Showing posts with label geek hater. Show all posts
Showing posts with label geek hater. Show all posts

How free software has come to sux ?

 I remember free software used to be fun and local. I would say like peasantly pleasant.

We were amazed by how much it would make our « old computers » raise from the dead whereas bros with expensive hardware were stuck with a huge learning curve to do in years what we could do fast.

In my years of coding I learnt one thing : the importance of not building frameworks, but to focus on solving small problem fast and, eventually to draw.


or
  	
#!/usr/bin/bash
chr() { [[ $1 == 0 ]] && echo -n \0 || printf \\$(printf '%03o' $1) ; }
W=$( cut -d "," -f 1 /sys/class/graphics/fb0/virtual_size )
H=$( cut -d "," -f 2 /sys/class/graphics/fb0/virtual_size )
S=$(( $( cat /sys/class/graphics/fb0/stride ) / $W ))

echo -n $( chr 65 )
echo $( chr 80 )
die() { 
    echo "$@";
    exit 1;
}
[[ "$S" == 4 ]] || die "ça va pas marcher"

for ((y=0;y<H;y++)); do
    for ((x=0;x<W;x++)); do
        echo -n $( chr $(( x % 255)) )$( chr $(( y%255)) )$( chr $(( ( x + y ) % 255 )) )$( chr 255)
    done;
done

Resulting in this
result of drawing in bash on a fb

I always loved the fact that if you focus on doing something with all the tools you have and have no « religion » you can go fast on linux, hacking like a brute your way to a result in very few "lines of code".

I used to be a perl monger, go to linux user group, and computing was funnier when it was making relationships between users and without ... gatekeeping.

I do blame linux and the notoriety brought to free software by big corporation to be the problem. Most big companies loves free code and are lousy contributors on more than one level.

But, well, the real matter is not the strength of the companies but the weakness of the community.

First of all, what is the community made of today ?

People craving for fame. Because most free software are poors, while a few one get all the bucks.

If we don't discuss the awesome contributors begging for money to do great work while some incompetent know all but do nothing are living in luxury we are missing something here.

There is a struggle in this community that revolves about gatekeeping and gaslighting. It pretty obvious to me now, that the great offenders are the same responsible  for toxicity in information technology : the bro coders.

There are not only the shiny brod dudes of web3.0 and crypto shit, they are also and most often the well educated from the Ivy League and university alike. They made a hell of the community by imposing their standards.

Coding and getting the job done is not what matters nowadays. It is mostly how you dissert on it, present it, make it available to the community. Free software as become as flawed as public research. People don't want to share their work, they want the fame of being noticed, even project that are already famous steal other people's code without attributing the paternity. I am very disturbed when I check on a python binding on libmagick to discover the « guenine code » from the libmacick python module is posterior to another one, with a different licence, and no attribution. It actually sickens me to see a project already famous doing that to a small contributor doing its job correctly.

I do not count the number of time like in the log4j case coders that are never supported are bullied into working for free and almost insulted. That's the day I am so fucking glad I am not notorious enough to have my code used. People seem to think they have a right to not care of developers state poverty and boss them around for their selfish interests of shining in their own organization.

Well, fuck you the wealthy stinky guys.

Also, you see, I don't like ALL major geeky news website doing a ban on political or polemic topic. There should be a lot of discussion about political outcome of computer usage.

From what is the actual contribution to climate change of our use of computers and the infrastructure they require (electricity does not come magically) to bias in dataset that are then propagated in the software learning from them, to the danger of creating databases of people with their location, sex, age, political opinions and addresses. We could also the discuss the unfair share of value being distributed to the persons actually doing the code in free software community to the one making money out of it. I am not here to actually talk about this, I do rant against the fact we tabooed any political discussions in computer related field for the sake of « avoiding conflicts », and it is making me uneasy. Because, this is only what people profiting from exploitation and bullying do. Hence, we see here a troubling pattern of free software having structured itself in pyramidal structures (fundations, projects) and borrowing all the bad behaviours of clergymen.

First free software has a huge problem of cult of personality. We see the community worthy only for those who are succeeding and present them like stars. Except for events like FOSDEM that are still better.

But, there has been a trending concern of religious like evangelism with technology. If crypto-scam comes into mind, languages, frameworks, « one best ways » of structuring a project comes into mind.

What I call religious is trying to impose views and brushing aside all polemics. Rust community comes to my mind has a language that seems interesting to learn but which community is so painfully arrogant I don't want to code in that language.

I do code in python, but since it structured itself in an elitist community with actually awesome core developers it has become also quite tough to talk to them.

There is like a sectarist way of getting your contributions being accepted. Since all this people are PhD at least you have to use their language and their « commonly accepted wisdom » are non disputable. They refuse critics too and are driving people not breathing with python in disputable death marches.

Among them were the python3, the asyncio death march that I fearly doubt will result in an outstanding improvement in regard to the effort poured by maintainer, the religion of typing.

But, you hear no one complain. And that's what bugs me the most. Coders at the bottom of the pyramid not endure this shit without complaining, they even seems to accept more shit further.

Like our platforms for collaborating have always been a pain in the ass since sourceforge (the old github) and savannah (the old gitlab). Being a sysadmin I hate installing these tools and maintaining them. The tools for ticketing, documentation, peer reviews, interacting online have had a phenomenal bloat in complexity and death by a one thousand cut of attention sucking and ritualisation. I would even in all fairness command line use of git.

Very few in the community seem to think an actual static website with a few doc, an email and tarballs is an acceptable way of sharing code anymore in our modern days. We all have industrial standards for our projects to help the companies rip off our values better so they don't have to adapt to us.

Hence we face a dilemna : either we spend money we don't have in hosting our own tools to be independent and relieve ourselves of the toxic IT like openBSD hermits or we use their tools that puts on us an overload of administrative tasks that are infuriating.

We are buying a world of « one best ways » by convenience. But this « one best way » is often a forced point of view that is based solely on the point of view of elitist cunts that often come out of bias on the « best way to work and having no fun ». Yep, Free Software has been depleted of fun by trying to prove something, like it's where we craft the best tools, and that's when we enter competition that we forget cooperation and cease to be a caring community.

At one point, all the mass of funding in free software is allocated on fame, because some idiots don't actually believe in the community but the « bests among us ». I won't paste the xkcd dependency referring to internet depending on imageMagick being maintained by an obscure one man army in nebraska since 2003 but it pretty much highlight the problem. The fairest way of solving the growing fragility of free software supply chain and dependency would be to ensure ALL humanity has decent wages and enough time for hobbies without distinction of birth, sex, religion, origin, countries, but funnily enough most free software coders I know are ferociously more anti unionist and anything that is close to a society where wealth is shared than the average joe.

I know how it is gonna ends up very soon : with the recession coming, the « great depression » and possibly an internet bubble explosion the mental health of most precarious maintainers and benevolent is gonna be sucked dry. The only sectors that are gonna still pay are organized crime. The acceptable one called government, and the more shady ones relying on scamming the vulnerable ones.

Once out of the keyboard world all this free time spent cut from their local communities and building « real world » skills will leave former free software contributors on the pavement like decaying useless turds with depression.

They will be all the more depressed then they will discover computers prevent us from buying actual reliable production goods. There is a computer with pig coded software everywhere that is brittle that replaced almost all appliance. Even fucking ovens. And we cannot fix them, because by listening to the idiots of « the ARM/USB/IEEE XXXX/ISO/ANSI/W3C/(put any language, platform, cloudish idiocy, framework or OS here)/ is the one best way, », we are cornering ourselves in a world where if you don't have money and comprehension and possession of an outstanding range of hardware equipment and tools we are driven away from even the most trivial hardware manipulation with a computer.

We have basically by denying ourselves the right to be free and raise our concerns helped to build a future in which the skills we honeyed are gonna be useless and we are gonna be powerless.

Diversity matters, but not the one of displaying pictures with blue, yellow, short or tall humans. The real diversity in a community is the social diversity. And since well educated with good intentions took over the playfield of free software ideologically, technically, economically and in public influence, it had become a dystopian aristocratic orwellian nightmare.

The inertia is such I don't believe the tendency will curb any time soon. But, in my new life out of this community I learned to not make the same mistakes again.

First I went back to coding, but only for fun. And I discovered the interesting code for companies has to be boring to use and create. Like confined (github) which basically is a research on how to do a « safe eval » templating language.

Well, no for, no while, no goto, no function, no access to file or hardware, memory, boring binary coded decimal that are harder to use than float an int. You only have a stack to work with and limited number of cycles, limited stack, limited string size. I think I will stop there, because it is not the language I want to build for my daughter to learn computer programming. Fun is inherently unsafe. So I will probably build a new toy forth like uxn forth. Forth are really easy to make into a language.

Secondly, I discovered it is actually faster to have a result in rushing like a boar. Coding requires focus. Our modern tools and ritual of doing stuff the « one best way » (including, CI, tests, docs, trying to gate fame/attentions/recognition) perturbs our precious focus. 

Once you are focused you rediscover the pleasure of getting things done and working. You even achieve results better than the one you envision you could, and it is often by not « following the one best way ». For the fun I installed prompt_toolkit which is a very complete framework for doing command line utility, but I soon discovered I was best done hacking an history saving manually than using there most complete solution. Dependencies are not a problem of creating a weakness and sucking 20 times your code size in dependency for a luxury, they also suck you in a mindset that can conflict with yours that is often your actual best tool at hand.

Lastly by attacking problems that I was told were too complex to be done correctly without using a framework, I discovered that our foundations are more than questionable, often because of aggregated layers of conservatism called necessary progresses crusted in all our full stack from the hardware up to the languages. I am even more and more convinced we should have a talk about unicode, integers and floats, documents, files and the utility of cryptography (except for ssh). All these solutions rose often from brilliant mind having maybe solved the wrong problem and half knowledgeable people being persistent (because money matters) and famous enough  to not only built them but forced their adoptions. This cult of personality that bloats the software world is the same as the one in the real world, at one point. And if it basically destroyed the « virtual » community, it destroys the real world in the same way. I got rid of my « impostor syndrome » by forgetting my ego, and rejecting trying to be a member of a community which values I don't recognize anymore as welcoming (except maybe BSD communities that are a different bunch even in real life and the only one I still frequent).

My final thought is that it is weird that by becoming bigger and valuating so much personal achievement, we have actually destroyed what made communities interesting : ourselves, selfishly. Because when you dilute yourself in the « one best way » of doing progress you actually lose your originality which makes you an interesting asset to the community. You don't need to shine, or be famous to be an asset. You just need to enjoy and have fun not fulfilling the greedy needs of foreigners who don't care, but sometimes you, your family and friends with small improvements. We have lost the sense of helping trivially. I do long for the community computer club were people from all ages and background would gather in a crappy community room to crack games exchange the cheat codes, try to repair old stuffs, help with installing the dreadful printer, experiment, assist others in beginning to code in assembly, solder to replace a burnt condensator...

Oh, I really miss it, and I checked google, according to it there is not a single one in my half a million inhabitant city except in the « MIT » and « oxbridge » like places near me where you guessed I won't set a foot and meet the toxic bros of higher education.


It's time to speak about free software culture, again.

People may not have experienced the beginning of free software as a social movement.

Before agile was cool, corporate process for doing software were uncool, and HR policies more than questionable.

There was already a faint smell of bullshit for new comers to computer programming. Especially for self taught that were kind of barred from IT jobs or operators. IT in the 90's was not judging on what you could do but on your social status (often diplomas).

Free software was not only a promise to free software but also to free human beings, including workers from a dysfunctional selection process.

What were we hoping ?

To invest the max we could in developing useful software that would be both useful, and done in a free from constraints of the corporate religious rituals, and prove ourselves without stupid barrier.

An ftp server, an announce of a new release on the mailing list and you had your new linux kernel.

The muscles of free software were in the code, the fat of procedures adapted over time.

Hence coders could build a portfolio or products, the possibility to fight perceived cronyism in coders' selection by proving their merits. That was the selfish part of the newcomers. Needless to say another part of free software was coming from academic field having a tradition of «mandarinat» where we could find the most notable proponent and evangelist of free software (FSF for instance).

I dare say the coder seeking to free themselves have been slowly pushed away from free software by the holy alliance of an academic based aristocracy and crony capitalism.

Free software events at this time had few sponsors, talks were giving room to talk to everyone.
I assisted to conferences whose speakers were plagued with heavy stuttering without slides, topics on discrimination in free software (notably against women in ~2005 following debian women awareness campaign), the use of i18n frameworks to promote diversity in culture (like having GUI translated in innu, basque, allemanic, esperanto ...)

And I think the zenith of my engagement in free software was in 2005
https://www.libroscope.org/Le-libre-au-dela-du-logiciel in Dijon when I co-organized a topic on free software in the context of the coders and the freedom we were expecting from it.

Since then, FOSS events are looking more and more like infomercials, big sponsors having more slots to evangelize their technologies, and free software has been colonized in some fields by researchers. Local meetup are mostly ads for BullShit techs and products under the disguise of friendly meetups.

I may not be the smartest guy, but I doubt that implementing a text of Plato as a base of an algorithm for eventual distributed consistency is the best way ; it lacks what makes powerful ideas : simplicity. Paxos strikes me as a weird idea when we have algorithms for making collaborative text pad with pretty straightforward data structures that don't require vector clock and which are proven O(n).

You see, we forgot one fundamental freedom of free software that is now taken away from us : the freedom of researching & inventing thus having our invention recognized : Open Science ! With an equal footing with the official provider of research/patent (in form of academic papers and corporate patents).

Science and technologies should be based on evidence first that we can make stuffs works and not our capacity to formalize it or having access to cooped media or bureau of legal depot. We should be free to use the method we want as long as they are opened to discuss our points the way we chose.

So I have some biff with academics. But not only.

IT industry may not care about your diplomas, but they care about which school you attended where you made your business network. Most of "degree less" examples of SV are phony. Gates, Jobs, Zuckerberg, H&P, google may not have had diplomas, but they had the network with the wealthiest bros from the USA. The very exclusive business network formed from the ivy league (MIT, Stanford...). The solid castle of the social reproduction of the elite in USA. Same here in France where your capacity to evolve towards having certain jobs (coding being one of them) is terribly skewed in favor of the local ivy league.

How this discrimination operate ?

At a non measurable level, by imposing a way to behave, to talk and a formalism hard to grasp. CoC has even become one of them ironically while I do support this idea.

Most of you ignore that the formalism used in math nowadays in science (hence CS) is the famous object of the rant «cargo cult» science by Feynman. Long story short ~1968 US mathematicians fell in love with bourbaki (mathématiques mordernes) and as in France imposed this formalism as the «only one best way» cause it was a promise to be able to verify correctness of everything (and blablabla). Needless to say, I think a formalism should not be about it's mathematical self contained beauty, but about its capacity to deliver simply a consistent message on how to deal with a tool.

For instance, if I give you the RFC2822 compliant 300 lines regular expressions to validate an email, you will know way less practical information and will understand nothing of mails for the exact same magnitude of informational entropy than with a RFC. Reading the RFC SHOULD even convince you that a regex is the wrong way to validate an email.

That's where the IT bugs me. RFC were a marvel of openness having the first RFC telling you how to read and write RFC in a simple language. RFC are about formalism, but the level of entry for RFC vs regex is way less. Hence, we can say there are hierarchy of formal vessels of information and the one that is being banned is the most expressive one : the simple language. (Modern RFC are hellishly complex to read JSON Web Token, Oauth2....).

The formalism of CS papers is like the regexp of formal logic.

I think this commit in python was a brilliant illustration of a subset of this problem :
Instead of requiring that comments be written in Strunk & White Standard English, require instead that English-language comments be clear and easily understandable by other English speakers. This accomplishes the same goal without alienating or putting up barriers for people (especially people of color) whose native dialect of English is not Standard English. This change is a simple way to correct that while maintaining the original intent of the requirement. This change also makes the requirement more clear to people who are not familiar with Strunk & White, since for programmers, the main relevant aspect of that standard is "be clear and concise;" simply saying that instead of referencing Strunk & White communicates this more effectively.

https://github.com/python/peps/pull/1470

And the comments plus the polemic proved this commit right. Including french eminent member of the evangelization of free software stating that this arbitrary grammar (nazi) barrier is legtimate.

Where does it lead us ?

Somme fellow free software coders are still fighting for the radical non discrimination aspect in free software, and that is great.

On the other hand there is a pattern on the way IT is talking about free software. We have a bunch of elites feeling self entitled to rule it.

Companies tries to out-source their code, recruitment process and formation to free software making their costs supported by the free software contributors whose bright future in being underpaid workers induces perverse incentive to gain fame. Yes I have a special tooth against npm bowl of muddy dependencies.

In HR, our github are now used against us ; a fall in our commits may mean we have depression, and we are not hired. But why some of us are on burnout ? Maybe they are being harassed by wealthy companies that relies on their code and press them to fix fast or merge a PR their soft, or by the overhead of work of bureaucracy to "sell your idea" to a steering comity that demand a peculiar document.

How much the mendacity on the internet helps to increase the well beings of grunt coders ? The top 1% is not even earning 30k$ yearly with the begging on internet. Universal Income would sure make free software non famous contributors (90% of them) wealthier  working 100% of the time they want on their software !

People push free developers to take care of more of the jobs including standardizing their tools to adapt to the workflow of said companies. A one best way to handle your repository with github-clones appeared as if git was the most productive choice given the cli is a mess of inconsistency.

This is not freedom.

The biggest part of a free software to be legitimate now requires :
-  a cool web page with links to resources ;
- an issue tracker ;
- CI ...
- nicely formatted pompous documentation ;
- versionized source browsing ;
- preferred language based distribution (pypi for python for instance) ;
- maybe distro based packaging ;
- docker based distribution ;
- k8s based distribution ;
- badges (CI, static analysis, bling bling) ;
And believe me this is time consuming. And once in a while something changes upstream (setuptools? language version like py2to3 or asyncio) forcing you a big gulp of accidental difficulties and wasted time to correct all the nice façades.

I think something is wrong in free software ; I would say some adhere to a myth of meritocracy that never was in the first place (first geeks had access to very expensive computers for the era and free time) that is detrimental to them.

Selling that doing free software can impress companies with your competitive abilities in a rigged competition is a SCAM, don't do free software expecting anything.

Free software (or open source) is indeed very welcoming to users. But, not that welcoming to active contributors who nowadays are discriminated. One thing is we -won't hide our face- technical excellence has been an excuse for being a jerk (linus torvalds does not comes first in the list) and still is. So called technical excellence is a religion to transform a past of privilege in a position of unchallengeable leadership.

Today a patch may be refused while algorithmically correct and documented for the following reasons :
- coding style ;
- not using a java design pattern (even in python or javascript, lol) ;
- using functions instead of objects (whereas they are equivalent) or whatever paradigm ;
- relying on system (sig handler + SIGHUP to reload a conf) rather than using a system facility (systemd) ;
- the phrasing of the patch ;
- the mood of the maintainers ;
- your fame (or lack of) ;
- your capacity to write overly bloated pretentious specifications to explain your idea backed by a lot of cryptic CS papers
....
But shouldn't be the language and OS the best judge of the quality of a software ? The heaviest difficulties in contributing do not come from the nature of computers, but from arbitrary cultural human rituals.

My advice is thus for those who are not comfortable to deal with hypocrites assholes from upper classes or the crony elitism of academic research to minimize your contributions to free software. This people are a toxic bunch of reactionary favoured kids that saw a business opportunity in an interesting social movement of protest against their legitimacy.

And for one thing I will let no one claim to speak in our names. If you belong to a community, you have a voice equal in strength with the other ones. And my words are : I don't have anymore respect for the free software community that has become exactly the opposite of what I contributed for : a bully free place of radical non discrimination.

Les travers du recrutement en informatique en France analysés à coup de #BigData

Attention dyslexie inside.

En introduction, et c'est de l'impertinence que j'assume d'après toutes les offres de big data (analyse de données) je ne suis pas suffisamment qualifié pour en parler.

Mon tort ? Mon titre de Maître es Science Physique (appliquées) qui ne vaut pas tripette contre une école de commerce option marketing et bullshit.

Je vais me permettre de mettre mes génitaux sur la table : quand on a travaillé en labo et été cité dans des publications scientifiques pour avoir permis de réduire le résultats de milliers d'expériences contenant des milliers de points à une valeur physique unique alors on est compétente en Big Data.

Maintenant que c'est fait, il est temps de l'étayer en démontrant par les faits que c'est le cas.

Qu'est ce que le Big Data ?


Un mot vide de sens supposé indiquer la capacité à traité de gros corpus de données et à en retirer des informations pertinentes. 2, 3 au max compréhensibles dans la langue de tous.


Derrière toute analyses de situation il y a une motivation à trouver une solution, à quoi ?

A la suite du suicide par overdose d'un ami connu en web agency, je suis dans une quête depuis 6 ans pour trouver un emploi loin de la culture informatique que je soupçonnais d'être toxique (sans pouvoir mettre le doigt dessus). J'ai fait un burnout à mon dernier boulot (GIP FUN-MOOC) suite à du cyber-harcèlement sur le github publique de l'entreprise.

La chose que j'ai donc recherché consistait à filtrer les offres de Pole Emploi afin d'éliminer tout ce qui pouvait être toxique sans savoir ce qui l'était.

J'avais un autre soucis : aider ma femme à m'aider or le plus gros problème rencontré avant même de qualifier les milliers d'offres par jour consistait à :
  • éliminer celles déjà vues ;
  • éliminer celles dont les contenus ne correspondait pas aux mots clés voulus ;
  • éliminer les intermédiaires postant sur pole emploi en faisant croire à un contrat final.
Si au départ je pensais faire une analyse textuelle, il se trouve que la plus grosse partie de mon travail  a consisté à dédoublonner les offres.

Imaginons que je me connecte à pole emploi, que je recherche un boulot de "data scientist" ou développeur python.

  • Je vais avoir très souvent des offres PHP, java ou autres sans rapport avec mes compétences ;
  • Je vais me voir reproposer très souvent des offres déjà vues.
Peut on quantifier très souvent ? 99.9%

Peut on quantifier impertinent ? 99%

On a un facteur de signal/bruit de 1/1000000

Est-ce terminé pour autant ?

Non la plupart des offres sont mal qualifiées.

Pour ajouter l'humiliation à l'injure le site de pole emploi est très peu ergonomique.

Certains vont me dire : il y a une API. Je vais être brutalement honnête : cette API est à chier pour 3 raisons.
  1. Elle ne dédoublonne pas ;
  2. par expérience de 15 ans de programmation toute documentation mal écrites dans la langue du pays est à chier. La documentation de l'API pole emploi est en franglais. Je parle bien anglais et français, je conchie le franglais ;
  3. la partie récupération d'une clé d'API est d'une lourdeur bureaucratique crasse.
Donc, j'ai fait ce que j'ai toujours fait ; ce qu'on appelle un aspirateur à site web : un programme qui récupère les pages de pole emploi et les offres associées si besoin.

Code source du script python

Il est moche ; j'ai pas l'intention de chercher du turbin toute ma vie, c'est un script jetable en mode chez moi ça marche.

Au fur et à mesure de son utilisation je me suis aperçu que la fonction principale du script consistait à ne plus me remontrer les offres que j'ai déjà vu. C'est comme ça que je peux estimer le ratio de bruit sur le site de pole emploi.

Ce qui veut aussi dire, sachant que je stocke localement les offres et les résultats de mes recherches que mon aspirateur d'offre économise à PE (pole emploi) énormément de bande passante.

Dans toutes les offres bigData la maîtrise de base de données permettant de gérer des milliards d'entrées est exigée. J'utilise mon disque dur et ma mémoire : en dédoublonnant, pour un mois de recherche, je n'ai que 3000 entrées sur disque pour la moitié de la France malgré supputativement d'après le site PE largement plus d'offres disponibles. Évidemment que je pourrais les utiliser, mais j'ai autre chose à faire qu'installer une grappe de 5 serveurs de base de données quand les 8Go de mon PC suffisente et que j'ai pas la maille pour me payer 5 serveurs et le temps pour faire sysadmin en même temps, je dois aussi jouer avec ma fille !

Voilà ça c'est pour la partie criblage : en retirant le bruit du signal (redites) on peut transformer un problème de big data en medium data avec 2 ordres de grandeurs (/1000).

Ensuite, attaquons la pertinence.

J'en avais ras le cul d'expliquer à ma femme que non quand les offres étaient "BAC+5 ou école de commerce ou niveau équivalent" ça voulait dire "universitaires allez vous faire voir". Elle me disait, mais à ton âge que ce soit au Québec (où nous avons vécu) ou en Pologne, tout le monde s'en câlisse, en estie de ton diplôme, kurwa de tabernâk !

Donc après avoir infructueusement tenté l'indexation textuelle (les universités françaises partagent le code source, mais pas les corpus permettant la lemmisation catégorisation alors que ce travail est fait avec de l'argent publique) qui nécessitent de bons outils indisponibles pour la langue française, je me suis rabattu sur la technique de brutalité propre aux scientifiques : parfois moins précis, mais plus simple si ça peut marcher. J'ai utilisé des expressions rationnelles (regexp en mauvais franglais informatique).

Une mauvaise odeur dans une offre d'emploi stable en informatique c'est (SPOILER) :
  • des qualifications non adaptées ;
  • "pour le compte d'un grand client", "SSII", "INTERIM" ;
  • gestion du stress ;
  • l'utilisation de framework
  • plus de 15 compétences éxigées ....
Pourquoi je dis spoiler (divulgâcher en français) ? Car je l'ai découvert non avant de faire l'outil, mais en l'utilisant.

A quoi ressemble mon outil ? C'est un outil en ligne de commande, qu'on peut qualifier de DSL (Domain Specific Language ou Langage Dédié) mais qui m'affiche des pages webs kikoo lol.

voilà ce que je peux y voir :


L'offre déroulée en un clic me permet de voir en surligné ce qui est exigé (et le nombre d’exigences) et en caca d'oie les choses que je juge non pertinente en rapport avec la recherche (ici python)

En général je ne regarde que les offres pour valider si j'ai des faux positifs, et j'ai rajouté les mots clés au fil de l'eau.

J'ai corrélé les offres auxquelles on ne me répondait pas avec certaines marqueurs (le niveau de diplôme) par exemple.

Le nombre de petites crottes correspond au nombre de mots clés non pertinents.

J'ai mis une fonte que j'aime lire, et du monospace avec un colonnage à 80 caractère car ça augmente la vitesse de lecture. Je n'ai mis que les informations qui m'intéressait.

Et puis j'ai mis un camaïeu de mauvais goût ainsi que de la rondeur partout parce que j'aime la couleur. Dans une version future, je mettras un arc en ciel pour que ce soit plus gai.

L'intérêt d'avoir une ligne de commande, et des données facilement accessibles sans interfaces de requêtage, c'est qu'il devient facile de faire des pivots sur les données pour obtenir des informations telles que :
  • quelle est la fréquence de crottes par titres ?
  • quelle est la fréquence de crottes par titres en fonction de la fréquence du titre ?


 Et ensuite :

On en déduit facilement des choses simples telle que plus un titre est unique, plus il y a de chance que ce soit du BullShit (de la merde de chameau).

Chaque graph en ligne de commande me permet une productivité d'analyse supérieur à l'utilisation d'Excel, MS-Access, Hadoop, Spark, Cassandra, Grafana qui sont pourtant un des pré-requis justement en big-data.

Une fois armé de cet outil voyons ce que l'on peut tirer comme résultats

Les Ressources Humaines (en Technologie de l'Information) ne comprennent pas les métiers de l'informatique


Mon grand père maçon quand on lui demandait quel était son métier (il était compagnon) il répondait, un maçon c'est quelqu'un qui sait monter un mur droit.

Si on applique à l'informatique et qu'on regarde la manière de formuler les offres on voit tout de suite le problème.

Un maçon doit il être jugé sur sa connaissance des outils ?

Non, si vous connaissez des Compagnons du tour de France, des MOFs, vous saurez qu'ils entraînent leurs petits lapins  (apprentis) à savoir se démerder avec les moyens du bord quand ils ont pas les meilleurs outils. Ce qui inclut de laisser les pious pious improviser des palans qui pourraient les tuer pour lever des blocs de plusieurs centaines de kilos.

Les outils en informatiques sont une difficulté accidentelle. N'importe quel idiot peu apprendre un langage, un cadriciel (framework) en un tiers du temps d'une période d'essai. Et c'est justement une bonne manière de juger un informaticien.

RH arrêtez d'éxigez la connaissance d'outil pointus pour une offre d'emploi, vous augmentez vos coûts de recrutement et créez une barrière qui favorise les bras cassés incapables de s'adapter

La convivialité, le fun, le challenge (défi en anglais) sont un mauvais signe. Orienté valeur, écoute ...

Ce qui évite la toxicité culturelle en informatique n'est pas d'être gentil et inclusif ou de vivre dans la bromance mais la neutralité émotionnelle.

Une expérience qui s'est répétée pour moi, c'est que trouver un trou de sécurité dans des grandes entreprises fait qu'une personne va le prendre très mal.

D'une part il est à noter que se focaliser sur la valeur incite à ignorer les cas asymptotiques, qui sont justement ceux où les trous de sécurité apparaissent, d'autre part on fait tous des erreurs. Factuellement, si vous analysés statiquement mon script, vous allez voir des erreurs (ainsi que moult fautes d'orthographes et d'accords en lisant ceci)

Avec la mise en œuvre du GRDP vous n'avez plus le luxe d'ignorer la question de la sécurité des données, et ça commence par avoir une culture de neutralité émotionnelle permettant de gérer les non conformités comme des adultes.

RH arrêtez de dire que votre boîte est fun/convivial seul les codeurs qui n'ont pas de vie et qui sont toxiques seront attirés par votre entreprise : on ne vit pas pour travailler, on travaille pour vivre

Quand on dit que la France rayonne à l'international du fait de ses grandes écoles. Par expérience, à part quand les français huppés colonisent une place (au hasard le plateau mont royal)  les polytechniciens et autres sont vus comme inférieur à des universitaires, car ce ne sont pas des titres ayant une forte résonance à l'international.

Les métiers reconnus sont nos métiers artisanaux et ouvriers : ébénistes, chefs de cuisine, tailleurs de pierre, maçon traditionnel .... Ceux où la reconnaissance est le fait de savoir faire, où il y a des concours de Meilleurs Ouvriers de France. Le faire savoir est le propre des grandes gueules le savoir faire des bons ouvriers.


RH, arrêtez de refuser les CV fournit sous la forme d'une page web pour un métier de l'informatique. Ils prouvent un savoir faire. Valorisez les projets libres innovants, les participations aux conférences ...


Point spécial : les entreprises ayant des taux de retour frisant les 0% une offre masquée derrière pole emploi on y répond pas.


Je tiens à souligner que les offres issus de l'industrie sont bien mieux rédigées que celle du secteur tertiaires et ironie spécialement des domaines des technologies de l'information.

Je pense que si déjà ces 3 points étaient validés ce serait bien. J'ai une détestation spéciale pour le mot digital (qui réfère au doigt) en lieu et place de numérique car quand les gens ignorent que le mot français est numérique cela implique que l'organisation aura du mal à communiquer, et donc que ce sera la tour de Babel. En fait, chaque mot de franglais me hérisse (et une crotte de plus). Une plateforme digitale, c'est un clavier car on y pose ses doigts.


Pole Emploi est un repère de cave



Ca risque de me coûter ma candidature pour leur API, mais maintenant je connais vachement bien leur API.


Beaucoup de données c'est le contraire de beaucoup d'information

L'information se distingue de la donnée par sa pertinence.

Si je suis obligé de créer mon outil qui accessoirement évite de tabasser vos serveurs en filtrant 99.99% de vos offres c'est que votre site remonte beaucoup de données peu d'information.

En tant que Joe la Science je vous donne la définition de bordel informationelle

H = k x ln(données_présentées_pertinentes/ensemble_donnée)

Imaginez que je suis informaticien, mais pour parcourir vos bases en long en large et en travers et m'amuser à regarder les offres manquant de candidat, ces offres sont des métiers non intellectuels. Les gens qui ont le plus besoin qu'on répondent à leurs offres n'ont pas des chercheurs motivés ou sachant rechercher une aiguille dans une meule de foin. Si vous devez vous focaliser sur une et une seule chose, c'est pas votre API/dev store, c'est la pertinence des recherches sur le site web.

Votre API est à chier, et vous n'en avez pas besoin

Une page web bien structurée c'est la même chose qu'une API REST. Le truc, c'est que votre page pour présenter les offres est écrite dans un HTML ignoble dont la sémantique des classes CSS contredit le HTML et la hiérarchie, au final, ça va plus vite de l'analyser en la transformant en texte sans balise. Ajout : L'ironie est d'autant plus forte, qu'une partie de l'application des règles d'accessibilité diminue l'accessibilité au site (lol).

Et même malgré tout ça, quand j'ai vu la doc en franglais de votre API et sa complexité inutile, j'ai refusé de l'utiliser et j'en suis content.


J'ai du corriger quelques une de vos ruses de sioux ridicules pour empêcher l'aspiration (ou peut être de l'incompétence) et ai sauté au plafond en voyant que vous ne respectiez pas certains standards de sanité du passage des arguments.


Abandonnez vos API, faites juste du HTML simple et propre facile à analyser, respectez le protocole HTTP.

Tout ce temps gâché par les chercheuses d'emplois à rechercher une aiguille dans une meule de foin, c'est du temps qui coûte à la collectivité, aux entreprises aux organisme sociaux. C'est aussi du découragement. C'est écoeurant. Vous pouvez m'embaucher pour corriger ça ou pas, je m'en câlisse, en tout cas j'ai vu un problème, j'ai vu une solution, j'ai postulé chez vous.

Pole Emploi, vous qui êtes un agent publique au titre de la Déclaration des Droits de l'Homme est du Citoyen qui est toujours en vigueur, je vous demande des comptes pour cette gabegie, cette incapacité à bien réaliser le coeur de votre mission : permettre à la demande de rencontrer l'offre sans barrières inutiles.

Ajout : Les points positifis de pole emploi

Pourquoi avoir choisi pole emploi pour scrapper des offres en info et pas indeed, monster, chooseyourboss ? 

Les autres sites sont soit pire en déviance vers la bromance, soit quand on appelle pour savoir si l'offre est encore dispo on se voit répondre souvent que non (ce qui est pas très différent de pole emploi).
Sauf que chez les autres c'est pire. Pole Emploi a selon mon expérience beaucoup moins d'offres affichées déjà pourvues. Et c'est déjà très bien.


PS : EDIT : j'ai beau être dyslexique et assumer, n'hésitez pas à remonter les fautes d'orthographes ponctuations, redites ... 

Google's silent autodafé

TL; DR google is not evil, blocking access to relevant information is just a side effect of its business model:

google silent autodafé rule is : any knowledge that is not generating a revenue stream does not deserve to be shown to you

Years ago, after a «burn out», because I am library rat I used my usual paper based routine to dig information on the topic.

Before I go for «new text», I always go in the past to see if there was no precedent to a bigger extent of a phenomenon we know. The rationale being if a phenomenon was extreme at this time hence it would have been easier to study. (How to do science with a Hammer (function)).

My topic was why am I feeling like shit after 60 hours work per week?

So instead of looking for burn-out in google I went for what were the reason to limit working weekly hours to 48hours.

Through an interesting journey on google I found something that I love! Figures and charts with close to unethical experiments on human beings.

It is called the scandal of the ammunition UK 1916. Long story short: WWI saw the prevalence of death per explosive during conflicts, hence winning a war was a question of optimizing the chain of production to maximize the throughput.

Until 1900 (or 2000?) there was a belief productivity was linear to the number of hours worked, and after a lot of patriotic propaganda, workers were pumped up to work willingly extra hours for the same money, and then all hell broke loose: productivity plunged, but more importantly quality; UK explosives were killing tommies because of defects.

So, the UK army did extensive unethical studies justified by war time on humans to scientifically establish the parameters influencing production and generating this mess.

Long story short:
- peak of productivity is 30 something hours;
- peak of productivity when accepting non lethal defects in production is 48hours;
- night works harm;
- the health cost due to burn out far outweighs the benefit in produced units after 48h weekly hours.

48hrs is not the optimum, it is the optimum degraded mode acceptable during wartime when it is okay to push workers above their limit to get a 7% increase in production in exchange for reduced quality.

Just so you know this was a thing USA adopted the 48hrs week in 1917 because they saw obvious business benefits. And O.I.T. later made it an international obligation that is on par in our states with Geneva convention on war law, and IP convention.

A lot of 1900's books reachable with google used to evocate fatigue professionelle (in texto) and the cost of damages and responsibility that lied on the employers.

Just for the record 1800 to 1900 have been quite intense in terms of work conflicts.

And google would give to the astute persons a way to uncover traces of this history. It would be in google books notably.

What pisses me off is that years after years this kind of knowledge disappears from all the search engine.


But where is it now on the internet?

It is gone, and all because of an algorithm.


What matters to me is not what matters to google. Google first reason to be is profit. They make stream of revenue on ads that are either on the contents you look for, or on the keywords you enter.

So their algorithm to maximize profits tends to favour when searching topics topic who have a paywall (academic, software or normative (like IEEE)).

Pointing at anything in the public domain is a clear cost sink for them.

If you try to visualize their algorithm, you will notice it favours fresh news other older one. And it is a good idea : I don't think a physical teaching of 1760 he is on par in terms of relevance with a 2017 teaching.

Basically, they modulate their relevance with a temporal curve. Probably and amortized exponential, that has a strong cut around anything that is not protected by patrimonial right.

It is probably not intended but a side effect of an algorithm optimizing the revenues.

No need to be a genius to guess the google engineers made the sin of any mechanical engineers : they put a positive feedback loop in their algorithm.

If you are good at "machine learning", why not teach your search engine to return the more relevant search results that maximizes your incomes? Resulting in the fact that any free content that doesn't generate revenue thus become irrelevant. They still are on the internet: but google will not give you the link to reach them.

Yes of course NEW materials tends to be more relevant than old one. But, it is far from being always the case. Like in the case of old established knowledge like: vaccination, Fourier transform, thermodynamic ....

You know in 1804 Fourier, one of the father of thermodynamics clearly stated human activity is responsible for global warming, and because of a small mistake in calculation, he concluded it was a good thing since according to him we were condemned to die in cold otherwise. The demonstration is still totally relevant. But it is not Fourier simple and clear demonstration that bubbles up in google : it is either the anti-climate BS or GIEC smoke-screen that comes up. The 1804 thesis of Fourier on global warming SHOULD BE in the top 10 choices when asking about global warming scientific basis.

I can also point you to "out of internet" knowledge that proves Fourier's calculation are not relevant anymore: trees and plants have moved up to 200kms/decade to colder places. But it comes from out of the web knowledge, people counting plants and insects around the world in (paper) notebooks.



It is funny that the anti-ageism and pro-tech bias of google seems to be at least a reality in its search algorithm.

Google silent autodafé rule is : any knowledge that is not generating a revenue stream does not deserve shown to you, hence any knowledge that is more than 70 years old.


Well, what we are doing is stupid anyway.


Imagine you have a public library, but do not want to have librarian because they cost to much.

So you give a company this mission saying just finance yourself.

The librarian goes to the bookshop and says I have business model idea: for every 10 search I submit to a reader I put one to a book you sell in exchange for a share of generated income.

This way you fund new knowledge while preserving the old one.


Readers also benefit from having updated knowledges.

The problem is that in medio stat virtue. Too much of any is stupid.

Only old news would leave us in a crusted world where no progress would be possible.

Only new contents condemn us to reinvent the wheel poorly by forgetting the basic knowledge.

Google does not care, they are not a librarian, they are a business. google is not a search engine, it is an ad based streaming revenue generator empowering any companies able to make people pay to access to data.

My conclusion is we all used so much google we forgot about Shannon definition of information: H = k ln (O) (where O is the ratio of relevant choices over total choices).

If google was useful to gather information we would have a rarefaction of choices to organically point to fewer and fewer relevant choices.

If google algorithm was information based it would tend towards losing revenues, and having its users lose revenues. At the opposite, google is in a position to create artificial revenues to make you pay for information that are publicly available out of the proposed choices. Google has a direct incentive to block you from publicly relevant accessible content so that the ads buyers can generate revenues. It does effectively hide information.

Google is NOT evil. Google is just like a rational good gear in a malfunctioning clock.

Sometimes there is no one evil but the rules of the game we play. Necessity may be evil, but there is still no necessity to leave under the realm of evil.

My conclusion is actual societies are immature thus sucking big balls at understanding the simple challenge raised by the con behind the Information Technology sector.

Information Technology is not about giving access to information, it is totally the opposite due to the incentive of the market.


Macron la pédanterie et l'incompétence numérique


 Correction importantes

TL;DR

  1. Le site permet bien d'envoyer des courriers non sollicités à des personnes;
  2. Les utilisateurs de Macron ne sont pas en danger de quoi que ce soit concernant les mots de passe (je me suis trompé grave);
  3. Il y a peut être un truc sur les tokens, mais ce code me ressort vraiment par les trous de nez.
  4. bcrypt génère les sels par défaut, cet algorithme n'a pour l'instant pas été pris à défaut contrairement à beaucoup d'autres.  
  5. Le code du site reste quand même éparpillé partout comme la cervelle de Kurt Kobain



En termes de technologies de l'information, soit on sait comme le premier ministre de Singapoure coder son solveur de soduku en C++
Voir le code ici

Soit on fait comme le gouvernement Taẅanais, et on embauche l'un(e) des meilleur(e)s hacker du monde comme ministre dédiée au technologie: Audrey Tang.

Macron est probablement l'un des candidats les plus dans la hype: son site web est disponible à mes yeux sur github! On se croirait dans la brise pré crash de la bulle internet tellement ça buzzz!

Donc, plutôt que d'écouter ses conneries, je vous propose une visite guidée des sources du sites webs et ce que cela révèle.


Premières impressions

Avant de rentrer dans le détail commençons par regarder l'ensemble:

Le code est ici : https://github.com/EnMarche/en-marche.fr

C'est buzz compatible et semble de bonne facture.

Annoncé logiciel libre, un readme, des documentation d'installation, une convention de style à la JAVA d'entreprise sérieuse, un couplet à la De Gaulle, l'intégration continue buzz compatible avec la vignette (comme sur mes projets), une doc développeur, du docker (de la techno cloud hype totalement instable).

Si j'étais dans le cargo cult je dirais : l'idée que l'apparence renseigne sur le fond, je serais sûrement un fan du site. En plus le core dev semble savoir de quoi il parle (là je ne m'attaque pas à la personne, mais à la stature sociale): il est tellement brillant qu'il a commencé par être architecte logiciel avant de savoir poser une brique logiciel, il est un dévelopeur certifié sensiolabs (créateur et dévelopeur du cadriciel utilisé par l'équipe par Macron pour leur site) et il est architecte internet de Macron, spécialiste en Intelligence Artificielle. Il participe et fait vivre du code libre. Si on juge sur le plumage tout à l'air bon.

Le code est propre comme du code d'entreprise, lisse, apparemment bien rangé, structuré fait pour le déploiement. Tout est fait pour sembler pro, propre, clean, parfait, même la petite touche logiciel libre et contributions libres.

Macron dont on rappellera qu'il a fait une violente charge contre le chiffrement. Une des bases garantissant un petit peu de sécurité sur internet tant que personne n'écoute au milieu.


Par où commencer un audit de code PHP?

Après 5 ans avec les web agencies et autres marchand de viande, j'ai appris à ne plus croire les apparences. Et j'ai développé une méthode simple d'audit: elle commence par rechercher comment les mots de passe sont stockés et validés.

Comprenez que l'authentification, est un point crucial de la sécurité informatique, tout autant que le chiffrement. La règle de base est: si le site est compromis il faut rendre difficile le fait de pouvoir trouver les mots de passes rentrés par les utilisateurs.

Il y a des règles simples:
  • utiliser un algorithme de cryptage (hashage) considéré sans vulnérabilités connues ou à venir (au moins au moment de la création du site) ;
  • rajouter un aléa dans le cryptage permettant qu'une compromission de la base embête qu'une bête comparaison entre les résultats du cryptage et ceux issus d'un dictionnaire donnent le résultat ;
  • utiliser un algo connu sans vulnérabilité susceptible d'apparaître sur les collisions.

Pour ceux qui s'y connaisse et qui veulent passer la suite un peu chiante, ils utilisent bcrypt et pour certains cas SHA1* et ne salent pas les mots de passe avec un aléa. Pourquoi? Parce que sinon ils ne peuvent pas faire une couverture de 100% sur leurs tests! Cargo cult 110%! Crétinerie ++ comme dans C++!
Si si, ils ont affaibli la sécurité pour avoir une belle médaille en chocolat délivrée par des laveurs de cerveau d'une secte appelé experts en méthodologie.

* le coté distraction par la redirection ne me permet pas d'être certain à 100% que les mots sont stockés encodés en base, mais je suis optimiste par nature.

Le labyrinthe des indirections

Tout code d'entreprise qui se veut sérieux tend à vouloir être obscur afin de paraître profond. La logique de vérification des mots de passes est en générale fait dans le contrôleur en appelant la classe de sécurité ou un mixin du modèle ce qui vous évite de réinventer la roue carrée. En général on s'attend à un niveau d'indirection, voir 2 si c'est mis dans le modèle :)

Bon prenons un outil de dev sérieux :

find ./ -type f -exec grep -Hin authenticate {} \;
La fonction authenticateUser apparaît dans le :
  • le formulaire (form) de connection (login)
  • un contrôleur 
  • le modèle
  • euh ... ailleurs ?!
Bon, un petit coup de fun, et amusons nous un peu.

Logging (journalisation des évènements) et Login (connection) sont prononcés de la même manière par les français. Ça ne veut pas dire que ce sont les mêmes mots, hein?

Et bien croyez le ou non, une fonction de Login est rangée dans l'espace de nommage Logging. LoL! 1 point pour l'humour.

Je vais passer la lente agonie de l'audit qui consiste à suivre une fonction sur 5 fichiers en se demandant, mais où le travail est-il vraiment fait? Pourquoi pour la même fonction je vois du copier coller?

Plus on met d'indirection pour faire une chose simple plus ça fait du code pédant, mais aussi chiant à maintenir et corriger. Par contre, il est vrai qu'en Entreprise on passe pour un dieu qui sait «abstraire et structurer». Quand le faire savoir l'emporte sur le savoir faire....

Bon, X fichiers 2 héritages une factory (qui n'empêche pas 3 fois la même fonction d'être recodée) et une apoplexie plus tard, que voyons nous comme manière d'encoder les mots de passe?

C'est notamment ici : https://github.com/EnMarche/en-marche.fr/blob/master/src/AppBundle/Membership/AdherentFactory.php#L98

private function encodePassword(string $password): string
    {
        $encoder = $this->encoders->getEncoder(Adherent::class);

        return $encoder->encodePassword($password, null);
    }
}
Le deuxième argument de encodePassword est le sel (salt) à donner à la function de hashage cryptographique.

Et malgré l'utilisation d'une Factory (code hyper réutilisable) la fonction encodePassword pour la validation de mots de passe est redéfinie / utilisée 17 fois. À ce niveau, ça valait vraiment pas la peine de faire une factory, et à chaque fois, le sel est vide.

Quel est l'algo de hash. Là encore X redirections plus tard c'est ici: https://github.com/EnMarche/en-marche.fr/blob/master/app/config/security.yml

brcrypt avec fallback en SHA1 si il y a des mots de passes anciens.

SHA1 est cependant toujours utilisé pour .... les jetons (tokens) de sécurité ... et j'ai pas eu le courage de suivre les cas où le legacy était vraiment appelé. Je suis lâche j'ai même pas honte.

Note pour les velus : je ne m'étends pas sur l'hérésie d'utiliser SHA1 en 2017 et la potentialité d'une prochaine attaque par collision qui rendrait de fait la fonction de sécurité cryptographique totalement illusoire.

Mais pourquoi 0 sel (salt)? Sont ils totalement idiots? La réponse est dans les tests unitaires : si vous mettez un aléas et que vous ne savez pas initialiser (seed) le PRNG de votre plateforme, alors, vous ne pouvez tester les mots de passes générés à la création de l'utilisateur. Et donc pour ne pas casser les tests unitaires .... ils ont retiré l'aléa ... \o/ Bravo! Chapeau bas!

En fait quand je lis les tests unitaires, j'ai parfois peur qu'ils testent des mots de passe en clair et que j'ai été très indulgent.
Mais le code est tellement lourd que j'avais pas envie de lire plus loin.


J'ai vu d'autres potentiels idioties (des tokens potentiellement utilisables en techno ajax base64encodé au lieu de URLbase64encodés), des tokens qui ont l'air déterministes, et des tas d'autres erreurs qui me ferait flippé si j'étais inscrit comme utilisateur du site web. Si une puissance étrangère avait la main sur leur base de données, je donne pas cher de vos chers mots de passe.

Si vous avez le courage de publier une analyse sur la sécurité de leurs tokens, je promet de vous payer une chopine! Moi, j'ai trop vu d'horreur pour un mois.

Mais si tu es pas content yakafokon soumettre un rapport de bug


Je suis pas content initialement, car je voulais déterminer avec certitude si le site enmarche était de fait une plateforme de spam. Et elle l'est. L'équipe internet de Macron qui connaît tout sur tout donne des outils à ses militants et à des officines privées pour envoyer le programme de Macron aux citoyens sans leur accord.  Cela tombe sous le coup de la loi Européenne, mais ils semblent se torcher avec la loi quand ça va pas dans leur sens.

Ma philosophie c'est n'ayant le droit de casser les genoux des spammeurs, au mieux de leur coller la honte à minima de ne pas les aider.

Le spam est un sujet autrement plus grave qu'avoir un site en carton, mais personne n'entend.

Mais c'est du logiciel libre donc c'est bon!


Non, c'est une licence spéciale appelée Affero GPL qui n'est pas unanimement reconnue comme telle, et même si c'était libre, ça donne pas au code des morceaux de vertues qui vont faire que je vais contribuer par lavage de cerveau.

Mais pourquoi t'es méchant!


Le spam c'est mal, mm'okay?

J'aime pas les gens qui me font chier et je donne pas un chocolat à celui qui me marche sur les arpions, je lui colle un bourre pif.

Et en République, on a le droit d'être sale, méchant et grognon

Mais c'est qu'un site web en quoi est-ce important?


Bonne question! Enfin.

C'est le site web dont le plus gros contributeur est l'auto promu architecte internet de Macron. Macron qui a pris une position radicale anti moyen de sécurisation des communications.

Pour moi, quand on fait la morale on s'expose à être regardé à la loupe au niveau de ses actions et de son code.

L'équipe web qui prétend conseiller Macron fait clairement un code qui est dans la norme de ce que fait l'industrie, et ce qui est d'un point de vue technique faible. Je ne souhaite pas avoir un président qui a l'oreille de mauvais experts.


Tu fais mieux?


Mon code est du code de punk, il est sale moche, méchant, petit comme moi  mais il fait la job sans s'étaler dans 28 classes et 20 répertoire et perdre les utilisateurs.



Being angry as a wolf makes you sacked and happy

Pun intended. (cf Duran Duran)

Have you been so sick, you just think you are gonna die?

Have you been checking dozens of physicians that tells you, you have nothing and it is all in your head?

It has been my routine every winters for the last 30 years.

It used to not matter: I always conveniently chose a room faraway in any place so that my cough would bother no one.

But now I have to face my angry spouse that really would like me to stay alive and raise our kid, and we have been living in tight spaces since we met...

Funny how small problems of 3D geometry can matter.

So basically: I cannot sleep at night, unless I accept to drown in a weird foam coming from my inside, wait 5 hours of zen acceptance of being between sleep and fucking vital reflexes waking me up because I literally drown in my own water and asthma get triggered while my body also try to put me to sleep to recover. Dreaming of drowning and yet being physically drowning in your own perspiration? Yummy!

Funny fact: unless you ask me now (the morning after), I have no memory of it. Just like pregnant women cannot remember what was their pain during the labour.

And during these nights I live the dreadful perspective of dying.

This morning I have a cheerful song into my brain when it comes to the melody (a New Orleans kind of tune) from everlast: when I was a very young boy, [my cough] told me we're all gonna die. (in the original lyrics it is mama not my cough)

For years, Doctors, shamans, and all kind of nicely knowing persons have gave me their bests at trying to heal me: but I suffer from nothing.

And at the end, I am either denied to suffer, or told it is God's way to tell me I am a bad person...

If I talk about it: I am a weirdo. If I say all kind of medicines are failing I am a liar. Because everybody knows that they are right in their beliefs.

So in order to have a social life I must forget the feeling of drowning in my sleep. Of feeling I am gonna die. And every morning, whatever my body is telling me how much my lungs, my heart, my sanity are damaged, I reconstruct a socially acceptable normal self: one that does not suffer, and like everybody else don't remember he well die. And go back to work or pass exams.

But there is a side effect of suffering huge amount of pain. You have a short amount of morning clarity the morning after...

One that tells you something important: today I AM ALIVE AND KICKING (and feeling like a fucking vulnerable weak shit (cough, ouch, cough)).

For some days (usually no more than 3) your priorities are re-based on one thing: you have one and only one life.

Only one that matters, and all the social limits put on your brain kind of falter.

It is like a smoke of screen that basically is our social based educations gets partially torn, and you are having a wake up call. 

But, why do conflicts always appeared these morning after at my jobs I always wonder? Why my accepted obedience to society gets in the way of my will to live as I wish?


Actually, what do I wish?

For one thing, knowing that I am gonna die, I used to drown myself in technical stuff that requires so much focus that it diverts me from thinking of it too much. But also, excelling at doing give me a sense of internal peace and fulfilling.Totally crazy batshit crazy thinking. But I discovered it worked.

I love to do stuffs, because they help me squash away my fears, and I am all the more relieved that they are done the more correctly I can. The pleasure of some well done work. I am all the more attached to try do my code correctly that I know I am a temporary being on this earth.

And writing good piece of intellectual work is hard. So hard, I don't like most of my code, but I stubbornly try to make it better, or at least as good as I know it can be done. And I make mistakes ... a lot of them. From which I learn.


Because of this, my getting fired day often happens after these kind of existential wake up: I love to do stuff correctly because that helps me feel alive. And I like facts.

On reddit and hackernews I often get downvoted for being savage as fuck. But, the true story is truth is always savage.

Authority and status do not like being questioned. And there is no way in political context, Truth can be told.

More than once, even though my skill in security expertise is low did I spot obvious security holes. My expertise comes from the fact these mistakes are often mistakes I made myself and recognize.

Let's begin the story telling

A level III engineer (I was a probatory level I) really hated that in a code review I spotted an SQL injection : he was using an ORM, it was therefore impossible there was an injection ... unless he was building the query as a string and then sending it raw for execution.... argument he always discarded as false (fallacious behaviour) and as a threat to his authority. I told him that we all did mistakes, but apparently, since he as always be coding this way it could not be possible (else the solution would be flawed to the core).

So he left me to be dealt with higher level of managements that asked me to do a mission on a critical payment & authentication system, but without the documentations.

So, I had to reverse engineer the tool from 3 functions calls and a proxy web server.

It was JWT based solution. And, I spotted the very expensive auth system was failing 40% of the time. I thought that I must be stupid or the emperor was naked. Long story short feedback from the production were telling me the emperor was naked. Everybody knew but nobody would tell it because they used the wraith of the managerial authority with convocation to the higher managers to shut you down and give you a blame.  Security obfuscation by retaliation.

Technical detail, I found by frequential analysis I was dealing with a base64 string, I decoded it, I found keywords, googles them and found a RFC. Then, I read it.

Basically the «secured» solution that was given as a token other HTTP GET method was a base 64 encoded string whereas the RFC mentioned it should be a urlsafe base 64 encoding... It made sense. But the devs, instead of a using an external dependency to have more control, rolled their own crypto.

In a company that is so big with so much turnover with so proud of hiring so much ninja coders  thousands of experts have been hitting this bug for YEARS.

So, how does a life and death concerns in the morning affects a stupid technical problem? When you have a wife and life matters more than a stupid problem of a dysfunctional hierarchy that has ego problem, thinking of the relativity of coding compared to have an happy life should matter the most, no?

All my friends always told me to use my smart brain to do what everybody does: shut my mouth.

Me, after a bout of cough, my brain becomes stupid: I filled in a security bug and a functional bug report describing with a sample of code on how to reproduce the problem, the mathematical calculus to compute the frequency of failure, I used side channels to have figures to compare with the observed production rates of failure that were matching  the analysis of the reason, why it happened and how to fix-it.

48 hours later I was shamefully brought to my desk by a security agent in front of all the coworkers to fill all my belongings in a box.

Years later, this bug is certainly still in production and affects million of users and have huge costs for the company. But, when I am telling the name of the company every one tells me, they should be proud of their products and I was dead wrong.

So, my conclusion on this episode is : security by pressure aka the naked emperor syndroma is real.

I will succinctly multiply the examples but let me tell you, it happened to me a lot. I more than once had a security engineer on vacation and needing secured acces to works.

Once I used an exploit in a linux perf counter to get root access ... that I reported when he came back. Needless to say I was not thanked for reporting ALL the linux servers were vulnerable for 6 months.  (Same perfect company some of my respected security experts friend give their credential to).

Another time, I had to play with a jar (as if I ever coded in java) to read a library and guess that a «secured payment system» from Orange telecom was in fact based on the repetition of an XOR on a fixed string, with white space padding, with fixed data... Well, I «cracked» the password because else the company would not have been able to process the payment. I had to fill in my box one week later. The buy in one click feature from ISP is the one I oddly never use.

Another time I just told to a CTO you cannot make an exact 100 top ranking by merging 10 top ranking on 10 shards. (Distribution matters). I was told, math lie.

And that well, there was also quite a few SQL injections somewhere else ... for which I was told the ORM magically protect mantra ....


My hazed brain does it every time I wake up having the feeling I nearly died from my coughing in the night. I forget about social context. I am just bluntly honest about my work. Because that is my life saver.


Every time, when I get back to work my brain switches off the social limiters and when something needs to be done or said because it seems the obvious stuff to do to go on and jump to a new thrilling adventure my brain tells me: Oh! everybody is like you! We all know we are weak, make mistakes and how can reporting a factual technical simple problem having a fix that is ready backfires?

Every time, I decide to take the bull by the horns and say, look we have a problem that can be fixed.

Truth is problem is often already fixed by layers of duct taping programming that hold the solution afloat and a lot of jobs relies on this duct taping. We sell dreams not facts. We want stuff to look as if they are working, we don't actually need them to be correct (except if it is in a nuclear plant or for a peace-maker, or for an autopilot?)


But being alive is not being a coward that does what has to be done to protect your social position.

Being alive is liking who you are. And if you define yourself by your love in what you do, then if being true to your own self is trying to make things work, then it is what has to be tried. You have only one fucking life!

And believe me: there is no way human beings do not take it personally when they made a mistake and you spot it, it is just that when it is made by the upper management they will fire you. If it is an intern, he will just resent you in your back except if they are some of my precious padawans I am proud of having enlightened.

And now, I don't even remember that I had the feeling I died tonight. Focusing on these petty technical problems makes me forget all about this. The feeling of my own pain and agony is gone, and even though I put my social status at risk, I feel at peace with my own self doing the stuff in the way I think maybe correct.

My brutal honesty get me fired, it get me blocked at human resources interviews, and right now I live with the social minimum in a dire economical situation. But, fuck, honesty and living as yourself 24 hours a day is wonderful.

People see me as savage as an angry honey badger. I prefer to say I will not bow. My pride as a human is as vast as the eternity of void that you can expect after your own death. 

Life is to short to live life as a full scale role playing game. Be yourself, and love who you are, and what you do, even if it hurts a tad. It will never hurt as much as wondering on your death bed why you messed up your only chance to live according to your own self.

And after smoking, my body fluids finally leave my lungs, giving me my much appreciated certainty tonight the problem will be fixed... and I dare not tell anyone that my cough was worse when I stopped smoking. Because ... everybody knows like Adolf H knew and all the others hygienists that there is no way tobacco can help... Yes it does, as much as smoking weeds, but I cannot: it is illegal.

Fuck my life on this, and please if nothing can heal me and legal medicine has given up on me, let me have access to the devil's lettuce that at least can ease my pain. Let me suffer less. Pain is not FUN!

The coders' ethics is plain bullshit

Oh! Coders are taking a virtuous stake in being ethical:
  • major US IT actors such as google, FB, twitter will not code a database of muslims and encourage developers to sign a chart about it;
  • a ban on killer bots (drones excluded) is proposed;
  • the IT industry (that reduces your choices while searching the web) are agreeing to show you «better choices»...

Well, it is a smoke screen, most of our activities are non ethical in terms of everything we pretend to be...

What IT means ? Information technology.

How do we define Information? As the number of relevant choices proposed to any requests over the whole possible choices.

Our job is very often to limit often by idiocy sometimes by following orders without critical thinking your access to information.

I have already treated poorly the bubble of reality that search algorithm makes. And I think the topic is boring.  So, I will prefer real life examples of stuff I did as either a freelance or a job.


Pure illegal activities

 

I have been a contractor, and for years I have been working for the media industry. I have taken part in violating the law to keep my job under peer pressure to keep the activity running.

IP theft/plagiarism is probably the most common activity I have taken part in my career as a coder, because I am free software specialist.

I mostly have taken part honestly in stealing myself, though.

Let's take this wonderful multihead solution based on linux that I helped building when I was young. You may have seen it working. It was based on linux, but the hardware description said it was based on a GPU that was never supported by linux. How can?

Well I coded the driver. My boss was a FSF free-douche, the kind that would bend the truth to oversell free software and its «intrinsic virtue» for the democracy, security & al. He said, we don't release the code:
  • license just means that it should be available to those who ask (and we never hinted customers about their rights);
  • the (cooperative) company owns the code anyway, so it is not you to decide how to use it. 
In my career as an open source developers this story has happened at least 3 times, and it has happened a lot with free software enthusiastic believing in the FSF: the most hardcore Open Source tenant with a strong moral stance. I dare say I do since have a very strong defiance towards people with a stance. Now I prefer to judge people by their actions.

I have also one time be mandated to code a spamming solution.. oops an efficient marketing tool or set them up.

Actually it was pretty okay in the opt-out part.

But every time I was forced to let customers input their email by batches from fishy origins without control. When I said, maybe we could give check if these lists are legitimates or to let people report that it was no optin, I was cock blocked.

I have even been asked to try to protect a spammer and asked to fight spamhaus while working for an ISP

I have taken part in fighting laws I totally support. Sometimes.

I have been talking a lot to my colleagues, and friends about this crossing the red line ; mainly the answer was : we all do this, because it has to be done and else we will have no jobs.


Grey activities most of the time : tricking people

I have also been taking part in activities that are about not committing crimes directly, but much more taking advantage of people by hiding information about important contractual part.

How much a free farting application costs on a mobile phone? Well, according to most it is free. But what if in small printing it is written that if you don't explicitly resiliate the free subscription it will be a tacit infinite reconduction of a .70€/month bill that no one notices? Your farting application can cost you 19€.

How can you be proud of manipulating the OS of a smartphone to make people send overtaxed SMS sneakily and then erase them from the list of the SMS?

While working for the advertisement industry I have been on numerous occasion working on deceptive (but with small prints still) websites for games and cooking recipies which were total clickbaits in order to collect personal information. It is not illegal if the information is there? But where?

I have tracked you with zombie/everlasting cookies. Pop-under, pop-over have no secrets for me, I have been altering the content of information web sites to the point I was potentially able to alter the news websites' information. The googleAds and co are fucking security holes. I could have put a financially fake news in order to manipulate the market if I were truly evil. But, as numerous coders I never talk about publicly (like on a blog) it because :
  1. I would have been blacklisted;
  2. the industry losing trust would mean the job disappearing. 
I have been taking part in activities I reprehend in order to keep my job alive.


I have been überized before it was cool


How do you call a worker with multiple customers but in fact has one and only one intermediary actor in the middle?

Well, an überized worker.

Like a driver, a coursier, a pseudo construction worker ...

How do you call this when your job is to be hired to do the job in a company that have the ability to do so for less?

You call this a yellow stupid überized.


Well, like every one else being jobless I was proposed it as the only way to have a job; I however know that in doing so I broke numerous work and contract laws. Well, choosing between living in misery or in integrity is quite a choice I did not have.

Big brother activities


You know the gun makers excuse ? It is not me who makes dangerous tools, it is those who pulls the trigger who are the dangers.

One of my specialty is log extraction and analytic. I have been building numerous tools that given in the wrong hand would result in mass surveillance. But for my defense, this is a routine activity we do. Oddly we always log the users even intermediates, even eventually the one doing the queries, but never report to the lower levels the fact they have been targeted by the query. Ooops, cost to much and not a desired feature.

I have taken part in supervising activities of workers that violates international conventions on legal length of workdays, what is an acceptable in terms of lunch/rest/toilets pause ....

Well, you know, I have not been alone, we were all involved in the technical, marketing and financial department of the company. My work has been by a lot of standards a slow slippery of concerns.

I am a good sheep. In fact, I have been considered a pain the ass for calling some a tool big brother and for asking my CTO that is a pro privacy/cryptography/freedom if he had no problem with his inconsistent moral stance in public in regard to what he was actually doing?

I guessed that may explain why he threatened to beat me one day and threw me an object at my face in the open space and then went on firing me immediately.


Breaking the working contract


You know in the big brother activities are funny. I can totally measure your work activities when you login, logout, call your mail client.... and you know for what I have sampled mentally of these logs, people are always working more than advocated.

On the other hand, application coded by fellow coders tends to forbid to input more hours than actually made. All the «timesheet» applications aka digital punch clock I have used required a manager authorization to enter the extra work hours.

It is funny how we can measure stuff accurately when we want.

50 - 70hours per week paid 35 in my industry are totally legitimate, and there is no evidence of the opposite, because, well, lol, our tools may be a tad biased.


Have you tried to be ethical?


Ethical? I don't understand this word, but let's say I do since I came back from Canada.

Results : I parse 900 work announces per week, answer to at most 3  go to numerous interviews and do not hide my intent of living by the laws and contracts.

So far, the only job for which I have been accepted had been mover (driver/riper) and it was a great personal experience.

Well, it is good news. I don't have to live in fear or give up : I can still find a job.

Most of my friends says my attitude towards IT is suicidal, I do think the opposite : IT industry is suicidal, and I am no lemming.

E-commerce is based on trust: lose the trust of your customers and you lose your business. And maybe so far you have not lost a lot of customers yet butme. I know enough of the landscape of IT to distrust most of the so called disruption coming. The IT market nowadays is basically a gigantic scam based on promising a gold rush on some technologies that you sell. The ones who made money from the gold rush were not the miners, but the shovel sellers. This what It are: scammers selling you shovel to scam other people. 

And to conclude, my experience at trying to raise ethical issues in my numerous pro life in IT is that it results in you being fired.

The actual fuss about let's be ethical is just a clever marketing trick as long as workers are not recognized the right to oppose more than questionable/illegal activities. And, we are not. The only ethic we are authorized is the one of those who pay. 

And I may be special, I decided to live by my own standards and I don't fear to be sacked, threatened, physically beaten, living in misery once again.

And, that is my choice, not an ethical one: a selfish one, I love to look at myself in the mirror and be a tad proud of who I am unlike the vast majority of my colleagues who have been involved in all these stories. 

Do whatever you want, but everything made by peer pressure and publicity is not ethic, it is just marketing or just buying the indulgence of the crowd for the shit you made as a catholic buying his indulgence to the Catholic church in the middle age.

Ethical coders, I do not belong to this movement and I despise it.The vast majority of my profession love moral stances and doing the opposite of what they advocate when you can't see.

Frameworks are tools for monkeys not needed by fishes

TL; DR


Frameworks are scuba gears made for monkeys that love to climb the height of complication.
Some other kind of developers are like fishes that feel naturally at ease with swimming in the water of the problem at hand, without requiring frameworks.
Coders who can and prefer to swim and are infuriated at the absurdity of being a fish trapped in a scuba gear.
Prelude: I kind of refer to this quote mis-attributed to Einstein.

Once upon a time

 

People did write their code by reinventing the wheel and it was crap.

So people decides to mutualize their code and it was good.

When it was small pieces of code it was called library, when it was bigger it was called frameworks.

To be an honest liar nothing distinguishes a library from a framework except the name given to it.

Stuff like openSSL were called library by the idiots, but a crypto framework by others (that may have written libressl). OpenSSH use to rely on it for everything except opening ssl tunnel which was the use the monkeys were seeing it could do.

Industry/fashion soon decided that the difference between framework and libraries were the size and the «genericity of the bousin». Bousin is a norman word that is totally legit in en_UK.


Of monkeys and fishes


I strictly don't understand why but when the wise points the moon, the monkey look at the concept of the moon when the wise just point at the moon.

You see frameworks don't exist. And when people see them, they think they are complicated stuff. Don't blame them, they have been studying and passing exams.

Most educated yet idiots think a complex idea must be complicated.

So they want to prove better than others and climb the mountain of the problem as a monkey and be the king of the hill. Showing off basically.

If coders where musicians it would be the difference between the stupid one playing simple pentatonic because it is easy to learn and master and the other one making a religion of it.

What makes music sound great is not your virtuosity (playing like Steve Vai, Ingwie Malmsteem, Satriano) it is your musicality (BB king).

It is not how much complex concepts and how much notes per seconds you can play, it is music.

Virtuous coders/musicians are like monkey, they love heights. They don't understand music, but like nerds they want to prove they can handle complicated things.

Complex is a lot of simple things put up together making a stuff. Complicated is the same thing but with the idea some powder of it works by magic making the result immutable. Complication vs complexity is in the eye of the one watching.

A monkey will see the framework as a tree that makes you reach new height. The monkey will tell you : you don't have to understand just put yourself on the giant's shoulders. The fish is different : he swims in the turbid waters.

So monkeys love frameworks as ladders bringing him to new heights that have never been reached before, thinking you can grow trees on trees to make a way to reach higher height, thus the moon.

But sometimes, your problem are not higher. They are just about getting to the food for less effort in turbid water. Getting the job done.

Making a SPA (Single Page Application) is not about using react, angular, or WTF. It is about making a web page able to load states that are stored in a database (be it a filesystem, a RDBMS, a noSQL shit, or memory) and then make the HTML page reflect this state and give you way to change the state of the application inside a Finiste State Machine through calls.

The fish just remember that a ssh connection might do the job better, but his project manager want it to be a nice HTML web page, so he does whatever he is asked, because the one who pays is always right.

The monkey have read there is a framework for doing it, so he does not care. He tries to put all his use case inside the constraint of the holy framework. He knows the manager reads some papers so he does not question authority.

There is a difference between accepting your managers are stupid and embracing the stupidity of your management in order to keep your job.

The monkey climb the Everest of the stupidity to please management. The fish just try to do the job and eventually use frameworks.

But for a fish frameworks are no trees, they are just scuba gears: they let monkeys evolve in the turbid waters of programming. We all are blind in these waters.

Every frameworks are like an additional part of a scuba gear that makes you less agile as a fish, more encumbered with rigidity.

Does rigidity makes you agile when you already know the ways?

Not really. But you are judged by monkeys fearing water and wanting to be dry as a loveless cunt while diving. 

Computers are ugly, they are limited by ... science. e = mc² is everywhere.

Even the number of cycles required to access information is limited by the speed of light.

Monkey coders think that the limit of science will/are being broken by giants on which shoulders they stand. They name their giants with name like CAP, ACID, distributed/graphs database machine learning and they think that once they know the name of a problem the problem have been solved by pushing more frameworks to the problem.

The fish is stupid.

He just sees framework as constraints, scuba gears and think there must be way, but that putting a fish in scuba gear will not make him solve the problem and that monkeys are really not the most able animals for the job.


Obsolescence programmée: bug siège guidon

Je viens d'achever une quête de 6 mois et 70 km depuis mon retour en France: trouver les pièces qui me manquent pour réparer un vélo qui a un quart de siècle. Bref, je lutte contre l'obsolescence du haut de ma Rossinante mécanique.
Mes 2 vénérables destriers pré obsolescence
Ces vélos Peugeot, made in France (dans le texte) ce sont vu arrêtés de fabrication à cause de la production bas de gamme made in China de la grande distribution (Auchan, Carrefour, Go Sport, Decathlon).

Mon Izoard dispose toujours de son infatiguable groupe RX100 de Shimano, par contre l'autre ayant fortuitement rencontré des gitans a vu ses étriers de freins remplacés par des étriers de freins bas de gammes.

Pourquoi je roule en cadre acier qui a dépassé sa date prévue d'usure pour le cadre ? (les aciers n'ont jamais été prévus pour rouler aussi longtemps; leur qualité physique se dégradant leur optimum de confort est prévu pour 12 ans).

Parce que je peux les acheter à pas cher et les réparer car tout le vélo a été pensé pour. Je fuis comme la peste les composantes dures à changer/réparer/régler et les cadres non pensés pour une réparation facile ou qui participent par leur mauvaise conception à dégrader le vélo comme les freins à tirages centraux (V-brakes) qui en plus d'être casse burne à régler exercent une pression excessive sur les jantes entraînant leurs déformations.

Pourquoi je vous raconte tout ça? Parce que je viens de comprendre le problème.

J'ai fait 60km en vélo parce que je ne trouvais pas mes étriers de freins sur internet (de manière satisfaisante) et j'ai du me bouffer Pontoise à Paris (en vélo évidemment). En passant par l'un des raidillons les plus costauds de la banlieue (le fort de Cormeilles). Bref, une VRAIE quête.
Vue depuis la Frette Montigny

Je ne trouve pas mes freins à la longévité extrême quand ils ne sont pas volés, parce que personne d'autres les achète. Et heureusement que Paris est rempli de coursiers car cela assure marginalement la survie de certains ateliers.

Et donc, je me suis retrouvé dans un magasin de vélo qui du fait de son placement dans Paris avait les murs qui suintaient de l'intelligence de ses acheteurs en plein milieu d'un quartier intellectuel.


J'ai passé une heure à attendre. En une heure, le commerçant a fait 12€ de bénéfices avec 10 clients et 1 employé à charge payé le SMIC horaire (soit 24€/hr).

Je lui ai rapporté 3€ avec ceci:
My precious

50% des clients venaient pour acheter. Tige de selle, et freins et autres pièces simples. 10 minutes étaient nécessaires pour savoir quelles pièces étant donné le flou des connaissances des clients sur leurs vélos.

50% des clients n'en étaient pas. Incapables de visser un écrou, de gonfler ou changer un pneu les clients faisaient juste perdre du temps au vendeur. En espérant une réparation gratuite qui si elle ne l'était vaudrait une remarque désagréable sur google synonyme de baisse de la clientèle.

Sur les clients qui achetaient, l'un reprenait son vélo de ville furieux que la réparation n'aient pas coûté 20€ mais 50€ car ses roues étaient voilées.

Non qu'elle fût musulmanes et marchaient de traviole du fait de la burqua sur leurs yeux, je le précise, mais bien parce que les rayons du fait de passage répétés sur des trottoirs en mode barbare les plient, et que rouler sur une roue voilée ne résulte que dans son voilage encore plus intégral comme un léger voile qui finit par devenir un niqab.

Le dévoilage de roue est au vélo ce que le décrottage de sabot est à l'équitation ; une activité qu'il faut faire régulièrement soit même pour assurer le bon entretien de son destrier. Geste simple si il n'est pas fait régulièrement, il s'aggrave entraînant la transformation d'une perte de 5 min de temps en temps à l'achat de la roue entière avec le coût de main d’œuvre.

Le passage des trottoirs nécessite un petit geste technique qui consiste à ralentir, faire sauter la roue avant sur le trottoir et l'enjamber avec gentillesse. On peut sans défourcher franchir jusqu'à 10 cm de dénivelé.

Je m'égare hagard et n'arrête guère de dégoiser.

Voilà, ça fait 33 ans que je roule en vélo. J'ai appris à les réparer un peu en regardant Mr Laurent (le vieux réparateur de quartier quand j'étais gosse) faire, et aussi en essayant moi même beaucoup. J'ai suis certes maître es science, mais mes cours de mécanique du point ne m'ont pas appris à devenir un pro du tournevis ou de la clé anglaise.

Les vélos de l'époque pré-obsolescence (aka pré-grande distribution) étaient simples.

Quand Auchan vendait ses vélos à 100Frs là où un peugeot valait 2000Frcs personne ne comprenait pourquoi même sans argent je refusais de les acheter: les filtages ne tenaient qu'une fois. Une visse dévissée était irréversiblement non revissable. Comme un meuble ikéa dont les mêmes clients sont si friands. Et c'est ainsi que les Peugeots sont morts; non de par une volonté délibérée de faire des vélos obsolètes, mais par le refus des clients d'acheter des vélos réparables. Pourquoi? Parce que ils pensaient que la réparation c'étaient pas leur problèmes, ils avaient les réparateurs comme Mr Laurent. Pourtant ses mêmes acheteurs aiment en «meeting» avec leur «managers» évoquer ce que les comptables appellent le coût total d'un produit, celui qui inclut l'achat ainsi que les coûts liés à sa maintenance sur sa durée d'utilisation prévisible. 

Mr Laurent a du faire face à une montée de vélo plus dur à réparer avec des clients irascibles refusant de payer le surcoût en temps dû à la qualité de erratique de leurs vélos.

Mr Laurent a fermé. Personne ne voulait acheter ses vélos trop chers et tout le monde finissait par préférer décathlon blindés de réparateurs au SMIC qui préféraient remplacer des pièces entières que de perdre du temps sur leurs vélos de merde.
Localement l'atelier réparation était en perte, mais globalement pour le magasin ça assurait l'image de marque de vélos fiables de réparateur aimables et compréhensifs et ça donnait confiance. Le premier actif d'une entreprise, c'est l'image que les gens s'en font. Decathlon faisait de la concurrence déloyale, mais un crime sans victime parce que les victimes sont heureuses de cette situation n'est pas un crime.

25 ans plus tard qu'est-ce qui a changé?

C'est la mode des fixies, tout le monde a et veut faire du vélo.

S'asseoir a une terrasse avec des néos athlètes urbains me fait sentir comme un étron au milieu de la moquette : que sais je de la chasse de mon guidon, de la supériorité du frein à disque sur le tirage central, du roulement fixe sur le libre, de l'impact sur l'inertie de 15g de pneus en plus?  De la supériorité du carbone sur les cadres manganèse ou titane.

Rien. Je roule toujours avec les mêmes vélos car j'ai convergé par plaisir et fainéantise vers des modèles de course pré 2000 dont j'aime la conception, l'assise, la maniabilité, la robustesse. 

Rien, j'y connais certes rien, mais je sais que je veux des Shimano à doubles pivots brevetés et non des pivots simples parce que sinon au fur et à mesure du temps ils se décentrent et frottent contre la jante. Mon savoir se limite à mon expérience. Je ne parle pas des vélos comme un livre.


La seule chose que je sais c'est que plus aucun réparateur ne sait mettre de fond de jante: c'est 90% de l'origine de mes 10 dernières crevaison. Un geste que j'ai vu Mr Laurent faire : c'est simple mais ça demande du soin et de la patience ainsi que des bandes taillées droites. Et le temps ... c'est de l'argent.

Je sais aussi que ces réparateurs à la petite semaine ne dureraient pas longtemps si et seulement si les clients au lieu de faire savoir qu'ils n'y connaissent rien se retroussaient leurs manches pour apprendre à faire avec leurs doigts tout fins d'intellos des tâches aussi simples que gonfler leurs pneus, changer la guidoline, gaines et cables, chaines...  Si ils le faisaient, ils comprendraient que le temps c'est de l'argent, et qu'autant par leurs choix de vélos chers et ineptes que par le temps non rémunérés qu'ils font perdre à des artisans sous payés du fait de leurs choix ils condamnent les réparateurs à crever la gueule ouverte sous leurs flots de récriminations injustes quand aux coûts des choses.

Notre éducation survalorise la mauvaise éducation, le mépris du savoir faire des métiers manuels aux profits du faire savoir des ingénieurs et commerciaux. Par exemple, si je voulais m'installer professionnellement, non seulement je devrais passer un examen validant que je connais non les gestes, mais les mots du métier, mais en plus il me faudrait acheter des murs, et payer pour m'enregistrer avec le bon code APE. Choses qu'étant fauché comme les blés du Vexin en ce moment je ne peux faire. Pourtant, je peux réparer mon vélo.

L'obsolescence est certes programmée, mais non par la production, mais par les choix des consommateurs qui entraînent que ma lutte contre l'obsolescence me pousse à faire 60km pour trouver des pièces à 20€.

Il n'y a pas de mal à ne pas savoir faire, mais confondre ses connaissances avec son savoir faire et imposer du fait du statut conféré à des artisans et producteurs des prix déraisonnables entraînent un marché où le plus filou gagne. L'obsolescence «programmée» n'est pas due uniquement aux vendeurs, mais essentiellement aux acheteurs dont la myopie intellectuelle derrière les lunettes roses de niveaux de diplômes élevés entraîne une mésestimation des coûts. Et l'argent c'est le nerf de la guerre contre les mauvais acteurs.