4 ms·

Meh. These questions are indeed trivial, but obviously biased towards security — your area of expertise. What makes these questions anywhere close to a compell

by _pius 14y ago

Meh. These questions are indeed trivial, but obviously biased towards security — your area of expertise. What makes these questions anywhere close to a compelling measure of a developer's mathematical knowledge? Seems pretty presumptuous to me.

cperciva 14y ago
These questions are indeed trivial Software development doesn't need a huge amount of mathematics -- but some basic calculus, probability, and statistics, are pretty essential. I debated whether to include the cryptography questions in this section, but I wanted to include them somewhere and this was the most natural arrangement. (I started out by writing about 25 questions, then threw 5 of them out to get a more balanced set, then tried to figure out how to organize them.)
- _pius 14y ago
  I debated whether to include the cryptography questions in this section, but I wanted to include them somewhere and this was the most natural arrangement. Fair enough, but you made some pretty bold statements about what this exam is supposed to measure and I don't think this lives up to it. For instance, I happened to have taken an intro security course taught by Ron Rivest; thus, I know the difference between a MAC and a hash function. But I wouldn't claim that another developer who didn't have exposure to the material was deficient in basic knowledge, anymore than I would make that claim about a security researcher who didn't know the basics of how a support vector machine works. These things are pretty specialized, even if they're not particularly difficult to learn.
  - cperciva 14y ago
    you made some pretty bold statements about what this exam is supposed to measure and I don't think this lives up to it. I believe I said most developers should be able to answer a majority of the questions -- not necessarily every single one. But I do feel that all developers should have some basic knowledge of security, and the difference between hash and MAC is a pretty important thing to know there... as all the people who have been caught using them wrong can testify to.
    - _pius 14y ago
      But I do feel that all developers should have some basic knowledge of security, and the difference between hash and MAC is a pretty important thing to know there... as all the people who have been caught using them wrong can testify to. Touché. :)
- Silhouette 14y ago
  Software development doesn't need a huge amount of mathematics -- but some basic calculus, probability, and statistics, are pretty essential. Sorry, but that's just nonsense. The vast majority of professional software developers could go through an entire career quite happily without any of the above, and no-one would suffer for it. Moreover, those who do programming work in mathematical or security-related domains probably need a much deeper understanding than the kinds of basic information you're testing for here.
  - tzs 14y ago
    You receive a call at 3 AM from someone in the marketing department, asking if there is a problem with the web site because they haven't seen an order in 20 minutes. How do you know if you should get up and investigate or tell them a 20 minute gap at 3 AM is nothing to worry about but call back if it reaches 45 minutes, if you do not know anything about probability and statistics? You are thinking of including 30 days of toll free phone support with your next product, and have calculated that for this to work out financially you will need less than 1% of your customers to call support. How do you figure out from the record of bug discovery and severity in your testing group's bug tracker if your testing program the probability that your product as it stands is good enough to meet that requirement, and how do you determine how confident you should be of that result, if you do not know anything about probability and statistics?
    - Silhouette 14y ago
      You receive a call at 3 AM from someone in the marketing department, asking if there is a problem with the web site because they haven't seen an order in 20 minutes. If you could plausibly go 20 minutes without receiving an order, this isn't a question about statistics, it's a question about PR. Moreover, the kind of place that doesn't take an order more than every few minutes probably doesn't pay someone to be on call at 3am. And what does the marketing department have to do with this? How is that I am running a web site that is important enough to wake me at 3am because someone isn't sure if there's a problem, yet we don't have any operations people who know the normal working of the system well enough to make the call on when something is broken? Like most contrived examples of how "important" statistics is in software development, IME, yours makes no sense when considered in a realistic context. You are thinking of including 30 days of toll free phone support with your next product, and have calculated that for this to work out financially you will need less than 1% of your customers to call support. Again, in any realistic scenario, that little "to work out financially" probably involves far more complicated considerations than some basic probability distribution, and if this choice is being made by a random programmer based on a simplistic model then you're doing it wrong.

by _pius 14y ago

cperciva 14y ago

These questions are indeed trivial Software development doesn't need a huge amount of mathematics -- but some basic calculus, probability, and statistics, are pretty essential. I debated whether to include the cryptography questions in this section, but I wanted to include them somewhere and this was the most natural arrangement. (I started out by writing about 25 questions, then threw 5 of them out to get a more balanced set, then tried to figure out how to organize them.)

_pius 14y ago
I debated whether to include the cryptography questions in this section, but I wanted to include them somewhere and this was the most natural arrangement. Fair enough, but you made some pretty bold statements about what this exam is supposed to measure and I don't think this lives up to it. For instance, I happened to have taken an intro security course taught by Ron Rivest; thus, I know the difference between a MAC and a hash function. But I wouldn't claim that another developer who didn't have exposure to the material was deficient in basic knowledge, anymore than I would make that claim about a security researcher who didn't know the basics of how a support vector machine works. These things are pretty specialized, even if they're not particularly difficult to learn.
- cperciva 14y ago
  you made some pretty bold statements about what this exam is supposed to measure and I don't think this lives up to it. I believe I said most developers should be able to answer a majority of the questions -- not necessarily every single one. But I do feel that all developers should have some basic knowledge of security, and the difference between hash and MAC is a pretty important thing to know there... as all the people who have been caught using them wrong can testify to.
  - _pius 14y ago
    But I do feel that all developers should have some basic knowledge of security, and the difference between hash and MAC is a pretty important thing to know there... as all the people who have been caught using them wrong can testify to. Touché. :)
Silhouette 14y ago
Software development doesn't need a huge amount of mathematics -- but some basic calculus, probability, and statistics, are pretty essential. Sorry, but that's just nonsense. The vast majority of professional software developers could go through an entire career quite happily without any of the above, and no-one would suffer for it. Moreover, those who do programming work in mathematical or security-related domains probably need a much deeper understanding than the kinds of basic information you're testing for here.
- tzs 14y ago
  You receive a call at 3 AM from someone in the marketing department, asking if there is a problem with the web site because they haven't seen an order in 20 minutes. How do you know if you should get up and investigate or tell them a 20 minute gap at 3 AM is nothing to worry about but call back if it reaches 45 minutes, if you do not know anything about probability and statistics? You are thinking of including 30 days of toll free phone support with your next product, and have calculated that for this to work out financially you will need less than 1% of your customers to call support. How do you figure out from the record of bug discovery and severity in your testing group's bug tracker if your testing program the probability that your product as it stands is good enough to meet that requirement, and how do you determine how confident you should be of that result, if you do not know anything about probability and statistics?
  - Silhouette 14y ago
    You receive a call at 3 AM from someone in the marketing department, asking if there is a problem with the web site because they haven't seen an order in 20 minutes. If you could plausibly go 20 minutes without receiving an order, this isn't a question about statistics, it's a question about PR. Moreover, the kind of place that doesn't take an order more than every few minutes probably doesn't pay someone to be on call at 3am. And what does the marketing department have to do with this? How is that I am running a web site that is important enough to wake me at 3am because someone isn't sure if there's a problem, yet we don't have any operations people who know the normal working of the system well enough to make the call on when something is broken? Like most contrived examples of how "important" statistics is in software development, IME, yours makes no sense when considered in a realistic context. You are thinking of including 30 days of toll free phone support with your next product, and have calculated that for this to work out financially you will need less than 1% of your customers to call support. Again, in any realistic scenario, that little "to work out financially" probably involves far more complicated considerations than some basic probability distribution, and if this choice is being made by a random programmer based on a simplistic model then you're doing it wrong.