Uncategorized

Quantum Computers Will Kill the Web as We Know It

cryptographyRecently I’ve been having students play around with some “toy” encryption programs, mostly simple double-Caesar encryptions, which is a good way to learn about text in Java. As with everything I started thinking and reading about encryption, and came to a terrifying realization: encryption for regular people is doomed.

About 25 years ago a coder named Phil Zimmerman invented an algorithm that has become central to the net. It was modestly named Pretty Good Privacy, but it was a method of encryption that was free, usable by pretty much anyone, and almost completely uncrackable by pretty phil_zimmermanmuch anyone, even the US government. It was based on a relatively simple mathematical principle: if you have a factor of two very big prime numbers (where ‘very big’ is at least 40 decimal digits, though for modern implementations more likely 150 or 300 digits) it’s almost impossible find those factors. Specifically, for a regular fast processor it would take millions of years of trials; a huge multi-core supercomputer might get it done in your lifetime but it would take years and the computer couldn’t be doing anything else.

As with so much about info tech it’s easy to forget how revolutionary this was. Before that, really good encryption was only really available to big governments and maybe corporations. I’m not really sure what encryption methods they had; probably they already had a prime-based method similar to PGP, but I don’t know
. Now it was available to everyone in the country, and pretty soon the world as method predictably spread beyond our borders (as Zimmerman, an anti-nuclear activist, certainly intended it to). The US government freaked out almost immediately, and by 1993 Zimmerman was being prosecuted. Zimmerman cpgp-logoleverly published the code as a hardback book, which was indisputably protected by the First Amendment. Later court cases over similar encryption methods established the principle that code is protected by the First as well.

Even if the government had succeeded in prosecuting Zimmerman it would have done nothing to put the genie back into the bottle. The basic algorithm was easy to program and implement by any 220px-edward_snowden-2talented coder, and soon was. Many other encryption algorithms have since been invented using some variation of Zimmerman’s prime number hack. PGP is still around as well; most recently Ed Snowden used a more advanced version of PGP to share his whistleblowing documents with Glenn Greenwald and Laura Poitras as documented in Poitras’ intense documentary Citizen4.

In 1980 physicist Richard Feynman proposed the concept of storing computer data not as ones as zeroes as people had done so far (and still almost entirely do) but as “qubits,” or quantum states of two-state quantum systems. In 1985 David Deutsch speculated in a theoretical paper about using these to make a computer that would solve at least some problems at a speed many many orders of magnitude faster than even the fastest digital machines.

In 1994 Peter Schor proposed a method for factoring large integers using this method in what algorithmic specialists would call “polynomial time,” as opposed to the “exponential time” it currently required. This is an extreme simplification, but to explain the difference between polynomial and exponential time consider a program that has to solve a problem with a “length” of 100 parts. In exponential time the program would have to solve a number of operations equal to 100 to some power, so say 100 to the 5th power, or about 10 billion operations. That’s a big number to us, but an Intel i7 processor that does about 300,000 operations per second could do it in a few hours. Exponential time, by comparison, would mean something like 2 to the power of 100, which is a number with about 30 digits, which the same processor couldn’t finish in the lifetime of our solar system, and possibly the universe. These are completely made-up numbers but hopefully give some sense of the difference.

qubitsLots of progress has been made in quantum computers, but as far as I know, no one has made a quantum computer that can execute Schor’s algorithm in that way. But you can be certain that the NSA and many other intelligence agencies are pouring an enormous amount of resources into solving this problem. In fact, if you were paying attention to the dates you might have noticed that Schor invented his algorithm within about a year of when charges were filed against Zimmerman for publishing PGP, so Schor certainly picked factoring large numbers as a challenging problem for a good reason.

There’s no way to predict technological progress, so no way to know when or even if Schor’s Algorithm will be implementable on a practical level. But likely it will happen. Not everyone will be able to do it. Only people who can afford top-level quantum computers will be able to, which for a long time will only be available to large organizations like governments and big companies. In addition to offering a way to break current cryptography, quantum computers also offer a method of encrypting that can’t be broken by a quantum computer.

In other words, when Shor’s Algorithm can be implemented, we’ll be back where we were before PGP: good crypto will no longer be available for the average user. If the NSA had had this ability when Snowden was communicating with Greenwald and Poitras, they could potentially have decrypted their messages, learned who Snowden was, and arrested him before he escaped the country.

Okay, then, so no more Edward Snowdens; that sounds pretty bad. But it’s not even the start of the problem. In the 25 years since Zimmerman invented his algorithm, the web has become central not only to most people’s lives but also our economy. A huge amount of business is done online, and all of this must be encrypted. You might have noticed that addresses at the beginning of your url bar often begin with ‘https’ instead of ‘http’. This means that your communication with the server is encrypted using the RSA encryption scheme, which depends on uncrackable primes in the same way PGP does. http_insecureIn the early 90s, encryption was for spies and hackers; now it’s essential to every person who uses the net. In fact, Google Chrome will soon warn users that sites using plain http are insecure.

I don’t suppose the NSA has any interest in hacking Amazon to steal my credit card number. But foreign governments might want to, or a criminal organization that has enough money to buy their own quantum computers. No doubt the government will try to criminalize ownership of quantum tech, but it will almost certainly work no better than any other attempts they’ve made to keep a technological genie in the bottle. Currencies like Bitcoin that depend on strong crypto will become worthless, as will the vaunted “blockchains” that every cyber-libertarian is predicting will transform our world.

Furthermore our lives will become entirely transparent to anyone with the money and power to buy the tech to look. And they will certainly exploit this ability. True privacy on the web will become impossible.

Eventually, like all other tech, quantum computers will become affordable to regular people and we will again be able to have really uncrackable crypto. This likely will take at least a decade, and that’s assuming no one tries to prevent it, which governments likely will.

I don’t know what impact this is going to have on our world. But it’s a question not enough people are asking.

Best first “pro” language (part 2 – Javascript)

Javascript LogoThis is part of a series on what is the best first ‘pro’ language, meaning something that’s actually used for professional applications. Last week I talked about Python, this week I’ll attempt to face the monster that Javascript has become.

I’m old enough to remember when people didn’t even really consider Javascript a programming language. They called it a “scripting” language or some other diminutive. To be fair, in those days they weren’t necessarily wrong. In the late 90s and early 2000s when I was in the Web business, Javascript was good for nothing but juggling the HTML Document Object Model. The DOM is the complex framework in the browser the controls the appearance and content of your web page. It’s what gets changed when text changes on a rollover or a menu drops down.

That is what made me think, once, that Javascript was a good first language for all its flaws. One of the challenges of any programming language is getting the students’ work in front of other people in a way they can see what the students have accomplished. Java used to be able to do this with Java Applets that ran on a browser. But Applets are dead as a doornail because Oracle could never deal with the security vulnerabilities they entailed, so browser makers stopped running them. With Javascript, if your students can make a simple rollover or dropdown, you can put it live and tell people to come see it.

But there are serious obstacles to this approach. The main problem is that first the students must learn HTML, Cascading Style Sheets and the Document Object Model. HTML is pretty easy, you can teach them enough to be able to do something useful in a month or two. But CSS and the DOM are convoluted and unpredictable, scarred with the remnants of the late 90s browser wars when the two major browsers roamed the earth with DOMs completely different from the World Wide Web Consortium’s official version, and hapless front-end developers had to kluge their Javascript to deal with all of them at the same time.

For all that it might still be worth it it Javascript was sitting still enough to be able to get students to the point they could do a simplified version of what web front end programmers do today. But real-world Javascript has been transforming itself at a terrifying pace. In a way it no longer makes sense to think of Javascript as a single programming language. It’s more like the flu; just because you could deal with last season’s version, it doesn’t necessarily help you with the next one.

Javascript ModulesEvery few months, it seems, everyone is excited about a new front-end “framework.” Frameworks are new downloadable modules of Javascript and CSS that come up with some (supposedly) better way of handling things in the DOM of various browsers. A few years ago everyone was using jQuery, which isn’t exactly a framework maybe but was an easy way to do a lot of visual things like dropdown menus and more importantly get fresh information from the server without loading a whole new page using AJAX. But Google had developed their own way to do that using a framework called Angular which is based on the Model View Controller web paradigm. At the same time Facebook developed a framework called React that wasn’t made for client-server interactions but which many people consider better than Angular for dealing with events in the user interface. Now Google has made Angular 2 which is very different from Angular.

But there are a million other different approaches and ways to use Javascript, including add-ons that do “polyfills” which trick browsers into using features they don’t have built in, completely different languages like Typescript that “transpile” into Javascript so browsers can run it, the npm module loader and Node.js, which is a version of JS that can be used on the server side where languages like Java, Ruby or Python would normally go. Javascript itself has added new features like returning functions from functions; ECMA16, the new version of JS, has a bunch of entirely new syntax even though it mostly does the same thing the old version does. This post at Hacker News gives an idea of how confusing Javascript is today even for people who used to think they knew it.

None of this is necessarily bad; it may just be Javascript growing up and becoming a mature programming language. But maybe not a safe environment for a learner to be wandering around in. Of course you don’t need to learn Angular or React or Node or whatever to learn Javascript; by itself it can still be a pretty simple language. But if you learn it all by itself you lose the advantages of being able to put your programs in front of the user, and you have to deal with all of the other weaknesses of the language.

And there are a lot.

When Javascript was new it attempted to integrate the then cutting-edge paradigm of coding, which was Object Oriented Programming. This might make you think it had a lot in common with the similarly named Java, but it was an illusion. Java, like any other OOP language, is built around classes which become objects in a program. Javascript doesn’t have classes, it has “prototypes,” which are like classes in the sense that raisins are like chocolate chips in your cookie.

People have been trying to make prototypes more mature so they work like classes (in ECMA16 you can even call them classes, though they’re not really). But along the way everyone got bored and started chasing in the new shiny object in the programming world: functional programming.

I’m just learning pure FP myself (Haskell is the gold standard in the way that Java is the gold standard of OOP), so I can’t say if JS handles FP any better than it handles OOP. But this kind of tacking on is what makes Javascript such a hard language to follow. James Nicoll said of English, “We don’t just borrow words; on occasion, English has pursued other languages down alleyways to beat them unconscious and rifle their pockets for new vocabulary.” This describes the expansion of Javascript perfectly.

Then there is the ugly way that Javascript deals with data types. Some languages, like C or Java, are very strict about declaring what kind of data a variable can hold. Other languages like Python keep that away from the user but behind the scenes still have a good idea of what the data type of a variable is. And when you say x = 10 but you want x to increment by 0.01 you can tell Python to make x a float instead of an Integer.

Number data types in C and JavascriptIf you say x = 10 in Javascript then x’s datatype is…number. As far as JS is concerned x could become 87 billion or 0.0003. But as far as JS is concerned x could become the lyrics of the national anthem or a graphical DOM element. This is very, very far from the way a computer’s memory works, so when a student moves to a language that’s even implicitly typed like Python, let along statically typed like Java, they are going to be in for a terrible shock.

What’s worse is the casual way that JS “converts” one type into another, especially when you compare them, so for example 0 is “equal” to false is “equal” to an empty string is “equal” to undefined. I put “equal” in quotes because they’re not really equal, Javascript just acts like they are. This leads to Javascript’s ridiculous “triple-equals” comparison convention. As you probably know if you’ve done any programming, a double equals (==) is what you use when you want to know if two things are equal, so for example if(a==b){ //some code } means do whatever’s in the curly brackets if a is equal to b. (This is as opposed to “a = b” which assigns a to be whatever b is.) Double equals work in Javascript too, but because of JS’s ridiculous laziness with type conversion, if you want to make sure they are really equal (same value and same type) you have to say if(a===b) . In other words in Javascript (and only Javascript) you have to say “do this if a is equal to b, but I mean really equal!”

I’m not saying (here at least) that Javascript is a terrible language, but I am saying that Javascript is a terrible first language, with a few exceptions. Khan Academy’s Intro to JS is a good way to get kids’ feet wet with a programming language where they actually have to type the commands. In fact what they will be learning is Processing, a useful beginner programming language, but since this is another example of “do things in the little window by the code,” it does not count as a ‘pro’ language in the sense I’m using it here.

The other reason you might want to teach students JS is if you actually want them to build interactive web pages. In this case first teach students HTML and CSS together (start with CSS right away; in 2016 there is no use at all in teaching simple HTML with no styles). This should go on for about six months or so. At that point they’ll be ready to start manipulating the DOM in simple ways with JS.

Otherwise, let them learn JS when they have learned another language first.

NetBeans: the Missing Step in Coding Education?

NetBeans LogoI’ve been talking about the need for a tool to transition from “move things around the little window by the code” teaching tools like Scratch, Khan Academy coding and Greenfoot. These are all great ways to start kids coding, but they are walled-off playgrounds with no connection to the outside world or even the rest of the computer you’re working on. Is there an accessible tool that allows students to easily do visually interesting things but also gives them access to code that can read and write files, create and connect to databases, and get data off the internet? And then I thought, what was that Java IDE that Sun made back in the 90s with a form builder, is that still around? And so I found myself at Netbeans.org.

Old AOL ScreenNetbeans is anything but a new tool; at 20 or so years old it’s practically geriatric by tech standards. When Netbeans came out Yahoo was the exciting new search engine, Mark Zuckerberg was a working on a media player as a high school project and a large percentage of internet sessions began with loud scratchy modem handshakes to AOL. I feared finding a neglected and forgotten product today, but Netbeans is quite up to date; the standard download comes with JDK 8 and tools for creating pages in Swing or JavaFX, the newer user interface module.
Don’t get me wrong; to do anything in NetBeans you have to know Java. So how does it help? The main way is that it makes creating user interfaces with Swing ridiculously easy using the forms design. To make a window you just select-click on your project, choose new and then choose JFrame form. You’ll see the window in the design view, and to your right you have a bunch of different UI elements like text boxes,  buttons, checkboxes and so on that you can drag and drop right on your frame.

Programming the UI is equally easy. To make an event listener for an element (that’s the code that happens when the button’s clicked or element’s changed or whatever), just double click on the element. You’ll be right UI elementsin the event listener class, so you can just write the code you want it to perform. (You can see more details in my first NetBeans lesson on my YouTube channel).

As I said, you’ll still have to know Java to do actually make the code in the listener, but with NetBeans your students can focus entirely on what they want their code to do rather than dealing with the the clunky Swing UI code or remembering the difference between addGroup() or addContainerGap().

But wait there’s more! NetBeans also makes it easy to create an Entity Class from Database. That means if you have a database connection you can easily make the students connect and start doing SQL commands with Java. It also allows you to create a Web Service Client. I’m not saying either of these are things kids could figure out on their own, but if you do the heavy lifting on the backend you can have kids do some serious programming with data that is not in a little box by the code window.

Apache LogoAfter I got excited about this, I immediately discovered that Oracle is planning on turning NB over to the Apache foundation as an open source project, and a sinking feeling filled my gut. I had experienced something similar before, when I got excited about teaching Microsoft’s fabulous XNA gaming platform in C# right before Microsoft dropped it like a used wad of gum. XNA became Monogame, but at least at the time Monogame was not what XNA had been. So I know well enough that “it’s becoming an open source project” is often the software industry’s equivalent of your parents telling you “the dog is on a beautiful farm where he can run and play all day.”

But Apache is not just any open source foundation; they are behind the most popular *NIX web server and Mozilla one of the most popular browsers – which you may well be viewing this page on – among many other projects like the Thunderbird mail app.

Even more encouraging was the thriving community of NetBeans developers I’ve discovered on Twitter. According to the NetBeans team there are more than a million users of NetBeans today, meaning a lot of commitment to keeping it alive and thriving. I wonder if these people realize NB’s potential as a learning tool for younger students?

I’m not going to get into the debate over whether NetBeans is better than Eclipse. Clearly some developers feel it is, but many more prefer the great purple circle (or one of the other popular IDEs like IntelliJ), and Eclipse may indeed be better for a commercial EE developer. For new students, however, it’s extremely intimidating with not a lot of handholds and no help with sorting out a parallelGroup from a sequentialGroup or a verticalGroup when you’re making a UI.

I’m experimenting now with NB as a teaching tool for students as young as 8th graders. I’ll continue to keep the blog up to date on how it works, and be sure to check out my NetBeans playlist on YouTube as it grows.

Teaching coding: The missing steps

It seems like every day someone is introducing a new tool to get kids into coding. Just recently Apple introduced their Swift Playground, with animations of kids making a weird pear-shaped blob thing move around a 3D world. We have the now-venerable Scratch, and Scratch Jr. for the really little kids, we have Hopscotch, we have the Hour of Code, we have Khan Academy coding and new tools that allow kids to program robots with Scratch-like code chunks. So that means that this generation should produce a huge new batch of computer-literate coders, right?

Missing Steps
Some steps are missing

Alas, probably not. I’m glad these first steps to coding are there, and they are essential. We also have plenty of steps higher up the mountain where adults, college-age kids or particularly motivated high-schoolers can learn more advanced coding: places like Udacity, Coursera, Pluralsight, Code School and so on. What we lack now is the tools, and maybe more importantly the teachers, to get people from these lower steps to the higher ones. It’s like staircase with the middle twenty steps replace by ropes and those wall-knob attachments from rock-climbing gyms. Some people will still get to the higher steps, but not many. Most will get to the top of the bottom row of steps, look around and say “that was fun, I made the robot move and turn; I wonder what we’re doing in art?”

But that’s fine, right? So most kids don’t go on and learn about networking. That’s advanced computer stuff! It’s not like every single computer is attached to some giant computer netw…oh.

Today we’re surrounded by computers, but unlike even ten or fifteen years ago, almost none of those computers does anything by itself!

Even applications that were once entirely local, like Microsoft Office or the Adobe Creative Cloud projects now depend on regular network connections. Remember the last time you were in a coffee shop and the WiFi didn’t work? I bet you didn’t get much done. You probably just put your computer away and got a book out or interacted with actual humans. Almost all computer work today involves having to download something from somewhere or look something up on Google. Even games are networked more often than not.

And it’s just going to get worse. More and more services are moving to the cloud; lots of organizations don’t even use Office anymore in exchange for Google Drive. More and more jobs involve getting complex data from a big cloud using APIs. And when the Internet of Things blows up, even your toaster will have an API.

Move the things around the little screen
Code can do ANYTHING!…in that window

But the programs the kids are learning to do, even a fairly advanced learning environment like Greenfoot that uses actual Java and begins to teach kids about objects and classes, all basically involve moving little shapes around a little screen on the side of the code. And sure sometimes you can blow the little screen up to your full screen, but it’s still a cozy little sandbox that has no contact with the rest of the world, unlike pretty much every other app they interact with.

I’m not saying there is anything wrong with these programs! I use many of them in my teaching. But there are very few places to go now when a kid is ready to get outside of that sandbox. Sure they can start learning Python, and if they’re patient they’ll stick with writing console apps for a month or two until they are able to start using PyGame and make some graphics. They can get into physical computing and start learning Arduino if they have the electronics gear and other hardware to make it possible. But as I mentioned, most Arduino programs (of the sorts most kids do) are actually very simple.

What is needed are tools that make it easy for kids to make simple network requests and access simple databases, tools that take some of the hard parts out (like making complicated database connection strings or working out complex network handshakes), while allowing kids to do the part that’s actually not that hard.

And the ideas aren’t that hard! SQL queries like “SELECT temperature FROM WeatherDatabase WHERE year>1990” or adding parameters to an http query like “?field=accidents&city=Omaha” are not that hard to to understand even for a middle schooler. But getting to the point where you can do that is. For now. It’s time for a tool to change that.

 

 

Why doesn’t Google Classroom put my class times on my calendar?

How classroom should work

Google Classroom is awesome, and I use it a lot. I know it’s not for everything; I don’t expect it to have things like places for unit plans or a gradebook, at least not yet. BUT why can I not put in a time that my class meets, and have it put that on my calendar with the students’ names included in the invite section, and put it on the kids’ calendar too? This would be a trivial thing to add as it uses functionality Google already has, but for some reason they didn’t do it.