5 ms·

I've been arguing about this for the last three days. Mostly around the reason that "complexity" is not strictly the same thing as "sophistication" when it come

I've been arguing about this for the last three days. Mostly around the reason that "complexity" is not strictly the same thing as "sophistication" when it comes to software. Noobs will conflate the two, but experienced programmers will agree that -- just to illustrate my point -- some code which solves a complex problem in a very clever way while also being very clean and easy to maintain will be considered strictly more sophisticated than some other code solving a similar problem which simply has a higher degree of complexity than the former. There is a subtle difference when it comes to software, and this subtlety needs to be considered in this question. Now, I think Stuxnet is a fantastic suggestion to this question, for a number of reasons: 1) The legal, ethical, technical challenges of creating the software. 2) The ability of the software to remain hidden in (sophisticated) environments rich with (sophisticated) organizations looking for exactly this kind of thing. 3) The stealth of the entire research, design, development, and deployment phases of the project. 4) The highly specialized nature of the target. 5) The scale of the entities involved. 6) All of this sophistication and we can't even see the source code (decompilation doesn't count). This is frankly some impressively sophisticated software. Also, incidentally, the Quora poster's company looks like a fun place to work (with good programmers on the team). Some of his other answers are thoughtful and interesting to read, too, if you get the chance.

omribahumi 8y ago
I want to second this. The things I wrote throughout my career that I'm most proud of aren't very complex. I find it very satisfying to understand a problem so well, up to the point you can find a simple and elegant solution to it. It makes the solution easier to reason about with other team members, and easier for the team to maintain it later. I see this as making your domain expertise available as a framework for the other team members. This is my idea of sophistication in the software development world.
- AmericanChopper 8y ago
  Simplicity is always a sign of a quality solution. I’m not sure why anybody would ever conflate complexity with quality or sophistication. I wrote some very complex code in college, but it wasn’t very high quality.
  - noxToken 8y ago
    To date, my most complex piece of software in terms of how it was implemented was a simple calculator written in my first programming course. About a week before I started it, I had learned about regular expressions (the programming construct, not the formal language construct). The basic implementation was a calculator that could add, sub, mul, div, pow, and sqrt. Bonus points were awarded for adding additional functionality including lettered variables. It started with a relatively clean shunting-yard implementation, but my use of regular expressions quickly fixed that. My calculator worked under most circumstances, but that thing is an eye sore. I'll never get rid of that source code. I like to go back and look a few key pieces of software I've written through the years.
tmoertel 8y ago
Indeed. I think that the mark of sophistication is not complexity but irreducible complexity. Sophisticated solutions are those that have been reduced to their simplest form.
- vertexFarm 8y ago
  I'm wondering why do you think this is true? Using stuxnet as an example, would it not be better if they used every feature within reason that would add to the likelihood of success? Why does reductive elegance make an application of technology superior to an inelegant solution? Does final effectiveness not overrule the developer's aesthetics? I'm asking in honesty, not using the question to merely attack your opinion. I recognize there are things I have probably not considered.
  - hedora 8y ago
    Referring back to my natural gas pipeline example, just install the nasty centrifuge control software at the factory. It is easier and more likely to succeed. Also, stuxnet has now been repurposed by multiple governments and criminal organizations. So, it’s creators built a symmetric capability, and gave it to their adversaries, when they could have used asymmetric capabilities that are more expensive to reproduce. [edit: Also, it is still well within the Iranians’ capabilities to build a bomb, and our recent foreign policy greatly increases the chances that hard liners will take over and restart the program. Contrast this to the outcome of the broader cold world strategy, which was a regime change to a relatively US-friendly government.]
- threatofrain 8y ago
  Irreducible complexity sounds like an incredibly high bar.
Clubber 8y ago
Yes, in my experience, solving a problem / feature well involves three steps: 1. Get the code to work 2. Clean up the code 3. Simplify the code 1 is self explanatory. 2 involves removing any logical redundancy, separating and cleaning the logic into methods, etc. 3 involves simplifying logic and logical mechanisms. Most developers only do step 1 and maybe step 2. Step 3 is where beauty comes in. If I could organize my thoughts around this concept, it would probably make a pretty good article. I don't know who the source is but a good quote goes something like this, "real genius isn't solving the complex, it's solving the complex in a simple way."
- packet_nerd 8y ago
  “Any fool can make something complicated. It takes a genius to make it simple.” I made a poster with this for my office wall.
- thybag 8y ago
  This fits perfectly with my own experience. The 3rd pass is always the one that makes the difference in terms of code that just feels nice/clean.
some_account 8y ago
If you are a state actor, it's not difficult to gather a couple of programmers from the "antivirus" and security field and build something that is hard to detect. It would be impressive if it was the work of a teenager but it's not.
- giancarlostoro 8y ago
  You also somehow need access to the industrial grade target platform in some way shape or form which is not something a teenager has lying around in their room nor extensive knowledge about to this extent.
  - sannee 8y ago
    You can buy the Simatic PLCs they targeted on ebay for a few hundred bucks. Industrial automation stuff like this is a common part of the "technical high school" curricula where I live. (of course only on the "press this button and then that happens" level)
  - packet_nerd 8y ago
    > not something a teenager has lying around Ha, generally true probably, but in my case as a teen I got my hands of a bunch of old industrial PLCs and built all kinds of interesting things in my room. :-) Ladder logic is how I got started programing, I didn't even have my own computer back then.
- a-dub 8y ago
  The SCADA stuff was novel and interesting though and goes above and beyond your average malware both in what it did and the idea to do it in the first place. A really creative hack, so to speak. (or destructive? anti-destructive? shrug)
  - a-dub 8y ago
    And just to reiterate. They built a rootkit that stealthily sabotaged an effort to build nuclear weapons in a way that just made it look like the people who were trying to do it were just incompetent... If that's not cool, I don't know what is...
hedora 8y ago
On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software. In response, the US introduced an integer overflow bug that was uptime dependent, and took something like 6 months to hit. The bug simultaneously cranked up the pumps and closed all the valves in the network. It was known that the Soviet economy would crash in under a year without the ability to cheaply move natural gas, so they couldn’t test long enough to find this. A year or so later, the DoD’s seismographs detected the largest non-nuclear explosion in human history. The main impact wasn’t the explosion or the short-term economic damage. The main impact was that the USSR stopped trusting stolen software, which set them way further back, economically and militarily. Arguably, that ~one line of code was infinitely more sophisticated than stuxnet.
- jespern 8y ago
  Do you have a source for this? I can only find reports from "At the Abyss", which are uncorroborated.
  - gregw2 8y ago
    somewhat described in the book Victory, by Peter Schweizer
- burger_moon 8y ago
  Wow I have never heard this story before! I had to look it up, for anyone else interested here's a quick wiki about it https://en.wikipedia.org/wiki/Siberian_pipeline_sabotage https://en.wikipedia.org/wiki/Siberian_pipeline_sabotage
- Lionsion 8y ago
  > On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software. I think this account might be a bit wrong. The one I read said that the CIA acquired a "shopping list" of Western technology that the USSR wanted to acquire. It included the pipeline control software, so they arranged for a trojaned version to become available to the Soviet shoppers. Apparently this was a pretty common Soviet activity. Their electronics technology was behind the West's, in general. IIRC, many US semiconductor designs has little cartoons on the dies to taunt the Soviet reverse engineers.
johnwbyrd 8y ago
Yeah, you understand exactly what I was trying to convey when I wrote the article. Thanks.

omribahumi 8y ago

I want to second this. The things I wrote throughout my career that I'm most proud of aren't very complex. I find it very satisfying to understand a problem so well, up to the point you can find a simple and elegant solution to it. It makes the solution easier to reason about with other team members, and easier for the team to maintain it later. I see this as making your domain expertise available as a framework for the other team members. This is my idea of sophistication in the software development world.

AmericanChopper 8y ago
Simplicity is always a sign of a quality solution. I’m not sure why anybody would ever conflate complexity with quality or sophistication. I wrote some very complex code in college, but it wasn’t very high quality.
- noxToken 8y ago
  To date, my most complex piece of software in terms of how it was implemented was a simple calculator written in my first programming course. About a week before I started it, I had learned about regular expressions (the programming construct, not the formal language construct). The basic implementation was a calculator that could add, sub, mul, div, pow, and sqrt. Bonus points were awarded for adding additional functionality including lettered variables. It started with a relatively clean shunting-yard implementation, but my use of regular expressions quickly fixed that. My calculator worked under most circumstances, but that thing is an eye sore. I'll never get rid of that source code. I like to go back and look a few key pieces of software I've written through the years.

tmoertel 8y ago

Indeed. I think that the mark of sophistication is not complexity but irreducible complexity. Sophisticated solutions are those that have been reduced to their simplest form.

vertexFarm 8y ago
I'm wondering why do you think this is true? Using stuxnet as an example, would it not be better if they used every feature within reason that would add to the likelihood of success? Why does reductive elegance make an application of technology superior to an inelegant solution? Does final effectiveness not overrule the developer's aesthetics? I'm asking in honesty, not using the question to merely attack your opinion. I recognize there are things I have probably not considered.
- hedora 8y ago
  Referring back to my natural gas pipeline example, just install the nasty centrifuge control software at the factory. It is easier and more likely to succeed. Also, stuxnet has now been repurposed by multiple governments and criminal organizations. So, it’s creators built a symmetric capability, and gave it to their adversaries, when they could have used asymmetric capabilities that are more expensive to reproduce. [edit: Also, it is still well within the Iranians’ capabilities to build a bomb, and our recent foreign policy greatly increases the chances that hard liners will take over and restart the program. Contrast this to the outcome of the broader cold world strategy, which was a regime change to a relatively US-friendly government.]
threatofrain 8y ago
Irreducible complexity sounds like an incredibly high bar.

Clubber 8y ago

Yes, in my experience, solving a problem / feature well involves three steps: 1. Get the code to work 2. Clean up the code 3. Simplify the code 1 is self explanatory. 2 involves removing any logical redundancy, separating and cleaning the logic into methods, etc. 3 involves simplifying logic and logical mechanisms. Most developers only do step 1 and maybe step 2. Step 3 is where beauty comes in. If I could organize my thoughts around this concept, it would probably make a pretty good article. I don't know who the source is but a good quote goes something like this, "real genius isn't solving the complex, it's solving the complex in a simple way."

packet_nerd 8y ago
“Any fool can make something complicated. It takes a genius to make it simple.” I made a poster with this for my office wall.
thybag 8y ago
This fits perfectly with my own experience. The 3rd pass is always the one that makes the difference in terms of code that just feels nice/clean.

some_account 8y ago

If you are a state actor, it's not difficult to gather a couple of programmers from the "antivirus" and security field and build something that is hard to detect. It would be impressive if it was the work of a teenager but it's not.

giancarlostoro 8y ago
You also somehow need access to the industrial grade target platform in some way shape or form which is not something a teenager has lying around in their room nor extensive knowledge about to this extent.
- sannee 8y ago
  You can buy the Simatic PLCs they targeted on ebay for a few hundred bucks. Industrial automation stuff like this is a common part of the "technical high school" curricula where I live. (of course only on the "press this button and then that happens" level)
- packet_nerd 8y ago
  > not something a teenager has lying around Ha, generally true probably, but in my case as a teen I got my hands of a bunch of old industrial PLCs and built all kinds of interesting things in my room. :-) Ladder logic is how I got started programing, I didn't even have my own computer back then.
a-dub 8y ago
The SCADA stuff was novel and interesting though and goes above and beyond your average malware both in what it did and the idea to do it in the first place. A really creative hack, so to speak. (or destructive? anti-destructive? shrug)
- a-dub 8y ago
  And just to reiterate. They built a rootkit that stealthily sabotaged an effort to build nuclear weapons in a way that just made it look like the people who were trying to do it were just incompetent... If that's not cool, I don't know what is...

hedora 8y ago

On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software. In response, the US introduced an integer overflow bug that was uptime dependent, and took something like 6 months to hit. The bug simultaneously cranked up the pumps and closed all the valves in the network. It was known that the Soviet economy would crash in under a year without the ability to cheaply move natural gas, so they couldn’t test long enough to find this. A year or so later, the DoD’s seismographs detected the largest non-nuclear explosion in human history. The main impact wasn’t the explosion or the short-term economic damage. The main impact was that the USSR stopped trusting stolen software, which set them way further back, economically and militarily. Arguably, that ~one line of code was infinitely more sophisticated than stuxnet.

jespern 8y ago
Do you have a source for this? I can only find reports from "At the Abyss", which are uncorroborated.
- gregw2 8y ago
  somewhat described in the book Victory, by Peter Schweizer
burger_moon 8y ago
Wow I have never heard this story before! I had to look it up, for anyone else interested here's a quick wiki about it https://en.wikipedia.org/wiki/Siberian_pipeline_sabotage https://en.wikipedia.org/wiki/Siberian_pipeline_sabotage
Lionsion 8y ago
> On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software. I think this account might be a bit wrong. The one I read said that the CIA acquired a "shopping list" of Western technology that the USSR wanted to acquire. It included the pipeline control software, so they arranged for a trojaned version to become available to the Soviet shoppers. Apparently this was a pretty common Soviet activity. Their electronics technology was behind the West's, in general. IIRC, many US semiconductor designs has little cartoons on the dies to taunt the Soviet reverse engineers.

johnwbyrd 8y ago

Yeah, you understand exactly what I was trying to convey when I wrote the article. Thanks.