply with any OS or version thereof. But they have to be installed first, and if your processes allow one to be installed on one OS they why wouldn't those same processes allow it for another?

author: paulca
author_rank: Super Contributor
timestamp: October 18, 2025 12:59:53 pm
content: Try installing up to date security software to bring Windows 7 up to the same standard as WIndows 10 or 11. There is where you will find out.Bad people use exploits. They usually select victims based on whether that exploit exists. So older machines become easy to find and detect and there exists online tools to grab IPs of them generally.A bit more "dumb" and not what we are talking about here, but consider "XPCam". An innocent enough device sold in it's millions which enables access to your webcam remotely.Does it have authentication? Possibly, but not by default. Does it have a search engine metadata block with it's application name etc? Yep. Does it allow google bots to search it and list it? Yep. Can you literally google for these wide open to the public webcams and watch them? Yep. Does it automatically ask your router to open and forward a port via UPNP? Yep.All it takes is one USB device or one USB key and it's compromised and the thing is, unless you are running upto date scans and endpoint security ala Windows 10/11 you won't even notice.

author: paulca
author_rank: Super Contributor
timestamp: October 18, 2025 01:04:48 pm
content: Consider installing a Linux distro from a magizine cover disc, circa 2003. Install that today and go on line and you will face some, not all, but some of the issues with browser security and the lack of it back then.The base OS is securer and unless you are running a full multi-user shared server 95% of the vuls are irelevant.However I would still recommend an updated linux distro, even for personal single user use.Javascript in Chrome is natively compiled and executed on the host. It should be noted that on some linux distros chrome must be given elevated permissions so that it can actually sandbox itself into chroot and prevent system level leakage from JS applications. You can actually exploit things like CPU exploits from JS in a web page these days.

author: PlainName
author_rank: Super Contributor
timestamp: October 18, 2025 01:47:39 pm
content: QuoteYep, got a current and constantly updated security software.But... didn't you get the point about recent stuff being far more crap than old stuff because, AI and bloat and all that? If W7 calculator doesn't leak a thing and W11 leaks 32GBdoing nothingthen are you really sure that W11 updates are an improvement?

author: Siwastaja
author_rank: Super Contributor
timestamp: October 18, 2025 03:21:32 pm
content: This discussion is 20 years late, if not more. All of this bad development was already there in 2005 or so. New generation of programmers being taught that adding a lot of layers, frameworks, abstraction, inefficient languages are the silver bullet tomodernandbug-freesoftware development witha little bitof performance penalty whichcan be accepted. It was obvious already back then that we will get more bugs, slower development, andsignificantlyworse performance.I call this computer software crisis and it has been going on very long, I don't see any abrupt change now. Of course recent developments where competence is even less valued than before (see AI) make it even worse. The problem is that we have nowmultiple lost generations. People have completely lost track of what could be useful software development practices and which are detrimental, there is no consensus of any kind.Individual projects can choose wisely, but if you are unable to do everything yourself and need to build a team of software professionals, it is nearly impossible to find capable people to do "Good Old" working and efficient software. Those who can, are very efficient at it. If you don't know any, good luck finding one. Your best bet is ignoring all from formal qualifications or linkedin and only look at young computer enthusiasts / "hackers".

author: brucehoult
author_rank: Super Contributor
timestamp: October 18, 2025 10:06:00 pm
content: Quote from: paulca onYesterdayat 11:16:09 amYeah, it's 10x slower than a raw register write. Because it maps virtual pin numbers to port and bit. Every time.Which means it's what? 2 or 3 µs on an AVR?Sure, that's important if you're trying to push an AVR to its limits, but for many or even most of the things people use Arduinos for it's just completely irrelevant. If you're interacting with a human or doing home control etc then no one notices things less than 10ms. Even doing motor control 1ms is fast. If you're reading analogue values then doing an analogRead() uses about 110µs using the Arduino call, and still maybe 65µs using direct register access at the fastest 200Hz conversion clock (if you want 10 bit counts). Do some logic based on that and its irrelevant whether a resulting digitalWrite() is 3µs or 0.1µs.Using digitalWrite() means you can take your code to any of dozens of different MCUs with zero modifications. That's worth something.