Demystifying JSCrush

Some of you may have seen Philip Buchanan’s award winning. Autumn Evening entry for JS1K 2012 Love. While skimming the source I saw that he had used Aivo Paas’s JSCrush to compress the code. The JSCrush website is intriguing with the source code minified and then passed through JSCrush itself (so it can be submitted to JS1K). The JSCrush version used in the page, in <script> tags is the JSCrushed version. As a weekend project I tried to ‘reverse engineer’ JSCrush and understand it. It took me about 4 hours. What follows is a walk-through of the process.
JSCrush is a very interesting JavaScript program, liberally abusing eval(), global variables and insane levels of nesting to achieve a sort of compression.
Remember that your browser’s web development tools are indispensible for activities like this. I made extensive use of Firebug.

The de-obfuscation

I chose to start with the compressed version in the <script> tag rather than the plain text in the upper text field.
The syntax is clearly wrong for JavaScript, and it is all stuck in a string assigned to _. The part at the end is interesting though (properly formatted).
For every character in $ it is splitting _ on the character, using with to make the resulting array the scope. Then joining the pieces using the last piece and reassigning to _. For example:

_ = "HelloRWorldRCrushedRAB"
$='R'

var temp = _.split($) // => temp = ['Hello', 'World', 'Crushed', 'AB']
var last = temp.pop() // => last = 'AB',
                      //    temp = ['Hello', 'World', 'Crushed']
_ = temp.join(last)   // => _ = 'HelloABWorldABCrushed'

Remember this step, it is key to how JSCrush works. These steps are repeated for every character in $, after which the ‘decompressed’ output is the minified source code:
You can see this for yourself by putting a console.log(_) just before the eval(_).
Now we’ve a fair idea of how JSCrush is doing decompression. Compressed scripts are stored in _, decompressed using the loop and then executed using eval().
The next thing I did was to un-minify the source (manually):
One change I’ve made is the call to setTimeout(). I’ve converted it to a function to make it easier to read, and directly used the script tags innerHTML, since I had the decompressed source in the tag. The JSCrush code generates the textareas and button as part of it’s run and assumes body.children[9] to be the <script> tag with the JSCrush compressed source. Hence it replaces the eval call with the program source itself so that the inner eval() call in setTimeout() extracts the decompressed source and puts it as the value of the first textarea. It then calls L(), the JSCrush crushing function to compress the original code back, so that you get the compressed version of JSCrush in the lower text field. Mind-boggling.
The setTimeout() without a time simply causes the code to be executed after the script has finished evaluating completely.

Understanding

Now that we’ve decompressed code, it still has the scars of minification – single letter variable names and no comments. Time to start reading the code. Line 1 is just setting up the HTML for the user. Lines 2-4 is the first interesting piece. The array Q is being populated with all the ASCII characters, in reverse order! The characters \n, \r, \\, ' and " are excluded, as are \0 and DEL, so that Q has 121 characters. Rather than using a readable if statement, Aivo is using the fact that && is ‘short-circuiting’ in JavaScript. Much space saving here.
Next we come to the definition of L. Line 12 just removes blank lines, whitespace and single line comments (except those following code). It also escapes backslashes so that the code is ready to be put into a string later. This is assigned to the letters i and s. Be warned from here, in the goal of smaller size, variables frequently change their meaning to promote reuse. s is always going to point to the code, but i is used as a counter all over the place.
Next, B is half the length of the program, m is the empty string. Line 15 is where it starts getting interesting. The pattern:

encodeURI(string).replace(/%../g, 'i')

occurs thrice in the code. Its task is to get the byte length of the string rather than the number of characters that string.length gives. In ASCII there is no difference, but if there are Unicode characters, they may occupy 2-4 bytes. encodeURI will replace each byte with a ‘%xx’ code with xx being the hexadecimal byte value. Replacing this with the single letter ‘i’ will get us one ‘i’ for every byte, so that the length of the resulting string is the byte length. This was one of the many clever tricks present in the JSCrush code. They might be well known, but this is the first time I came across it.
The initialization in the for loop is only to save a byte, it does not affect the loop itself in any way. Similarly the m = c + m call can be moved to the end of the loop body. This construct will generate the decompression sequence contained in $. This for loop is then actually an infinite while loop.
Line 43 is again a trade-off of readability for size. Here it is in a cleaner form:

c = 0
i = 121
while (!c && i) {
 if (! (~s.indexOf(Q[i])))
  c = Q[i]
 --i;
}

~ is binary NOT. If Q[i] is not found in the source, then indexOf will return -1, NOT -1 = 0 and !0 === true, so that this code is actually saying:

For every character Qi in Q in reverse:
    If the source does NOT have the character in it:
        c = Qi

Or, c is set to an ASCII character that is not present in the program. Initially it will be ASCII 1, then perhaps 2 and so on. This ‘c’ is now the character that will be used to join the pieces obtained in Lines 20-32. This is one round. When all the characters have been used up, compression stops (Line 18).
Lines 12-32 basically try to find long, repetitive strings that can be replaced with a single character, to get the best compression. JSCrush follows a brute-force approach to find these segments. With single variable names, the code is a mess, so here is a cleaned up version which makes things much clearer:
Lines 9-28 try to find segments which repeat atleast twice in the code. Longer segments will give better compression, so we try all of them. For segments of length 1, we try every character in the string, for segments of length 2, we try every pair and so on. If it repeats we keep track of the segment count.
The segmentLengthBound = longestSegmentLength (B=Z) bit is interesting, and it took me some thinking to figure it out. It relies on the following facts:

• The longest segment in the current source is longestSegmentLength.
• Splitting by something, and then joining by a character not in the source will not lead to creation of longer segments.

So we can restrict segmentLength of the next round to segmentLengthBound.
Lines 32-41 choose the best segment to substitute in this round. The expression (R=o[i])*j-R-j-1 may seem cryptic, until you look a little later in the code where the split and join is done, and you remember how JSCrush works. R * j is the number of bytes we will remove by replacing this segment. But to join the split, we’ll need one character for every repetition, followed by one character to separate the segment suffix itself. The conditional asks if this leads to actual, and better, compression than what we already know of. If no such segment was found, we are done compressing. Otherwise we split by the segment, join the pieces by the join character and tack on the segment at the end. One round done!
Once multiple rounds have been done, the script is compressed, and only some trivial things remain. The value of B is now changed to store the quotes (double or single), based on which are fewer. Since the compressed program is stored in a string, using the quotes that appear less times means less ’\’ to substitute, each of which costs a byte. We then prepare the boilerplate, setting _ to the now compressed source, setting $ to the decompression sequence m and adding the evaluation code. The savings accomplished are announced too.
One trick I picked up in the code is forcing a certain digit view precision.

i/S * 100

would give a float percentage with many digits after the floating point. Instead multiplying by 1000, gets us two digits in the integral positions, bitwise OR-ing with 0 casts to an integer, losing the floating point digits, then dividing by 100 gets us the two digits we want.

Summary

JSCrush works by:

1. Finding the first unused ASCII character to act as the join
2. Finding the substring of the program text that gives the best space savings if its repetitions are all replaced by the ASCII character from 1.
3. Splitting the source on 2 and joining the pieces using 1, tacking on 2 to the end. This string replaces the original source.
4. Repeating 1, 2 and 3 until no more savings are possible or we’re all out of ASCII.
5. Wrapping the compressed source into a string, then using the list of join ASCII characters to unroll the string.
6. Unrolling is performed by splitting on every ASCII character used in 3, extracting the original repeated substring 2 from the split and joining the parts.

I hope this (long) post was interesting and educational. If you have feedback, a comment would be great.

I'm scared for the Internet

(This article was written for Entelechy Edition 33 (February 2012). The news is slightly old, but posted here so I have a public permalink to the article)

When the Internet began over 30 odd years ago, it was an ideal of democracy. Born in universities, where only meritrocracy ruled, it was used by hackers whose ideals were very egalitarian. In its very protocols, the Internet encodes equality. No piece of data is considered more important or more dangerous than any other.

Even as the World Wide Web exploded some 20 years ago, it retained the ideals of the Internet, although in some sense these very ideals led to corners of the web which were just evil.

Of course, as the Internet went global and required physical infrastructure and government permissions, what you could and could not do became much more controlled. Child pornography was plain illegal, but freedom of speech was not, often because much of the core architecture and servers were based in democratic countries who were benefiting massively from the Web.

Of course the web came along and made piracy much much easier. As Paul Tassi states in Forbes, piracy is a 4 step process, while any conventional means of media consumption from the Old Big Media Houses is way more inconvenient. With laws differing across borders, delayed releases, abominations like DeCSS and so on, it was far easier to use a general purpose computer to circumvate all these measures.

In the last few years however, piracy and freedom of speech has come back to bite us. Rather, it has come to haunt the old bastions of power, governments, religions and media publishers. Faced with a series of attacks, the Web is now caught between the devil and the deep sea. On one side is the battle for intellectual property. On the other hand are repressive governments (even so-called democracies) where certain factions wish to curtail the one medium that is impossible to truly shutdown.

There are also the silos of Facebook, Google and a thousand walled App Gardens that are eating mouthfuls of our data and keeping it behind closed doors. They aren’t the worst part though.

I’m not scared that the Internet will die, but I’m scared that it could lose its essence. The essence of freedom, of equality, of opportunity and communication that has brought hope to many and improved countless lives immeasurably. If we the common people keep lying down as our freedoms are taken from us, we will lose the one chance to truly step into something new, to fully embrace human potential, and go back to watching the shiny rainbows on Blu-ray discs whose only use is as coasters. It is not as if we are powerless, we just need to be educated. After all in the case of SOPA/PIPA, mass protests were effective in sending the bill for reconsideration.

It is no secret that politics is financed by capitalists. Much of this money flows in from media conglomerates and thus politicians are puppets when the MPAA or RIAA decide to take out their battle axes on pirates. What the old media does not realize is that the Internet has levelled the playing field. It is now possible for anyone to publish high quality content. Rather than focusing on making it cheap and easy to spread their content, so that most users will be willing to pay for it legally, they continue to impose draconian laws on sharing, copying and accessing their media. The solution – piracy. When technologists like Netflix, Hulu and Amazon try to make it ever easier, they crawl back into their shells. A perfect example is HBO’s Game of Thrones.

There are fundamental problems with new bills that are tabled to deal with piracy. These laws are often framed in secret in a nexus of politics and old media houses, most notably ACTA (the Anti-Counterfeiting Trade Agreement), rather than in public scrutiny where rights groups and the general public can see what is happening. It was only as ACTA started to get ratified around the world that people realized what is happening. The result – plenty of EU countries have seen protests that have led to ACTA being put on hold. What is laughable is that the United States actually rejected Right to Information requests saying that it could be a threat to national security. The second problem is that all copyright laws have always focused far too much on tightening copyright regulations, and what it means for something to be copied, what requires royalties and what requires permission. Copyright was initially a way to give creators sufficient returns for their works, not how can I get the maximum money out of this. By tightening the noose, it is getting harder for artists to re-use other’s creativity to create even better works. In addition every anti-piracy effort has put costs on innocent third-parties, taken huge cuts from taxpayers money, and pushed technology that had non-infringing uses out of the market. For example, BitTorrent is a fascinating technology with huge potential for better Internet services, yet it has achieved negative connotations due to its use for piracy. In the aggregate, they reflect a disproportionate focus on the interests of a handful of large companies. It’s hard to think of a single example during this twenty-year period of copyright restrictions being repealed, relaxed, or any in any meaningful way liberalized. Finally, there is a great paradox between the Western world’s constant demands for the right to free speech on the Internet and the principles embodied in stronger copyright laws. For example, SOPA’s feature of allowing the shutdown of arbitrary websites without judicial hearing, ACTA’s removal of safe harbour protections and the outlawing of circumvention technology leads to the internet quickly toeing the line with new regulations. Ironically, even as SOPA seeks to outlaw technology like Tor, the US Department of Defense actively funds its development to help activists in repressive regimes like Iran.

The Internet has now reached its prime, e-commerce is commonplace, startups for media distribution are blossoming all over, our identities are now better known by Facebook and Google than by our Governments. Power and opinions flow over wires, free of the meddling of higher-ups. This is leading to politicians and other old bastions of power (cable TV, telephony) feeling lost, and so they are taking concrete steps to clamp down on what they consider a menace. They then repackage it and sell it to the public as ‘stealing’ or ‘content that can cause public unrest’. Caught between these two forces, the Internet could become a nanny state in the next few years.

Over 20 years after an international agreement that deregulated the Internet and led to a meteoric success story of capitalism and free markets above all else, the United Nations plans to establish “international control over the Internet”. In December 2012, Russia, China and others will push for:

• allowing ISPs to charge ‘international’ fees for Internet traffic - this is just absurd. By its very nature the Internet is not supposed to have ‘boundaries’. It goes completely against Net Neutrality
• Subsume under governmental bodies many of the tasks of the Internet Engineering Task Force, the Internet Society, the Internet Corporation for Assigned Names and Numbers and others. These bodies currently operate solely on merit, technical competency and democratic votes, and as private bodies are free from governmental interference.

among others. Censorship is emerging stronger and stronger. Censorship across the world has been well covered, and I will not go into the details. Two things are relevant though. One is #IdiotSibal’s attempts at getting social networks to take down ‘offending’ content. It seems in our bid to compete with China, we’ve decided to one-man up them in censorship too. Shivam Vij has very correctly stated in Kapil Sibal doesn’t understand the Internet,

So Sibal and Tharoor think social media can cause riots, but it hasn’t actually done so yet. Now that Sibal and Tharoor are telling us there’s stuff out there that could make us kill each other, some of us will go looking for it out of curiosity and…

and

In neighbouring Pakistan, every Tom, Dick and Harry with complaints of online hate speech approaches the Lahore High Court. In India, Kapil Sibal wants to be the high court.
He wants to be judge, jury and executioner. And he wants to do it silently so we don’t get to know.

Google’s Transparency report on India clearly identifies politicians lack of ability to accept criticism.

In addition, we received a request from a local law enforcement agency to remove 236 communities and profiles from orkut that were critical of a local politician.

In the private sector, Reliance Communications has taken it upon itself to be the moral and economic guardian by obtaining ‘John Doe’ orders from a local court to ban file sharing websites in the days around a movie release. In sheer violation of Indian law which states that only the Department of Information Technology may request censorship, they then went and blocked websites country wide. It was as if SOPA was already passed in India. A John Doe order is the type of insanity that you think can only happen in movies until some lawyer actually dreams it up. Multiple, unknown, offenders can be acted against. Interestingly while Reliance stated that they were within law, no actual complaint was recieved. The court order and ban was based on speculation. I sent a Minority Report Precrime in action.

In retrospect there are 3 things (amongst others) that threaten the future of the Internet as a ‘commons’: Net neutrality, draconian copyright-laws and censorship. There is only one thing stopping that from happening - YOU.

Further reading:

• Free Culture: How Big Media Uses Technology and the Law to Lock Down Culture and Control Creativity by Lawrence Lessig
• If Not Orwell, Then Huxley: The Battle for Control of the Internet
• Enough, Already: The SOPA Debate Ignores How Much Copyright Protection We Already Have
• The U.N. Threat to Internet Freedom

The IT Crowd?

(This article was originally published in Entelechy, edition 32, Jan 2012. It is being published here in full with some annotations.)

It has continued to surprise me over the last 3.5 years how few information technology students actually bother to use the innovations of information technology to improve their productivity in any manner. More importantly, they are usually unaware of the products themselves. Recently the issue was brought to the fore when Skish Champi pointed out that Zimbra Collaboration Suite had great calendar integration (and I agree), and we as a college are still struggling around with sending meeting emails and reminders.

We are all experts at using DC++ to share files over our network. Yet, when it comes to sending the same files over the Internet you still stick to (gasp) e-mail. If you send me a 50Mb file over email in 2012, I’m going to knock on your door with a gun in my hand. Use Dropbox or a thousand other such services. You only need to upload once, your multiple devices can continuously sync the files, individual folders can be shared with individual people — this is great for working on projects and such. In addition Dropbox keeps old versions around. Heck, using the Public folder you can even host a complete static website without paying a paisa! Once your file is on Dropbox you can go trigger happy with the public link and send the link in the e-mail instead. Less load for the e-mail servers, and the link can easily be shared via any other medium too.

Similarly, if you are in charge of planning a lot of events (looks at the committees and clubs and faculty), create a new Calendar event in Zimbra and send it to all batches. That way a student simply has to accept the invitation, and he will also occasionally get reminders. Synced with a desktop Calendar application, you can even have your computer play sounds or show messages even when webmail is not open. Now you have no reason to forget or be late for a meeting.

If you are working on a software project, and your way to ‘work as a team’ on the code is to ship around newer versions of the files to everyone via e-mail, your project is already dead. Why? What happens when you suddenly need an older version? Or one feature from Amrita and the other one from Rajni? Spend your time copy-pasting? Let a version control system do it for you!

I’m going to mangle The Unix Philosophy slightly to suit my purposes:

• Use software that does one thing, and does it well.
• Use software that does not lock your data in, or modify it so no other software can use it. A hyperlink should always be available.
• A software which allows its output to be the input for another program, is usually better than one that doesn’t. An API can do wonders.
• Understand your work flow. Don’t hesitate to throw away the clumsy parts.
• Use tools in preference to manual labour, even if you have to detour to build the tools.

So why do we continue to use legacy technology, mouse around and generally not maximise our use of the computer?

One reason is of course inertia. Our biological brains are always trying to survive and if one thing works we aren’t willing to go improve. Another is a lack of curiosity about wanting to hear about new technology.

But it is also an attitude problem. Technology continues to be the poor step-daughter. If someone shows you how to skin potatoes faster, you’ll quickly adopt the technique. But as soon as the metaphor moves onto the computer, there is immediate unwillingness. From the very beginning of our computer education we’re asked to treat the computer as some magic box, and restricted from doing anything outside of that ‘education’. “Usse haat mat lagana nahi to kharab ho jayega.” is what your parents/teacher says. (English: Don’t touch that, you’ll break it). We carry over this belief that computers are frail creatures even when we become more responsible. The second reason is that the internals of computers continue to be treated as unknowns for much of the population. Most people who drive a car have a qualitative idea of how an internal combustion engine works. They also know how to change a tire. But the same people don’t know how to add RAM or the basics of a processor. Worldwide, computer literacy focuses on office suites and the like. Even when you do eventually study the internals, they remains something from the textbook, so that whenever your C program is malfunctioning you don’t once bother to think in terms of how that program is being interpreted in a certain way, and how that can help solve the problem. This disconnect is alarming, I’ve seen computer science professors being unaware of basic computer features. The funniest example I can think of this is when Windows users keep right clicking on the desktop and hitting Refresh when things aren’t moving.

The media is also responsible. World news is quick to highlight the policies and laws that will affect say, retail, or corruption or some industry. Technology media however is focused on product reviews and the next revolutionary technology (which is usually some old concept re-hashed), and sidelines actual problems which will impact privacy, ownership and other fundamental rights in the digital age, so that the notion of computing in itself is never given enough attention by the general public. If car manufacturers specified which brand of fuel you could use in their cars, there would be a hue and cry over anti-competitive behaviour and not giving choice to people. Yet mobile phone carriers fleece people every day with locked, underpowered cell phones. The war on computation keeps going the wrong way.

I also believe, that just as in mathematics, computers require significantly more complex mental models to be manipulated in the mind. A car engine is heat and metal and chemicals and can directly be observed doing something. The levels of abstraction between the electrons racing through the wires and the point and click metaphor of daily interaction are numerous in comparison. As a user you do not of course need to have any inkling of them, but even at the software layer, a computer desktop is much more congested and much less tangible. Most normal people seem to keep missing subtle user interface clues that convey meaning. To those with the mental ability to hold these models and think rationally and logically (the only way in which the computer can think), the paradigms are much clearer.

But as ICT students you are expected to have that mental ability. The first thing to do is to lose fear of the computer. Modern operating systems and applications are robust enough so that they won’t go down just due to clicking in the wrong place. Experiment with preferences, try buttons which have only icons, many a feature can be discovered this way. Second, internalise the knowledge as much as you can by always trying out new things yourself, until they become second nature. Third, think through what you are doing rather than just clicking as your friend told you to. Fourth, remember that like in all engineering disciplines, convention is implicitly followed in computing as well. So concepts you learn in one application (say drag and drop) can be generalized and applied everywhere. Fifth, start thinking of computing tasks as recipes. In cooking, you apply a series of tools, to transform various inputs (ingredients) to the final outcome. The output of the knife becomes the input of the frying pan. On the other hand, most software normal people use tends to be monolithic, one tool that will do all the steps. Good software on the other hand has separate knives and separate frying pans and allows a great deal of flexibility. The Unix command line is the most pervasive and powerful example. Sixth, keep your eyes open for new ways of better using technology. Blogs like lifehacker are an excellent source of such tips. Seventh, pay attention when governments and companies try to cripple your right to compute and the right to information.

With a little active effort, you streamline your computing experience, so that you can devote complete attention to the fantastic things you create.

Posted via email from nikhil's posterous

Why Indian students should attend college

In recent months, the number of posts extolling dropping out of college, or of people recounting their experiences (mostly positive, probably because the negatives won’t share) has increased substantially on Hacker News (I believe Steve Jobs effects on humanity extend here too). Meanwhile the The Story of Average Indian ‘Techie’, What’s your GPA? and other posts bring to the fore some things I do agree with:

• Most computer science curricula are outdated or just poor quality
• The majority of students are in it for the money
• The professors are almost always bad

In fact I didn’t particularly like most of my CS courses either. There were a few gems like System Software and Computer Networks at DA-IICT, but the rest were totally out of sync with the real world. So if you are a precocious hacker should you drop out of college in India? (Assuming your Indian parents will let you do that!)

NO!

Try your utmost to get into a good college with good infrastructure. Here is why you would want to do so. Not only is the infrastructure itself important, it also attracts the smartest people. Do well in college while improving your own skills and knowledge.

My reasons are based on personal experience, and in ways document some of my shortcomings too :P

Like minded people

Unlike the dense technological concentration of Silicon Valley, India doesn’t have technological hotspots. Even in Bangalore, very few people are passionate about technology and are hacking on open source software or launching startups (while this is pretty high in India terms, it is nothing in Bangalore terms). FOSS talent is instead concentrated in the students of engineering colleges. (I focus on FOSS because it’s a good way to filter out passionate people.) You will get to discuss problems, hack on code and be inspired by these people. A concentration of geeks also leads to geek events like hackathons. During various college fests there will be programming contests and so on. You’ll get to have fun. Finally there will be a lot of smart people doing things other than computer science. But they will be equally as passionate as you are, they will be liberal and forward looking and it will be a pleasure to interact with them. Oh and please don’t think of every person you approach as a potential future employer, employee or general networking and increasing contacts kind of person. Sometimes you (and certain people in the Valley too) just need friends. Face it, do you want to spend the next few years talking to your mom about why REST-ful APIs are the bomb or why this is funny?

Facilities

High-speed Internet access in India is still not too common, but colleges will usually have a great LAN setup, a lease line to the Internet and generally good connectivity. Use these to experiment with your peer-to-peer applications, host websites, or write the next great DDoS program (I’m not advocating this). That said they also may have ridiculously bureaucratic system administrators, censorship and the like. You just have to deal with in (and in some cases, circumvent).

Your college will also have a certain ‘relic from the past’ which is far more useful than any of our modern day, 140 characters technology. The library. Specific technology education is always best done via Internet, but general concepts and deep theory is still found in books. Use it well, you will regret the day you leave college and books will have to be purchased. (To overseas readers – there is hardly a public library system in India.) Oh, and do remember the fiction section.

Motivation and Persistence

When you are working on personal projects it’s very easy to give up or change tracks. You also tend to focus only on the things you like. College courses will force you to persist at subjects you don’t like, and keep you onto one thing for 3-4 months. Valuable lessons when your first commercial project is 90% done and you don’t want to polish it up because node.js just came along and is much more fun to play with. Do a great and challenging final project and end your education on a high note.

Find some other interests

Your life isn’t going to be just about CAP theorems, cache invalidation and naming your projects. You will have to interact with society. Take a humanities course. Learn to loosen up a bit — travel, listen to music and play sports. Waste time with friends once in a while. Don’t burn out before you’ve even started. Your whole life before 25 should not be spent being a workaholic. Sometimes I think the Valley propagates Minimum Viable Product, pitching to VCs and beer and pizza far too much. You don’t want to end up like this. You might also want to try some of these things.

So if you were thinking of dropping out, just give it a second thought. If you are still convinced you should drop out, do it. But please let me know at nsm.nikhil@gmail.com why you did so.

Posted via email from nikhil's posterous

Have some humanity

This article was first published in Entelechy (Issue 29, September 2011), the in-house DA-IICT magazine.

---

“Technology [is] the knack of so arranging the world that we don’t have to experience it.”

-- Max Frisch

DA-IICT is one of the few colleges in India to make humanities courses mandatory for students. It is sad then that most students treat it as a course to pass, and not as a way to gain insight into the world they’ll spend the rest of their lives in. I am going to try to convince you that humanities courses are perhaps more essential than even the technical courses.

Observe the typical young engineer as he gets placed and eventually graduates from college. Engineers used to have dreams. That is why we have the Taj Mahal and the Golden Gate bridge. Today the most skilled engineers end up sitting at a desk writing non-user-friendly software for some mega-corp. Or they start a startup which aims to make another form of real communication virtual and ‘social’ without considering the repercussions.

The humanities have always been a has-been simply because they offer no financial value. A poet does not produce a life-saving vaccine or the next Fortune 500 company.

The fundamental schism lies in the fact that engineers want concrete answers to problems, while the humanities never answers anything. It is about concepts and interpretations and I think engineers find that hard to fathom. Trust me, try it once, it is fun.

We engineers are children of the binary, decisions are absolute, choices are fundamental. That is not how the real world works. The humanities teach us to look hard into those gray areas, and how they end up shaping history. I remember in the Environmental Studies class when the professor remarked that in the case of the Narmada project, you could not simply relocate the tribals. An economist or engineer is trained to see the world in terms of resources and equations and profits and margins. Our problems are so simple. We think that by throwing more hardware at it, or building better technology things will fix themselves. That to build a dam, we can simply move the people out and give them good homes. But we have no way to measure social cost. So the moving of tribals seemed a trivial problem. But the land they live on has been theirs for thousands of generations and they associate traditions and religion with it. It would be like evicting you from your home. All technological problems are finally attempts to improve society and the context in which they are implemented is essential.

Even if you don’t want to be the decision maker or ideal citizen or a analysis spewing geek when all that your friends wanted to watch in the movie was the explosions, there is one concrete reason that you should take atleast a few humanities courses.

Writing. The Indian education system especially thrives on canned solutions for much of school. Even the technical courses in college do not require writing papers or projects. But much of real-world engineering today is a team activity where written communication is a very important skill. For all your career you will be writing documentation, making reports and presenting findings to your boss. A good command of English and an ability to deliver crisp writing can help immensely. The humanities courses will be the only ones where you will have to analyse some aspect of art or literature, critique it and back up your opinions with arguments. Since you can’t do a copy-paste in humanities (since it doesn’t have any concrete answers), it is a good lesson in writing.

Finally remember that as bits seep more and more into our lives, our cultures are framed by the file formats and user interfaces and other mechanisms that we will make. And they will enforce the way we think. Do we want to end up in Orwell’s 1984 or Huxley’s Brave New World? Facebook friends vs real friends, privacy vs sharing, customer-friendly or corporate-friendly, patent laws and other important ‘wars’ are going to start erupting. Yet I find engineers have no awareness for any of this as they sit in their cubes creating the most widely propagated products that ever existed, constantly connected via a medium whose drivers are human. All these are areas where theologians and philosophers and lawyers have been arguing for centuries, in the eternally fluid and muddy concepts of property, privacy and ethics. Except they used to be able to make these decisions before the technology spread. Now App stores and locked-in products arise everyday, social networks grow exponentially and international surveillance is easy as pie, and law makers cannot catch up, so the engineer will have to specify those decisions by product design itself. There you and I will enter into the indefinite world of humanities because these problems have never arisen before. Only someone who understands both technology and humanities can solve this, otherwise we end up with abominations like the Digital Millenium Copyright Act or Software Patent Law based on real patent laws when it doesn’t fit the software model. This requires an ability to mull over these concepts and use the various interpretations debated in the past and the present. In some literary passage somewhere may lie the perfect system you strive for. The times, they are a changin.

Posted via email from nikhil's posterous

Interning

DA-IICT 3rd year students usually do an internship in the summer. Good industrial internships are always hard to come by, although the situation is way better in IT than in other, more resource-intensive disciplines. 10 interviews, a hundred or so e-mails and lots of forms later this is part guide, part my internship search story. The first thing you’ve to decide is what kind of company you want to intern at. Most companies will have menial code jockey jobs which you don’t want. This is my first blog post typed out on the n900 for the most part while waiting for a flight home at Ahmedabad airport. What a keyboard!

Why not a GSoC again?

Having over two years of FOSS contribution and 7 years of usage and having done a GSoC previously, I could have done one again. While a GSoC is an invaluable experience, it is not the same as an internship. GSoC is excellent at improving e-mail communication skills and long distance collaboration and giving a feel of the open source development style. But it is not the same as going to office, talking to people, having lunch together and hanging out. In addition internships usually will be in a city or country other than the one you live so it can be a great excuse to explore a new place. So if you’ve already done a GSoC, getting a different sort of experience is way more important in my opinion. So I didn’t apply at all this year. Besides I was confident that my experience would serve me just as well to get into the kind of companies I wanted.

Have a good CV

Spell-check, design it well and put in only relevant things. If you are a good singer don’t put that in just to have stuff to show in a IT company. On the other hand positions of responsibility should always be highlighted. FOSS contributions top the charts in startups and other ‘cool’ or cutting-edge companies.

Start early

By luck or resolve my best move was starting to look for internships in December for an intern to start in May. Keep in mind that HR departments are busy places, resumes can take time to process and sometimes do get lost. Wait for a week for a reply when you submit your CV, then ping them aggressively on IRC, Twitter and e-mail to ensure you aren’t forgotten. Interview procedures can take upto a month and for international interns there are visa procedures that take time. Finally you are likely to get rejected by the first few and you should have time to apply for more. In any case companies with established internship programs have information available on their websites and start each season with prior planning.

Decide what you want to work on

The first two companies I applied to were Google India and RethinkDB. The RethinkDB folks were very positive about international interns. I had two interviews in early January which went ok. I was rejected, which in hindsight I know was due to me not really being passionate enough about what they were doing. So I narrowed down to the two specific interests I currently have.

• Javascript engines and low level APIs
• concurrency, distributed networking and web-scale computing.

and decided that I would only approach companies based on these work areas.

Stick to a few companies.

Interviews are always stressful because you have to think on the spot. If you are trying internationally they will be at very bad times (most of mine were at 6am and 10pm). Companies hiring solely on phone interviews will usually take atleast three interviews. In addition you will have to prepare atleast a bit for them. This adds up to a lot of things to do. So stick to a few companies at a time. Prioritise which company you want to work for if hired by multiples companies. When you agree for interview times, make sure you convert timezones properly and that you don’t have any appointments more important than the interview at that time. Finally, remember you have a life too :) I gave one of my interviews at conf.kde.in, and another during Synapse. At such times be very careful with scheduling.

Research

Off-campus internships (ie. ones you find on your own) are the way to go. The college will always aim for what is good for a majority of students, or towards established companies. But if your area of interest is niche you can do a much better job looking on your own.
Try to find out as much as you can about what interns do in the company. With some searching you can usually find blog posts of former interns which can be very informative. Talk to people in the domain. If you are a FOSS contributor ask fellow IRC users about intern opportunities or experiences.
Based on my areas I finally applied to:

• RethinkDB
• Google India
• Directi
• Opera
• Mozilla

I was very lucky to meet a former Mozilla intern at the MIT Media Lab COEP workshop in late January. Without that I would never have thought of it as I was unaware of the Mozilla Foundation and Mozilla Corporation dichotomy.

Be confident, but ready for rejection.

During the interview what matters most is being able to keep up a continuous stream of conversation going to show that you are capable of thinking. So if you tend to think mentally for 15 minutes and then produce the answer in a flash, it would be good to think out loudly. If you are confused, clarify the question, it does not penalise you. Remember that in interviews no one expects perfect code, and classes and documentation. If you miss edge cases thats fine, performance – not an issue until the interviewer actually asks you for a better algorithm. Graph and string algorithms are a favourite of interviewers. For algorithms the TopCoder tutorials are a good read. For C++, the C++ FAQ is invaluable. In fact I suggest always having that page open during the interview. For C++, templates and virtual functions tend to be a question spot. In addition, know the warts and good points of your favourite language. If you have FOSS projects, be ready to explain what they are, and how you implemented them. One favourite interviewer question is, “What was the hardest part to implement?”. In such a case be prepared to explain in as general terms as possible, since the APIs you use may not be something the interviewer has experience with.
A typical telephone interview will last 30 minutes to an hour. Half of that time will be the technical interview and the other half when you can chat with the interviewer. A full recap of my interviews with each company are beyond the scope of this article, but suffice to say that I was lucky to have extremely nice interviewers. Google insists on algorithmic questions which you’ll usually answer via a shared Google Docs. Remember that in a phone interview it is important to know how to approach the problem. Since you have access to a computer, once you know what to do, you can look up your existing code or use the internet. Just keep discussing the approach on the phone and speak with utmost confidence. The interviewer may try to misguide you. For Mozilla and Opera the interview was purely on former experiences and some C++ stuff. Use the chat time later well. Good questions to ask are about prior interns, what they do, how they find the company etc. If you know their name before the interview, see if you can find out about them on the internet.

Get to know and learn from the interviewers

My most memorable interview was the fourth one with Mozilla when due to some daylight savings confusion I was woken up by the interview call. Desperate to get myself sane, I asked him a few questions before I let him start the technical round. After that I spent 45 minutes discussing spidermonkey and Mozilla’s general plans with Luke Wagner. It was a very humbling experience. If you can show the interviewer that you are passionate about the products and do you homework, there final review is much more likely to be glowingly positive. Finally they can tell you about some implementation features, constraints etc. that can be interesting to know about even if you never join that organization.

Congrats, now get to work!

After all this, I hope you get selected somewhere. I can’t really write the part about how to handle it if you get rejected. So what happened to me?
The response order was:

• RethinkDB reject – January 16, 2011
• Directi reject – March ??, 2011
• Mozilla accept – March 22, 2011
• Google accept – March 25, 2011
• Opera reject – March 28, 2011

based on my interview experiences, stipend and location I opted for Mozilla Corporation! When I got the confirmation on March 22, it was unbelievable but I guess all the hard work paid off. The Mozilla folks have been really nice and punctual throughout the process, and damn they know how to take care of their interns :) I think a series of posts will of course pour out of me regarding the internship in the coming months. I will be working at Mozilla HQ in Mountain View, California from next week to the end of July. My first assignment is typed array implementation improvements in JavaScript so Firefox can perform WebGL, audio/video and binary data better. With Mozilla I found a great, FOSS friendly company, interesting work dealing directly with JavaScript engines, a new city to explore right in Silicon Valley and going to the United States of America for the first time ever. I couldn’t have asked for more :D

---

A note to DA-IICT students specifically! Our placement cell has an odd policy where when you apply for one or more internships through the placement cell, you are bound to accept the offer of whichever company accepts you first. So if a ‘better’ company delays their interviews, and a ‘lesser’ company hires you already, you are screwed.

Posted via email from nikhil's posterous

GMail Notifier on an Arduino

The exams are over and I've been hacking a bit on the Arduino today. So I came up with a simple hack which blinks an LED on the Arduino if you've got unread mails in your Gmail inbox. I assume that you're familiar with the basics of Arduino.

Equipment

• A computer with an internet connection


• Python


• pySerial


• Arduino ( I'm using Duemilanove )


• Red LED


• Pushbutton (optional)


• Wires
  

On the computer

A python script will run continuously on the computer, and fetch the Gmail RSS feed every few minutes. pySerial will be used to notify the Arduino of new mails.

Here are our imports and constants

# ~ Gmail Notifier for Arduino
# ~ This file is released under the public domain

import httplib
import getpass
import base64
import re
import time
import serial

INTERVAL = 5 # check every INTERVAL minutes

serv = 'mail.google.com'
path = '/mail/feed/atom'
# ask user name and password and encode them for authentication
auth = base64.encodestring(
                 '%s:%s'%(raw_input('Username: '),
                   getpass.getpass()))

So first, fetching the feed. We'll use httplib. Here is the code:

def getfeed():
  print 'Checking...'
  conn = httplib.HTTPSConnection(serv)
  conn.putrequest('GET', path)
  conn.putheader('Authorization', 'Basic %s'%auth)
  conn.endheaders()
  return conn.getresponse().read()

Next lets get the count. Gmail replies in the following format. In the case of new mails there is more information, but we don't care about that. We're mainly interested in fullcount.

<?xml version="1.0" encoding="UTF-8"?>
<feed version="0.3" xmlns="http://purl.org/atom/ns#">
<title>Gmail - Inbox for nsm.nikhil@gmail.com</title>
<tagline>New messages in your Gmail Inbox</tagline>
<fullcount>0</fullcount>
<link rel="alternate" href="http://mail.google.com/mail" type="text/html" />
<modified>2009-02-22T11:00:33Z</modified>
</feed>

So we'll use regular expressions to get the count.

def count(data):
 matches = re.findall('<fullcount>([0-9]+)</fullcount>', data)
 if len(matches) == 0:
     print 'Error in parsing feed, check user name and password are correct'
     return 0
 return int(matches[0])

We'll need to write this to the serial port.

def writeSer(data):
 try:
     # the best way to find this out is to launch the Arduino environment
     # and see what it says under Tools -> Serial Port
     ser = serial.Serial('/dev/ttyUSB0')
     ser.write(data)
 except serial.serialutil.SerialException:
     print 'Error writing to serial device'
     raise

Now that we're done with the functions, it's time to make them work together

# subtract so that we check first time
last_check = time.time() - INTERVAL*60

while True:
    if time.time() - last_check < INTERVAL*60:
        continue
    last_check = time.time()
    msgs = count(getfeed())
    print msgs,'mails'
    writeSer(str(msgs))

Thats the computer part.

On the Arduino

The circuit :



The LED is on pin 13 and goes to ground. The button takes 5V through the power pins on the analog side, via a 220 ohm resistor. The other leg is grounded. Pin 4 can be used to read the state of the button. The wire from pin 4 connects to the 5V leg of the button.

The code is dead simple and so is presented together.

int ledPin = 13; // connect led to digital pin 13, or use default small one
int bPin = 4; // connect button to digital pin 4
boolean blink = false; // holds our current state

int INTERVAL = 200; // led blink rate in milliseconds

void setup() {
  Serial.begin(9600);
  pinMode(ledPin, OUTPUT);
}

void loop() {
  if(Serial.available() > 0)
    blink = Serial.read() > 48;// 48 is 0 is ASCII

  if(digitalRead(bPin) == LOW) // button pressed
    blink = false;

  // blink is true if we got serial input
  // or we had got serial input and button hasn't been pressed yet.
  if(blink) {
    digitalWrite(ledPin, HIGH);
    delay(INTERVAL);
    digitalWrite(ledPin, LOW);
    delay(INTERVAL);
  }
  else
    digitalWrite(ledPin, LOW);
}

The button is used to switch off the blinking once you've noticed that you've got mail and don't want it to keep blinking till the next check.

Running

Verify and Upload the code to the Arduino. You can try entering numbers in the Serial Monitor to check that the circuit works. Remember to switch off the Serial Monitor.

Now start your script, python mailarduino.py. Enter authentication details. Now sit back and relax... oh wait, you've got mail.

Full python script ( mailarduino.py )

import httplib
import getpass
import base64
import re
import time
import serial

INTERVAL = 5 # check every INTERVAL minutes

serv = 'mail.google.com'
path = '/mail/feed/atom'

auth = base64.encodestring(
                '%s:%s'%(raw_input('Username: '),
                getpass.getpass()))

def count(data):
 matches = re.findall('<fullcount>([0-9]+)</fullcount>', data)
 if len(matches) == 0:
     print 'Error in parsing feed, check user name and password are correct'
     return 0
 return int(matches[0])

def getfeed():
 print 'Checking...'
 conn = httplib.HTTPSConnection(serv)
 conn.putrequest('GET', path)
 conn.putheader('Authorization', 'Basic %s'%auth)
 conn.endheaders()
 return conn.getresponse().read()

def writeSer(data):
 try:
     ser = serial.Serial('/dev/ttyUSB0')
     ser.write(data)
 except serial.serialutil.SerialException:
     print 'Error writing to serial device'
     raise

last_check = time.time() - INTERVAL*60 # subtract so that we check first time

while True:
    if time.time() - last_check < INTERVAL*60:
        continue
    last_check = time.time()
    msgs = count(getfeed())
    print msgs,'mails'
    writeSer(str(msgs))

Custom hash objects in Python

It's quite common to use strings, integers and other 'native' Python data types as hash keys. But sometimes it is much easier to be able to use your own class instances as keys. Python's magic methods allow you to do this.

Note: This is not a tip on implementing hash functions, this is how you can remove a certain layer of peeking around into objects

__hash and __cmp__

Consider a useless HTML parser with a simple node design where you want to associate the node name with its attributes.

You want to use the absolute node name as a unique hash.

The solution is to define custom implementations for __hash__ and __cmp__, two magic methods. For more information and constraints about them take a look at the Python docs.

The builtin functions hash(obj) and cmp(obj1, obj2) will attempt to call there __underscored__ counterparts on objs.

import UserDict # allow NodeAttrs to behave like a dictionary, not significant for this example

class NodeName(object):
  def __init__(self, name, parent=None):
    self.name = name
    self.parent = parent

  def __str__(self):
    return (parent and str(parent) or '') + self.name

  def __hash__(self):
    # the hash of our string is our unique hash
    return hash(str(self))

  def __cmp__(self, other):
    # similarly the strings are good for comparisons
    return cmp(str(self), str(other))

class NodeAttrs(UserDict.UserDict):
  def __init__(self, attrs={}):
    self.update(attrs)

Where we assume that the parser is doing the heavy lifting of parsing the name, and putting the attributes in a dictionary. Now to use this in a dictionary you would do the following:

>>> d = {}
>>> d[node_name] = attrs # node_name is an instance of NodeName and attrs

... # do anything which can be done to a dictionary and its keys

Thats it! For more magic methods see Python __Underscore__ Methods

Programming: What they don't teach in school

This is my honest opinion, feel happy to flame or contradict me, but be polite.

Much has already been written about how much High School computer science teaching sucks ( High school computer science education ). As a student who has just left high school I just wanted to present my 2 cents on how bad the seperation between RealWorld programming and ClassRoom programming is. A common rebuttal is that there isn't enough time. I agree there isn't, but half-baked knowledge is dangerous. If you teach something, teach it qualitatively, not quantitatively.

The Problems

Tool Power

A programmer is only as good as his tools, and how well he can use them. But schools generally lock down students to a specific ( often crappy ) tool. For example, we've Turbo C++ 3.0 ( 1992 ) on all computers. That is a 16 year old environment, supporting 16 year old standards. That's bad! In the days of Linux and Wikipedia do you really want kids raised on old proprietary standards. The ICSE board is very good atleast in their terms. They say that any Operating System ( why are we still on Windows ) with a latest C++ compiler should be used. It seems our school isn't listening.

If you are on Java, you probably have BlueJ. Now I've nothing against the BlueJ folks, but hiding all the compilation details from the student is denying knowledge. Students ( especially the ones who got into CS just for fun ) are of course happy that they don't muck around with "hard" stuff. But thats not how things work in the RealWorld. You should know how to use the command line, invoke javac and java. And, fricking, you should know that Java files have a .java extension and .class is the compiled byte code.

Another issue is shortcuts, quick search and replace, commenting. Kids don't know any of these things. It's type, click, type. Click Save. Click Compile. And to change something there is always manual replace.

File Management

Typical high school level programs, if well written, are never longer than 2 pages. They are often crappy, in the fact that the logic is repetitive, their is no purpose to the program and that students still don't get it!

So when it's project time, what the instructor gets is a dump of humongous shit, often with all the code in main, bad indentation and no comments. That's because the instructor hasn't taught the kids anything about decoupling programs, and seperating classes in files, and using header files. Often the instructor himself has no idea about build systems.

Bad Core Concepts

One really bad thing I see among my fellow students, is the complete inability to realise that each statement is an individual component. It evaluates to something, and other statements can use that value to do their job. This causes repetitive coding. To illustrate see this code sample.

function isSpam(email) {
 if(email.contains('$$$'))
     return true;
 else
     return false;
}

Students aren't taught that email.contains is returning true or false, and all we care about is true and false. They are never taught to see function documentation, just use it the way the instructor tells them too. This code can be simplified to the following, because email.contains is already doing what we want it to do, why decorate it?


function isSpam(email) {
return email.contains('$$$');
}


Beautiful Code: Of Readability

Bad indenting. Student code is full of bad indenting. Instructor code is full of bad indenting.

Learn to appreciate code people. It's just as much art as painting or poetry. Encourage right indentation, make liberal use of whitespace, clean up your logic, don't nest too much. You should be able to go back to it after a few months and not have to spend time just cleaning it up.

Follow standard conventions for variable names, make sure your method names and parameter names make sense. Use camelCase or _underscores_. Make booleans start with 'is' or simply the condition you're representing. If any variable has more purpose than a loop counter or a position marker, it should have a meaningful name.

Name your files meaningfully, keep it lowercase, and keep all your fake 31337 ness to yourself.

Type for today, Think for tomorrow

It's a matter of thinking for 3 hours, writing 3 minutes worth of elegant code, versus thinking for 3 minutes, spending 3 hours typing up code.

-- Compsci.ca

The post above also mentions some of the crap I've mentioned here, like the 4600 line Sudoku.
Student code is littered with conditionals highly specific. The very reason you're using a high level language is to avoid this. I've seen quiz programs where each question and its answer is in an if clause, embedded in the program! Cardinal sin. Use a file and parse the file, if you can't do that, atleast put all the questions and answers in two arrays ( don't tell me about maps ). Then you can just use a loop to pick out the question and its right answer.

Make your code extensible. Just because this is some dumb program which you're writing in school, doesn't mean it should be a waste of muscle energy, disk space and time.

If you have to choose day's of the week, put them in an array. You want to find out the number of days in a month, use a 12 element array. Or better yet, use your brain a bit more and write this:


int daysInMonth(int month) {
if(month==2)
return 28;

else if((month%2 == 1 && month <= 7) || (month%2 == 0 && month >= 8))
return 31;

else return 30;
}


It might seem like more code, but you can write this code once and use it anywhere. And you are using your brain.

Solutions

Use better languages

Far too many schools have jumped on the Java bandwagon. If you are teaching kids who don't have much programming experience start with a higher level, small language. Use Python. You should be able to finish explaining most of the language within a week. Besides the interactive interpreter is great for messing around to know exactly how something works, how to make it go wrong and where it can fail. You will also spare them from the compile cycle ( I know, it kind of contradicts my first problem :p ), allowing them instant gratification. Spare them the brackets and let them develop the logic. Logic is far more important than syntax. Syntax changes, but logic is immortal.

Real World Knowledge

Once in a while just stop the programming, and discuss technology related issues, latest news, ethical considerations. Anything which expands their minds and gets them more interested in computers. There are more than enough anecdotes and quotes about programming, use them. Instructors should stay on top of news stories. You don't have to know what monads are, but at least know what Linux is. One of my instructors had never heard of Opera and Mozilla ?!? Whatever language you are teaching, make sure you know it well. The same instructor above didn't know that the Java GUI framework is called Swing. Make sure you are aware of atleast major upgrades and integrate them.

The Open Source ecosystem is set to flourish. Make sure your students are aware of what it is. Encourage them to try out FLOSS. If you can't convert to Linux, atleast use open source compilers, tools and languages on your Windows machines. Set aside a computer where you can mess with distros.

Encourage frequent group projects. Let the kids make plans. Tell them how to go about design. Make sure its extensible and adaptable. If the project will need something more than what is taught, tell them to read about it, while you do too.

Good Reading

I don't know about the rest of the world, but in India, Computer Science textbooks for high school are crap. They are full of errors, bad practices, incorrect language, and often old software. There are hundreds of better quality books available online, often royalty free. There is Wikipedia and Wikibooks. While using them, remember to tell your students how cool the Internet is, and teach them about sharing.

Mark for the big picture

There is this huge emphasis on theory at the high school level, mostly due to lack of time for practical assessment. Which means students have to often write programs and submit them without testing. In such situations, don't cut marks for syntax errors, unless they mess up the logic ( missing braces ). The compiler/interpreter is going to catch them anyway. As long as the program works correctly logically, missing semicolons are OK.

Rank readability above extensibility, extensibility above just-getting-it-done. If a student has used some cool logic, or exploited the specifications, give him some appreciation. After all programming is all about getting the best out of constraints, and pushing the limits. If he/she has looked to optimize, that's good too.

Don't hand hold

Far too many instructors help students fix their errors. Don't help them fix the errors, help them understand what the error is. Any decent language is quite verbose at error reporting, and in case of languages which support exceptions, the class name is often a very good indicator. Any decent compiler also reports line numbers. Let them fix the problem for themselves. Time well used now, is time saved later. Tell them it's called debugging.

Create some passion

Kate Masukomi sums it up nicely. Most programmers today are doing it to pay the bills. Don't let your students be one of them. If someone just doesn't seem to have any aptitude, maybe he should look into some other field. Encourage the good ones to expand out of the syllabus, mess with different languages and read sites like Proggit. Tell them to blog and learn HTML/CSS and create their own site. Don't create hundreds of typists, the world would prefer fifty real programmers ( thanks to lankythoughts for the link! ).

Conclusion

If something isn't done quickly, the IT world will be in a mess. Already the lack of real talent is leading to a shortage of employees. According to me, the only real coders are the people who are up breast with new developments and technologies. They don't have to know how everything works, but they should know that it exists. That's passion. They are the ones who read blogs, write them, comment on articles, are always hacking on side projects and have commits on some open source project. Make your students a part of that group.

P.S. Forgive my immodesty in certain areas :)