Amazon has pledged financial backing for the team behind the Lean programming language as part of a sharpened focus on AI agent development.

In a statement on 26 July, the tech giant revealed it will provide "substantial, long-term” financial support for the Lean Focused Research Organization (FRO).

The FRO leads development of the open source programming language, which Amazon already uses internally in agentic AI development practices.

Lean has been around since 2014 and is a popular programming language across a range of fields including mathematics, physics, and computer science.

For Amazon, the appeal lies in its role in helping develop and fine-tune AI reasoning capabilities. The programming language is used alongside a ‘proof assistant’ - a type of software used to conduct checks of code to identify and sift out errors or flaws.

It’s these ‘correctness proofs’ that make the programming language a go-to option for academic researchers and professionals in scientific fields.

“AI generation of formal proofs in Lean has been a key method for training models with lower error rates, to the point that they are now producing correct solutions to research-level problems,” Amazon explained in a blog post.

Amazon Lean-ing in on agentic safety

Amazon said its support for Lean comes at a critical time both for its own internal AI ambitions and for the industry at large as enterprises ramp up adoption of agents.

Safety has been a key recurring talking point for organizations on this front. As ITPro has previously reported, research shows growing concerns around access control, governance, identity security, and visibility when it comes to agents.

“Coupling generative AI with Lean's mathematical rigor will help enable verified, trustworthy AI agents,” the company said.

Amazon already uses Lean-based verification in its Bedrock AgentCore service, helping to “prove the correctness of the policy language” that ensures agents operate within strict boundaries.

Elsewhere, Lean underpins systems such as SampCert - which provides “mathematical guarantees” for privacy protections in the AWS Clean Rooms analytics platform - and AWS Neuron.

“One scientist recently used an LLM with Lean to prove the correctness of Amazon Aurora's segment repair protocol, our most durability-critical distributed protocol, in a fraction of the time it would have taken manually,” Amazon noted.

“The set of applications is growing fast, and this is just the beginning.”

Peter Van der Putten, assistant professor of AI at Leiden University and director of Pegasystems’ AI Lab, said AWS’ FRO backing is a welcomed move given recurring security-related concerns.

“It is encouraging to see AWS investing in open source technologies such as Lean that have the potential to provide stronger formal verification guarantees for software and AI systems,” he said.

“As agentic AI systems become increasingly autonomous, technologies that can provide stronger correctness and safety guarantees than just traditional testing will become ever more important.”

Van der Putten noted, however, that the inherent complexity of agentic AI development means more robust orchestration and governance is still of paramount importance.

“Enterprise agents operate within complex environments involving workflows, automated processes, policies, regulations, humans in the loop, multiple stakeholders, and countless exceptions and uncertainties that cannot simply be abstracted away but must be dealt with in practice,” he said.

“So even an agent whose behaviour has been verified against a specification must still be able to operate effectively in such a context,” Van der Putten added.

“In practice, the bigger challenge may lie in orchestrating agents, people, data, and systems together in a governed way, while reflecting ambiguity, trade-offs, conflicting objectives, and constantly evolving realities, rather than simply proving that an idealised agent behaves correctly.”

Open source backing

Backing for the FRO serves a broader purpose rather than complementing its own use of Lean, according to Amazon.

“It’s easier to trust a proof when you can evaluate the tools behind it yourself,” the company noted.

“Customers, auditors, and regulators can independently inspect and validate work done in community-governed tools, which is the kind of transparency that safety-critical AI demands.”

The firm said that in the long term, Lean’s growing popularity will benefit the AI industry by providing “more libraries, more tooling, and more formalized proofs for everyone”.

FOLLOW US ON SOCIAL MEDIA

Software developers aren't losing skills because of AI, but using time saved to skill up, according to research from O’Reilly.

Analysis from the learning platform found that rather than the boom in AI coding tools having a negative effect on developer capabilities, many view the technology as a way to streamline everyday tasks to help them focus on learning.

O'Reilly said that use of generative AI content on its own learning platform was up 89% in the UK over the last year, while machine learning grew by 51% and natural language processing was up 117%.

At the same time, O'Reilly noted that more traditional programming topics saw decline over the last year, with "programming fundamentals" down 74%, Agile falling 31%, and Git down 20%.

While that could be seen as software engineers handing off such work to AI and not bothering to study key subjects, the study noted this suggests many are learning such skills on the job and using AI to support learning.

Formal training time, meanwhile, is spent learning about more advanced AI-related topics.

Alexia Pedersen, SVP International at O’Reilly, said the study shows developers are now making AI a “core part of their learning priorities”.

"The UK tech workforce isn’t turning its back on programming," Pedersen said. "It’s building on years of engineering expertise to take advantage of the opportunities AI creates. That’s exactly what we’d expect from experienced developers."

"Many already have years of programming experience, which puts them in a strong position to adopt AI tools confidently and apply them in meaningful ways," she added.

AI isn’t a replacement for core skills

That said, O'Reilly warned that AI should complement, not replace, foundational programming knowledge – especially for newer developers.

As ITPro reported last year, concerns are rising that those entering the workforce are becoming too reliant on the technology. The result is that many could miss out on valuable learning curves in the early stages of their careers.

"The challenge now is making sure the next generation develops those same foundations before relying too heavily on AI," Pedersen commented. "AI will make great developers even better, but it can’t replace the technical judgement that comes from understanding how software really works."

The company suggested that while developers are choosing to learn in different ways, it's worth noting that employers still require specific programming skills.

React, Node.js and Java skills are still highly sought after while cloud-related knowledge is prevalent in many UK job ads.

Indeed, demand for the Clean Code courses grew 19% over the last year, O'Reilly said, with C# up 17% – showing practical coding capabilities remains important.

"What this data captures is a workforce making active choices about where their time goes," Pedersen said.

"UK tech professionals aren't casually browsing AI content – they're incorporating technical learning into new ways of working, building AI agents, testing different approaches, and exploring how these tools can improve productivity and outcomes.

FOLLOW US ON SOCIAL MEDIA

Anthropic believes Claude Code can play a key role in modernizing legacy code like COBOL, but IBM appears to disagree.

In a recent blog post, Anthropic said its flagship coding tool can automate much of the legwork required in COBOL modernization, which is a notoriously difficult process for enterprises.

"With AI, teams can modernize their COBOL codebase in quarters instead of years," the company said.

If as useful as promised, Claude could be the tool that finally breaks the ongoing dependence on COBOL, or Common Business-Oriented Language, a programming language first developed back in 1959.

While it's still widely used, that's largely for legacy operations, and efforts are being made to shift at least some of those workloads to more modern platforms. Anthropic noted COBOL runs 95% of ATM transactions in the US and is used to power critical systems including finance, airlines, and government.

"Despite that, the number of people who understand it shrinks every year," Anthropic noted in its blog post. "The developers who built these systems retired years ago, and the institutional knowledge they carried left with them."

Waning expertise in COBOL is exacerbated by the fact universities no longer teach the language. Indeed, it’s becoming increasingly difficult to find qualified engineers in this domain.

That could have serious implications for major industry players such as IBM, largely because COBOL is a major selling point for IBM systems as the company continues to sell mainframes to customers reliant on the language.

After Anthropic's announcement, shares in IBM fell 13.2% – the biggest drop seen by the company in more than 25 years, according to Reuters.

Claude Code vs COBOL

Anthropic said COBOL modernization is different from standard code, adding "you're reverse engineering business logic from systems built when Nixon was president."

With that in mind, it’s not just about coding, but understanding long lost institutional knowledge that's only represented in the code itself.

That's one reason why "armies of consultants" are now required to update these systems – at high cost and with lengthy timelines.

"Tools like Claude Code can automate the exploration and analysis phases that consume most of the effort in COBOL modernization," the post noted.

Using Claude Code, Anthropic said researchers were able to map dependencies across thousands of lines of code, document long-lost workflows, spot risks more quickly than human analysts, and offer "deep insights" to make key decisions.

"AI excels at streamlining the tasks that once made COBOL modernization cost-prohibitive," the company said. "With it, your team can focus on strategy, risk assessment, and business logic while AI automates the code analysis and implementation."

By going through a step-by-step process that includes validation, the AI can translate COBOL logic into modern languages, creating API wrappers around legacy components and building a system to run old and new code together.

IBM isn't convinced

In an apparent response, IBM published its own blog post about AI coding tools and COBOL – without specifically mentioning Anthropic – that argues there's a clear difference between translating code and modernizing a platform.

"Translation captures almost none of the actual complexity," said Rob Thomas, Senior Vice President, IBM Software and Chief Commercial Officer, later adding: "Decades of hardware-software integration cannot be replicated by moving code."

IBM's mainframe business isn't just about COBOL, Thomas said. Indeed, nearly half (40%) of COBOL doesn't even run on mainframes.

"COBOL on IBM Z is code optimized over decades of tight coupling between software and hardware," Thomas added.

"An analogy is the iOS and iPhone: someone could build an alternative, but it is unlikely to displace a billion iPhones. The performance derives from tight coupling of software and hardware, processor-level acceleration, I/O subsystem optimization, and decades of performance tuning."

Whether that convinces the markets to stop battering IBM's shares remains to be seen, but IBM isn't the first company to see its price fall over an Anthropic post or product launch in recent weeks.

Software and services shares dipped over the launch of Claude Cowork, while another reveal about security tools tanked share in a host of major cybersecurity companies.

FOLLOW US ON SOCIAL MEDIA

Microsoft plans to replace C and C++ with Rust within the next five years as part of a major engineering modernization project – but a senior company figure insists AI won’t be doing the heavy lifting after a social media backlash.

In a post on LinkedIn advertising a job opening last week, Galen Hunt, Distinguished Engineer at Microsoft, said the tech giant plans to “eliminate every line of C and C++ from Microsoft by 2030”.

The scale of the project here is significant, with Hunt suggesting that developers will be working toward refactoring upwards of one million lines of code on a monthly basis.

“Our North Star is ‘1 engineer, 1 month, 1 million lines of code’,” Hunt wrote. “To accomplish this previously unimaginable task, we’ve built a powerful code processing infrastructure. Our algorithmic infrastructure creates a scalable graph over source code at scale.”

“Our AI processing infrastructure then enables us to apply AI agents, guided by algorithms, to make code modifications at scale,” he added. “The core of this infrastructure is already operating at scale on problems such as code understanding.”

The move from Microsoft marks the latest in its shift to the Rust programming language in recent years. In 2022, David Weston, corporate VP for OS security and enterprise at Microsoft, revealed the company was investing around $10 million in Rust to make it the company's "1st class language" for engineering systems.

As ITPro reported back in 2023, the company made a significant leap on this front with the introduction of Rust-based kernel features on Windows as part of the Windows 11 Insider Preview Build 25905.

Progress has continued at pace in the intervening years. During a keynote presentation at RustCon 2025 in September, Azure CTO Mark Russinovich detailed the company’s efforts to embrace Rust, per reports from The New Stack.

Microsoft's Rust project courts controversy

Initially, Hunt hinted at the use of AI in helping Microsoft deliver on the goal of rewriting some of the company’s largest codebases.

The suggestion tracks with how the tech giant is using the technology in software development over the last two years. In May this year, CEO Satya Nadella revealed up to 30% of the company’s code is now written by AI.

However, Hunt’s comments appear to have courted controversy, prompting an edit on the original post to clarify that “Windows is *NOT* being rewritten in Rust with AI”.

Hunt insisted this is a research project aimed at “building tech to make migration from language to language possible”.

“The intent of my post was to find like-minded engineers to join us on the next stage of this multi-year endeavor—not to set a new strategy for Windows 11+ or to imply that Rust is an endpoint,” he wrote.

Rust is in vogue

Microsoft isn’t the only company making the shift to Rust. Last year, Lars Bergstrom, director of engineering at Google’s Android team, said developer teams embracing the programming language have unlocked marked productivity and efficiency benefits.

A 2024 project from DARPA also saw the US government agency announce plans on this front, this time actually using AI tools to translate C code to Rust.

A key factor behind the shift to Rust lies in security. Popular languages such as C and C++ have suffered from recurring security-related issues, making them vulnerable to bugs due to how they use memory.

These ‘memory-safety vulnerabilities’ have become a frequent pain point for enterprise security teams and developers alike, and have caught the attention of security agencies on both sides of the Atlantic.

In 2022, the US National Security Agency (NSA) urged organisations to shift to memory-safe programming languages, such as Rust, Python, or Java. More recent guidance from the NSA and CISA, meanwhile, once again urged devs to make the shift.

FOLLOW US ON SOCIAL MEDIA

A majority of enterprises are using a version of Python that’s a year or more older, according to new research, and it’s costing them dearly.

Statistics from JetBrains’ annual Python Developers Survey show over three-quarters (83%) of enterprises are using older versions, highlighting a broad “distribution across the latest and older versions of the Python runtime”.

They’re not particularly fussed, however, with the majority of respondents stating that they were satisfied with the performance of the version they’re currently using.

More than half (53%) said the version they’re using “meets all my needs” while 25% admitted they simply haven’t had time to update.

Breaking down usage rates, JetBrains’ study showed just under a quarter (21%) reported using version 3.11, released in October 2022, while 35% said they’re working with version 3.12.

Just 15%, the study found, are using 3.13, the latest version of the programming language.

Notably, the study showed that a significant number of developers are using Docker and containers to execute code, meaning the volume of enterprises working with older versions was “surprising”.

“With containers, just pick the latest version of Python in the container,” the company noted in a blog post detailing its findings. “Since everything is isolated, you don’t need to worry about its interactions with the rest of the system, for example, Linux’s system Python.”

JetBrains added that it expects containerization to “provide more flexibility” for enterprises and “ease our transition” to the latest version of Python.

Upgrading Python has big performance benefits

A key talking point in the JetBrains survey centers around the potential ease of use improvements enterprises are missing out on by failing to upgrade.

More recent versions include features that ease quality of life for developers, but also big performance gains, the company noted.

“The 83% of developers running on older versions of Python may be missing out on much more than they realize,” the firm said. “It’s not just that they are missing some language features, such as the except keyword, or a minor improvement to the standard library, such as tomllib.”

“Python 3.11, 3.12, and 3.13 all include major performance benefits, and the upcoming 3.14 will include even more.”

Drilling down into the potential gains, JetBrains noted that 48% of those using Python 3.11 can unlock code run gains of ~11% by upgrading to 3.13 - and that’s achieved while using ~10-15% less memory.

“If they are on the 27% still on 3.10 or older, their code gets a whopping ~42% speed increase (with no code changes), and memory use can drop by ~20-30%,” JetBrains added.

Speaking to ITPro, Daniele Volpe, software engineer at SecureFlag, said while updating to newer versions isn’t critical, the advantages are clear and should be capitalized on.

“Running old Python versions does add up over time,” Volpe said. “You’re basically paying for slower runtimes and higher cloud costs when newer versions give you efficiency for free.”

“It’s not always urgent, but ignoring it means you’re leaving money and performance on the table”.

Volpe noted that the impact on developers has a knock-on effect which ultimately exacerbates existing efficiency and performance-related issues.

Slower runtimes mean slower feedback loops, which slows down the overall efficiency of the development lifecycle.

“Developers spend more time waiting on tests, builds, or jobs to finish,” he said. “Plus, sticking with older versions means missing out on language improvements that could make their day-to-day work smoother.”

Upgrading might be a hassle – but just take the plunge

Volpe said that it’s no surprise a significant portion of respondents are satisfied with the performance of older Python versions. It’s a long-running practice and most teams “stick with what works until something breaks”.

“Upgrading feels like hassle and risk, so they put it off,” he said. “Comfort and inertia often win out, even if the gains from moving forward would be worth it.”

Maurice Kalinowski, product director at Qt, echoed Volpe’s comments on this front, adding that “updating any technical dependency is always a concern to a development team”.

“There can be regressions, both on functional or performance level, incompatible changes or even removed functionality,” Kalinowski said.

“This applies even more to the underlying programming language, as it touches not just one component but your whole solution.”

Simply put, if it isn’t broken, don’t try and fix it.

MORE FROM ITPRO

• AI is transforming software development – JetBrains CEO Kirill Skrygan says it’s up to developers to transform with it
• AI coding tools are finally delivering results for enterprises
• Want developers to build secure software? You need to ditch these two programming languages

Java, one of the world’s most popular programming languages, has officially turned 30 - but it’s still a long way from reaching its twilight years.

The programming language was first released in May 1995, and its launch came at a pivotal time in the development of the world wide web. The programming language was perfectly suited to cater for growing interactivity and multimedia requirements.

Java was created by James Gosling while working at Sun Microsystems, which was acquired by Oracle in 2010. Java development began some years before as part of a project - originally called ‘Oak’ - aimed at revolutionizing interactive television.

Ultimately, it proved slightly ahead of its time and the team behind the project pivoted to develop and fully flesh out the programming language. But with the rise of the web and more complex networking requirements, Gosling and co were wary of the potential pitfalls less portable languages could create in years ahead.

It was a solid call on their part. In an interview with ITPro way back in 2007, Gosling noted that “most of the stuff we talked about back then has happened, even though at the time it seemed like extreme science fiction”.

So what makes Java tick, and what’s the secret sauce behind its longevity?

Java’s timeless appeal

Java is a high-level, general purpose, object-oriented programming (OOP) language and was designed with a C/C++ style syntax that developers at the time would have found very familiar.

The language itself is very reliable and known for its ease of use, which also contributed to its popularity upon release. It was easy for developers to jump on the bandwagon and get going - and they sure did.

From the release of its first public version (Java 1.0) in 1996 to 2001, more than two and a half million developers globally were using the language in their daily workflows.

Today, Java still powers many of the popular websites and applications we use in our daily lives and remains the go-to language for many Android developers.

Indeed, figures from JetBrains' 2024 State of the Developer Ecosystem report showed 30% of developers cited Java as their primary language. Similar research last year also showed the programming language was experiencing somewhat of a renaissance, with enterprises planning to ramp up Java developer recruitment.

The Java Developer Productivity Report from Perforce showed investment was rising significantly, with nearly two-thirds (60%) of respondents planning to bring on more devs specializing in the language.

Java’s popularity among developers has remained modest over its long life, but admittedly peaked in the early noughties. Regardless, recent statistics from the Tiobe Index ranked the programming language in fourth place behind Python - which itself is experiencing a surge in popularity - C++, and C.

Despite its age, Dewan Ahmed, principal developer advocate at Harness, said Java still plays a critical role underpinning the tech stacks of enterprises globally.

“Java may be turning 30, but it’s far from showing its age – as it continues to underpin much of modern software development,” he said.

“Java’s longevity lies in a rare balance: consistent backward compatibility paired with continuous evolution. The Java Virtual Machine’s “write once, run anywhere” principle still resonates, while the syntax has evolved over the years to become more concise, without sacrificing its stability.”

The longevity of the programming language is also partly down to enterprise frameworks such as Spring Boot and Jakarta EE, Ahmed noted. These have ensured the programming language remains relevant amidst an age of cloud-native and microservices architectures.

“This vast ecosystem of libraries and tools, combined with widespread enterprise adoption, gives Java staying power that newer languages struggle to match,” he said.

Java in the age of memory safety

Another key appeal for Java at the ripe old age of 30 is the fact it remains a memory-safe language. Security agencies on both sides of the Atlantic have issued repeated warnings to enterprises about the dangers of memory-unsafe programming languages in recent years.

Languages such as C and C++ all suffer from one key weakness – they’re vulnerable to bugs that threat actors can pounce on. Some of these vulnerabilities include - but aren’t limited to - buffer overflow weaknesses or out of bounds read/write flaws.

These underlying memory-related weaknesses can be manipulated by threat actors to devastating effect. Analysis from Google in 2023, for example, estimated that three-quarters of CVEs used in zero-day exploits targeted memory safety flaws.

What next for Java?

According to Ahmed, Java’s long-term relevance will “hinge on how effectively it adapts to the asks of AI, cloud, and edge computing”.

There are ongoing initiatives which aim to meet these demands, however, such as Project Panama for example, which he said enables AI workloads to run more efficiently on hardware resources.

“In the cloud, ahead-of-time compilation via GraalVM is poised to become more mainstream, while advanced garbage collectors like ZGC and Shenandoah promise to minimize pause times for latency-sensitive applications like real-time analytics,” Ahmed added.

“These capabilities will ensure Java remains performant in modern, distributed environments and suggest it will remain so long into the AI-centric future.”

MORE FROM ITPRO

• The ultimate guide to becoming a programmer
• Interest in traditional programming languages is declining
• AI coding tools are finally delivering results

Python’s popularity continues to surge, according to the Tiobe index, with the programming language reaching a 25.25% share in May.

Figures from the index show Python now holds the highest rating for any programming language since 2001, surpassing Java’s record-breaking rating in June 2001.

But as Tiobe CEO Paul Jansen noted, this was the first month of the Tiobe index and there were far fewer languages being tracked.

Nonetheless, the programming language has surged in popularity in recent years, and in the last month alone increased by around 2.2%, with Tiobe figures from April showing the language boasted a rating of 23.08%.

Notably, May 2025 marked another record-breaking month for Python, according to Jansen. It’s the first time a programming language has held this big a lead over other languages ranked in the index. Python currently holds a 15% lead compared to the second-placed language, C++.

So what is it about Python that makes it such a popular choice for devs? There are a number of factors here, but one key appeal is its simplicity, experts told ITPro.

Python’s ease of use is a major draw

According to Allon Mureinik, senior software engineering manager at Black Duck, ease of use is a major draw, with the programming language having a “very low barrier of entry”.

“While you can technically write code in any language with no more than a text editor, Python is one of the few programming languages that actually make it practical”, he told ITPro.

“All you need to start coding in Python is the Python binary itself and a text editor, and you’re good to go.”

Mureinik added that this ease of use is a “huge factor” even for seasoned developers while the ecosystem surrounding the language is vibrant and still growing at pace.

“The syntax is simple without being simplistic, and the language constructs themselves make a lot of the developers’ routine tasks (such as manipulating or transforming data structures) very easy,” he said.

“Python has a rich ecosystem that offers libraries to integrate and interact with a wide variety of services, protocols and environments without having to implement those integrations from scratch.”

Darren Meyer, Security Research Advocate at Checkmarx, echoed Mureinik on the ecosystem front, noting that the Python community “really participates actively in thinking about security and compliance, which is appreciated”.

“While parts of the ecosystem (like PyPI, the Python Package Index which makes it easy to adopt open source Python libraries) have had security issues in the past, the community and maintainers are very responsive,” he told ITPro.

Python is the language of choice for AI developers

With the advent of generative AI, it’s hardly surprising that Python has soared higher in popularity, experts told ITPro. Indeed, research from Snowflake last year showed it has now become the “programming language of choice” for AI developers.

Analysis by the company found Python use grew by 571% on its Snowpark platform, highlighting its growing appeal. Moreover, this marked a considerable increase compared to other popular languages, such as Java and Scala.

“Python skills will be increasingly essential to development teams as they venture into advanced AI,” the report said.

So what makes it ideal for AI development? According to Meyer, Python is an “excellent language for rapid prototyping”, meaning developers aren’t bogged down by cumbersome workflows.

Meanwhile, Mureinik told ITPro its simplicity and ease of use again offers marked benefits here - an aspect of the language that Snowflake said enables developers to “focus on solving AI problems rather than parsing abstract syntax”.

“Python is a very convenient language for integrations and for stitching together workflows,” he said. “This makes it the obvious choice for programs that take data from source A, use it in a prompt to an LLM (through a Python client library, of course), and then take the output from that prompt as input for system B.”

Python does have some limitations

While Python has a lot going for it, there are certain limitations - particularly with regard to speed. Jansen specifically highlighted this issue in the latest Tiobe index update, suggesting that Python’s low performance is the “only reason other languages still have a reason for existing”.

This lower performance is due to how Python operates. It relies on an ‘interpreter’, a program that processes and executes code from a script file, or in some cases interactively. This allows programmers to test code - and run said code - on a line by line basis.

Notably, Python uses a Global Interpreter Lock, or ‘GIL’. This is a mutex, or lock, which limits the throughput of code, Jeff Watkins, chief technology officer at CreateFuture, told ITPro.

“The interpreter and its “global interpreter lock” limit throughput to a single, slow thread, so heavy-duty computing needs to be offloaded to C/C++ libraries,” he explained.

Efforts have been made to increase interpreter performance and remove these single-threading limitations, Watkins added, but still leaves developers wanting when compared to the performance of languages such as C++.

“Python will likely never outperform C++, but it doesn’t need to, as it was never its original purpose,” he noted.

Other limitations of Python are due to its dynamic typing approach, which Watkins said “trades off any ‘compile time’ safety for ease of implementation” and therefore can result in errors.

“This looser approach to typing means that runtime errors can slip through the net unless you put in belt and braces testing and typing hints through annotations,” he explained.

“Outside of niche projects, it also doesn’t have a mobile or client front-end footprint,” Watkins added. “As the Web runs on HTML, JavaScript, CSS, and WebAssembly, there’s no native way of using Python in the browser. Mobile and client browsers are also payload and performance-sensitive which makes it a less reasonable choice.”

Watkins said these notable gaps in performance and versatility explain why Python has supplemented other ecosystems, echoing Jansen’s earlier comments.

“Python’s rise is predictable, sensible, and more of a realignment than a hostile takeover,” he said.

“It has become the default high-level tool of choice, leaving space for complementary languages where absolute speed, strict typing, or native client experiences are paramount.”

MORE FROM ITPRO

• "Java is here to stay": Popular programming language to remain on business hit lists
• Want developers to build secure software? You need to ditch these two programming languages
• Organizations shift away from Oracle Java as pricing changes bite

A growing number of Oracle Java users are considering switching to another provider, new research shows, as cost concerns are driving developers towards open source options.

A new survey of over 2,000 Java professionals commissioned by Azul found 88% of respondents were considering switching to another Java Virtual Machine (JVM) or Java Development Kit (JDK).

This marks an increase on the 72% of Oracle Java users who said they were thinking about transitioning away from the platform in 2023, with 42% citing cost as their primary concern.

Since Oracle shifted to an employee-based pricing model in January 2023, 82% of business users have expressed some level of concern over its approach, the report found.

Just over two fifths of these users stated they were either ‘very’ or ‘extremely’ concerned, with this figure rising to 55% when restricted to Java 17 users.

Oracle ended free commercial support for Java 17 in October 2024, leaving users having to opt between paying Oracle to continue to use the platform and receive support, upgrade to Java 21, replace Java with another language, or opt to migrate to an alternative JDK.

The second most common reason professionals gave for considering the switch was a preference for open source options, cited by 40% of respondents.

Moreover, 46% of the companies considering the switch identified free OpenJDK releases paired with paid support services as the preferred alternative to Oracle.

Oracle Java customers also noted the firm’s sales tactics (37%), restrictive policies (33%), and audit risk (32%), as additional worries that were driving their potential migration away from the platform.

Java remains a top enterprise choice for cloud and AI

Despite cost concerns, Java remains an integral programming language for a vast number of organizations due to its cross platform and backward compatibility, stability, and efficacy in enterprise-level applications.

Azul noted that only 1% of potential survey participants around the world were disqualified due to the fact they didn’t use Java, “a testament to the language’s ubiquity in modern development environments.”

For example, almost 70% of respondents said that at least half of their enterprise applications were either built with Java or run on a JVM.

In the AI arena, 50% of respondents who build AI workloads use Java over other popular languages like Python, despite the latter’s reputation as a preferred language for developing AI applications.

Azul said the growing adoption of cloud services is only further fueling uptake of the language, with just under two-thirds of organizations using Java in the cloud stating 50% of their compute costs originate from Java systems.

The report also found underutilization of cloud compute capacity remains a problem for enterprises. Nearly three-quarters (71%) of respondents said more than 20% of their cloud compute capacity is unused.

This presents a serious problem as cloud expenses continue to rise, with 38% of survey participants stating their organization has established new internal rules for cloud asset management to reduce this inefficiency.

Additionally, when asked why they use a high-performance JDK, 61% of respondents said they used it in order to optimize their cloud compute costs.

Python has overtaken JavaScript to become the most popular programming language on GitHub, according to new figures released by the firm, largely thanks to the rise of machine learning and generative AI.

The coding platform revealed that there are now 518 million projects on GitHub, up by a quarter year-on-year, with 5.2 billion contributions to projects over the course of 2024.

AI is having a major impact, the firm noted. There's now 137,000 public generative AI projects, almost doubling since last year, and more than a million open source maintainers, students, and teachers have used the free AI-powered GitHub Copilot tool.

With Python taking the top spot on GitHub, its ascendancy brings to an end ten years of JavaScript holding the top spot. Moving down to second, the programming language is followed by TypeScript and Java.

It’s not all bad news for the language, however. JavaScript is still the top ranked for code pushes — which means more developers use it more often to push code — but across all activities on the site, including commits, issues, pull requests and more, Python is now the top language.

"More developers still use JavaScript more often to push code, but in absolute activity across all contribution types on GitHub, Python now outranks JavaScript," GitHub said in a blog post.

Python's meteoric rise to prominence

GitHub identified two key factors behind Python's popularity on the platform - namely the rise of data science and generative AI, as well as TypeScript cutting into JavaScript's lead.

The firm said TypeScript had grown exponentially from 2014 to 2019, overtaking Java last year to join the top three programming languages.

"While Python is increasing in contributor counts for both code push activity alone and other activity faster than JavaScript, it isn’t increasing in those faster than JavaScript and TypeScript combined," the post noted.

"Rather than a slow down in the JavaScript community, what we are seeing is a transition to TypeScript for a large proportion of new commits."

It's not just Python that’s benefitted from the rise of machine learning either. Jupyter Notebooks has seen a spike in usage of 92% over the last year and 170% since 2022.

"This could indicate people in data science, AI, machine learning, and academia increasingly use GitHub," the post added.

GitHub's ranking echoes recent research by cloud data company Snowflake, which in March revealed Python had become the go-to programming language for developers building generative AI applications, pointing to 571% growth on its own platforms.

But Stack Overflow's 2023 survey ranked Python third overall, which it said was a reflection of who uses the language. It’s the fourth most popular programming language among professional developers, but more popular among those learning to code and the top ranked for those who aren't full time developers but use some coding at work.

That tracks with GitHub's assessment that the rise of AI and data science was drawing a wider range of people into coding.

"Python is used heavily across machine learning, data science, scientific computing, hobbyist, and home automation fields among others," GitHub added.

"The rise in Python usage correlates with large communities of people joining the open source community from across the STEM world rather than the traditional community of software developers.

"The notion of who a developer is and the scope of what a developer does is changing. The rise in Python, HCL, and Jupyter Notebooks, among other things, indicates that the notion of a developer extends beyond software developers to roles like operations or IT developers, machine learning researchers, and data scientists."

Other shifts driven by AI

AI is helping to encourage coding globally by making it easier for people from a wider range of countries, GitHub said.

"The rise of these non-English, high-population regions is notable given that it is happening at the same time as the proliferation of generative AI tools, which are increasingly enabling developers to engage with code in their natural language," the post said.

And that's good news for the industry. By attracting a more diverse community of developers, this will ultimately drive innovation long-term, the firm noted.

"Increased access to and experimentation with AI could also simplify and personalize the coding journey for new developers, lowering entry barriers and further diversifying GitHub’s community of developers."

More widely, generative AI is becoming a core part of software development at every stage.

"They power coding tools that offer fixes and context behind vulnerability remediations, suggestions in response to natural language prompts and existing code, and facilitate learning among new and experienced developers alike," the post added.

"They’re also changing how developers build applications, and developers will benefit from platforms that allow them to easily experiment with AI models as building blocks without requiring separate setups or extra costs."

Previous research from GitHub found that developers are beginning to unlock real value from AI coding tools, with respondents to a recent survey relieving the solutions have helped them learn new languages and save time.

Scientific publishing has traditionally been a flat, static affair. You write up your research in a document, which is typically a PDF with text and code. Someone reads it and might use aspects of your research in their own projects. But what if you could make those documents smarter? Wouldn't it be useful to have a data science paper or programming tutorial document that you could actually interact with? That's what JupyterLab, a free tool from Project Jupyter, aims to provide.

Traditionally, programmers wrote Python programs in a text-based file with a .py extension. If you wanted to explain what the source code in the document was doing, then you'd write comment blocks to give others an idea of what you were thinking when you wrote the program. That kind of comment is fine for code that people rarely look at, such as one working behind the scenes running database interactions on a server.

JupyterLab: Who is it for?

If you're a computer science tutor trying to explain how bubble sorts work, or a biology morphologist describing how you used code to map the Fibonacci sequence in the disk of a sunflower, mixing code that runs together with text and images gives you a much more intuitive way to tell your scientific story. Computer scientist Donald Knuth envisaged this in 1984 in a concept called literate programming. A literate program file runs like a non-literate program file, but it also structures and describes that code in a way that makes more sense to the author and their audience.

That's where Project Jupyter comes in. It evolved from an initiative called IPython (interactive Python), formed in 2011, which used a different kind of format than .py files. An iPython notebook file is human readable, containing text written in the markdown format along with Python code that you could run. Each snippet of code and text description occupies its own cell, and produces a cell containing its output when you run it, like this:

You could send that notebook as a single document for anyone running IPython Notebook to run and interact with, or you could send them the URL to an online version.

As IPython Notebook grew more popular, the project spun them off into a separate initiative called Jupyter. Jupyter develops the tools to run the notebooks while IPython focuses on the underlying interactive Python implementation to support them.

Jupyter carried on developing the notebook project, now called Jupyter Notebook, but it saw more data scientists using this tool for complex data analysis projects. To support them, it developed a product with more functionality called JupyterLab. This summer (2023), the team released the fourth version of that project.

JupyterLab: Setup

JupyterLab is a fully integrated development environment (IDE) targeted mainly at data scientists, although anyone wanting to exchange descriptions of their code journeys can use it. Like Notebook, it runs as a server that you visit in your browser. You can either access it online using someone else's server (Jupyter offers its own demo here), or you can install it locally.

We've found the best way to do this is via the Conda package manager, which contains pre-baked collections of packages including JupyterLab. You can install the collection in a couple of lines as a separate virtual environment in Conda, and then just switch to it whenever you like. This allows you to maintain a version of Python separately from your system version, with separate packages.

JupyterLab doesn't just support Python, although that's the world that it came from. Like Jupyter Notebook, it supports a wide range of languages. You can simply select these from its menu, as long as you have installed the relevant kernels, and it handles syntax-based formatting for you.

Whereas Jupyter Notebook comes with a basic file browser that you use to select a single file, JupyterLab starts with two panes: one displaying the file browser and the other displaying a launcher. This enables you to quickly and graphically create different kinds of files. Notice that you can also create a console directly in the browser – something that Jupyter Notebook doesn't support – if you want to tinker with code before putting it into your main notebook.

JupyterLab: File handling

This pane-based approach is an example of the fundamental differences in the user interface that set JupyterLab apart from Jupyter Notebook. Another nice feature is the way that the file browser opens documents of different types. We downloaded a CSV with the results of public school inspections from the UK government's open data repository. We first opened it in Libre Office and resaved it with UTF-8 encoding, which Jupyter needs to open a CSV directly. Opening it as a file from within Jupyter Notebook (on the left), and from within JupyterLab (on the right): reveals quite a difference:

Jupyter Notebook displays this as a text file, while JupyterLab displays it as a properly formatted, scrollable CSV file. It also displays other kinds of documents like PDFs in their native format, making it an excellent file browser and display mechanism for those working on large projects.

JupyterLab: Features

Notice how the JupyterLab interface on the right is tabbed? This demonstrates another big advantage of JupyterLab: multiple document management, which is also a significant enhancement for those working on large projects. Jupyter Notebook focuses just on single documents, meaning that if you want to work on more than one you have to open another tab in your browser.

JupyterLab's tabbed interface is useful enough as shown, but you'd still have to click on each tab to see the appropriate document. What if you wanted to compare two documents side by side? Simply click on a tab and then select New View for Notebook. This creates a split window that lets you see the document side by side. Here, We've created a document to load the school's csv file into a Python Pandas data frame and then displayed the data frame in the notebook. Splitting the view lets me see the CSV and the Python representation of it side by side:

JupyterLab also has plenty of enhancements for working inside specific notebooks. One of these is the ability to collapse cells. When we displayed the school's data frame in the notebook, it created a lot of text. We can collapse that by clicking on the cell's sidebar on the left, making any subsequent code more visible:

Changing the code in a cell is simple – you just click on the cell and edit it. However, you have to rerun it to produce its updated output using CTRL-RET. Jupyter Notebook didn't indicate that the adjusted code hadn't run yet unless you happened to notice its out-of-date output. JupyterLab fixes that by using different colors for the sidebar. A cell that hasn't been updated since it last ran is blue. If a cell has not run to reflect new edits, the sidebar turns orange:

Let's do a little more analysis on schools, grouping schools by region and checking the mean average of their education quality. Then we can plot that as a horizontal bar graph:

That's a long bar chart. Let's say we want to keep it handy for visual reference as we continue working on our notebook. We could create another view of this notebook, rearranging it to the right-hand side of the screen, and then collapse the graph view in our original notebook to make room for our code. However, that creates a problem, because collapsing the graph in one doc also collapses it in the other.

Instead, we can do another thing that isn't possible in Jupyter Notebook: create a new view of a single cell's output. This creates a new tab with just the output of the cell that we can then drag to the right, rearranging it to keep it handy at all times. Collapsing the output cell in the original notebook has no effect in the new output view:

To create a true IDE, the Jupyter team gave JupyterLab another feature that doesn't exist in Jupyter Notebook: a debugger. If your Python kernel supports debugging, you'll see a small bug icon next to the kernel indicator in the top right of your window. Clicking that turns it orange, switching on the debugger, and showing us its data in a sidebar. The debugger supports the basic features you'd expect, including variable watching and setting breakpoints. We can set breakpoints by clicking on the appropriate line in the gutter, creating a small orange indicator:

Version 4 of JupterLab, released in June, contains some welcome new features. The team has adjusted its code behind the scenes and updated the text editor that it uses to make editing faster, especially for large notebooks. You can also now import extensions for JupyterLab directly from PyPi in addition to installing directly using the tool's extension manager. JupyterLab was built with extensibility in mind, and there are plenty of plugins to enhance your experience.

JupyterLab: Is it worth it?

JupyterLab is the perfect tool for creating not just programs, but stories of how those programs came to be and what you were thinking when you made them. Think of it like a smart lab journal - a kind of Harry Potteresque document that's alive and answers your questions as you read it. It's such a good system that in many cases, especially when teaching programming to high-school students, say, it's a worthy competitor to many other IDEs. Whenever we're looking for insights into data or simply trying out some concepts in Python programming, this will be our first port of call.

Microsoft announced that it has taken an additional step forward to embracing Rust as a core language by introducing new Rust-based kernel features to the latest Windows Insider build.

On Wednesday it shipped Windows 11 Insider Preview Build 25905 containing what it called a “small trial” of another critical kernel feature written in Rust.

The update specifically concerns a new implementation of GDI Regions in the win32kbase_rs.sys driver file located in System32. The _rs refers to the Rust language version.

GDI Regions refer to shapes, or a combination of shapes, that can be created for tasks like hit testing - checking to see if a cursor is hovering over a specific icon, for example.

“While this is a small trial, we will continue to increase the usage of Rust in the kernel,” Microsoft said in a blog.

“We are beginning to roll this out, so the experience isn’t available to all Insiders in the Canary Channel just yet as we plan to monitor feedback and see how it lands before pushing it out to everyone.”

Microsoft’s commitment to Rust

It’s long been known that Microsoft has aimed for a stronger adoption of the Rust programming language.

The company’s CTO issued a call to the industry last year, encouraging it to embrace Rust over traditional languages like C and C++, following in its own footsteps as well as other major tech firms like Cloudflare and Linux, the latter of which is also implementing Rust in its own Kernel.

Microsoft’s interest in Rust dates back years and made a case for its adoption as early as 2019. 

It highlighted in a 2019 BlueHat presentation that most security vulnerabilities are caused by developers accidentally implementing memory safety issues in software components written in C or C++.

Rust and memory safety

One of the headline benefits of Rust is its inherent memory safety. For this reason, it’s considered a more secure programming language that can do the same things that the older C/C++ can do, at the same speed and efficiency - the main reasons for sticking with the older languages for so many decades - with better security.

Rust is memory-safe thanks to its compiler which refuses to build any program it's used to write unless memory safety can be guaranteed.

It makes for fewer security vulnerabilities and more reliable programs that are less likely to crash.

For this reason, it’s also being adopted by an increasing number of major ransomware operations, with a number of groups rewriting their payloads using the language.

BlackCat, Hive, and LockBit are among the most notable ransomware groups that have shifted to Rust in recent months. Ransomware binaries also benefit from Rust’s anti-analysis properties, largely attributed to the complex way in which its compiler translates developer code into machine-readable code.

Major tech companies, in addition to the aforementioned Microsoft, Cloudflare, and Linux also have their own Rust projects running in some capacity.

Meta, Amazon, Mozilla, Dropbox, and Figma are among the most notable in this far-from-exhaustive list.

Rust has also been the ‘most loved’ language by developers in the past seven annual StackOverflow surveys, underlining its popularity. 

As more tech companies increasingly embrace the language, it’s likely to become more of an in-demand skill for developers in the years ahead.

Cyber security experts have warned that the targeting of the Python Package Index (PyPI) repository is likely to continue given its popularity and potential to cause massive disruption.

PyPI has been targeted numerous times in the past year and has been described as a “highly lucrative target” for cyber criminals.

The repository is the official package index for the Python programming language - the most popular language according to the TIOBE index.

"The comparative naivety of the average user, combined with its prolific use, has led to an attacker's dream,” said Liam Follin, CHECK team leader and consultant at Pentest People, to ITPro.

“If you download and run a Python package, you’re running Python code on your own machine. If, just by publishing a package, you could compromise a large number of machines, it is easy to see why an attacker salivates at the idea.”

Following the attack on PyPI over the weekend, security experts have called on the open source community to “develop new infrastructure and invest more in sharing attack data”.

PyPI attack: What happened?

Registration for new users and project packages on the PyPI index was temporarily blocked over the weekend due to a high volume of “malicious activity”. 

In a notice to users, maintainers of the repository said they had detected a significant volume of malicious projects and users being created on the repository, prompting the strict response. 

The outage lasted for nearly 29 hours and appears to have been exacerbated by the fact that some admins were on leave for the weekend, the status report indicated. 

“New user and new project name registration on PyPI is temporarily suspended,” admins said. “The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion, especially with multiple PyPI administrators on leave.”

“While we re-group over the weekend, new user and new project registration is temporarily suspended.”

While exact details on the incident or the threat actors involved are yet to be disclosed, there are indications that the attack was automated.

Growing open source threats

Researchers at Checkmarx warned that the PyPI attack bears similarities to a host of attacks on open source registries in recent years, and is an issue that has grown in both frequency and intensity. 

In August last year, PyPI admins issued a warning over a sophisticated phishing campaign that aimed to steal credentials from package developers. 

The JuiceLedger phishing campaign against PyPI contributors successfully compromised a “number of legitimate packages”, researchers at Sentinel Labs revealed at the time. 

“In the past few months, we have witnessed actors publishing overwhelming amounts of malicious packages in several open source registries,” said Tzachi ‘Zack’ Zornstain, head of software supply chain at Checkmarx.

“Among these is the NPM incident early last month that flooded the JavaScript package manager and caused a sporadic denial of service. Late last year, we saw a similar incident on the Nuget package manager, which included over 140,000 malicious packages.”

Understanding threat actors key to open source safety

Checkmarx noted that this type of abuse “isn’t specific to PyPI” and will require more concise communication across the open source community to mitigate growing threats. 

“We must change the mindset from detecting attacks to identifying attackers,” Zornstain said. 

“Only by understanding the attackers’ TTPs and raising the bar will we succeed in keeping the open source community safe. This will require the open source ecosystem to develop new infrastructure and invest more in sharing attack data,” he added.

Follin suggested that the very nature of the PyPI repository makes it difficult to proactively mitigate threats, however. 

“It’s very difficult,” he told ITPro. “PyPI is run by a charity, the Python Foundation, which operates with limited funds. The repository is effectively built on trust, and unfortunately, trust is often misplaced in today's world.”

“In effect, it is down to the end user to ensure the PyPI package they are downloading isn't malicious. At the end of the day, there is only so much The Python Foundation can do to keep things safe.”

The director of the US’ cyber security authority, CISA, has criticised the tech industry for normalising unacceptable security practices, including Microsoft’s Patch Tuesday.

Patch Tuesday is a monthly round of security updates on which IT system administrators rely to keep their organisation’s IT estate safe from vulnerability exploits.

The fact that the industry has accepted this as normal is “evidence of our willingness to operate dangerously”, Jen Easterly argued.

Easterly acknowledged that while it’s impossible to prevent all security vulnerabilities, the tech industry should be demanding higher standards for the products it produces and uses.

During a speech made at Carnegie Mellon University (CMU) this week, the CISA director went on to cite some of the major cyber attacks in recent years, such as school districts shutting down, a gas pipeline shutting down, and patients being diverted from hospitals affected by ransomware attacks.

“And that’s just the tip of the iceberg, as many - if not most - attacks go unreported,” she said.

“As a result, it’s enormously difficult to understand the collective toll these attacks are taking on our nation or to fully measure their impact in a tangible way.”

The industry has reached the point at which it accepts that technology is “dangerous by default”, and that it wouldn't be accepted with the likes of car airbags, for example.

The normalisation of deviance theory by sociologist Diane Vaughan posits that when swathes of people grow accustomed to deviant behaviours, those behaviours no longer seem deviant to many over time.

Easterly cited the theory, drawing parallels between it and the state of the tech industry currently.

It has been accepted as normal that Patch Tuesday only comes once a month and usually fixes around 100, often more, vulnerabilities with each package.

It also seems normal that software is still written in memory-unsafe languages like C and C++, a practice the US government has hoped to stamp out through public information campaigns over the past year.

The idea of encouraging the use of secure software development practices feeds into one of the three core principles CISA is currently trying to enact across the industry.

1. Placing greater emphasis on manufacturers of technology products to assume responsibility for security issues
2. Technology manufacturers to “embrace radical transparency” to disclose customer safety challenges
3. Focus on building products with both the ideas of security by design and security by default at the core of production

At the federal level, the Biden administration has already mandated that all civilian executive branch (FCEB) agencies must patch a list of the most common vulnerabilities by a given deadline to limit the potential for a major cyber attack on the government.

However, there is still work that needs to be done at both the government and education levels in order to raise cross-industry standards, Easterly said.

Better incentives need to be introduced so manufacturers are rewarded for producing secure products. In the tech industry, no such rewards exist.

The idea of incentivising proper security practices is not a new one, but little movement has been made among leading countries to reward manufacturers for providing secure software.

Easterly said the government needs to improve its approach to legislating positive change, such as preventing companies from disclaiming liability by contract, for example, and mandating a more transparent production process.

Private companies should shoulder some burden of security too. For example, making multi-factor authentication (MFA) a default setting in user accounts across all technologies and platforms is one way the industry could prevent a sizeable number of breaches.

Apple’s iCloud service has a 95% uptake of MFA among users compared to Twitter’s 3%, a contrast Easterly said was due to Apple enabling MFA by default.

At the education level, the CISA director praised CMU specifically for introducing its CS 112 programming class which teaches students how to code in Python - a memory-safe programming language.

Areas for improvement that were highlighted included embedding security throughout all IT-related classes and courses, and supporting the open source and research communities to adopt memory-safe programming.

A new report recommends using regulatory and monetary incentives to encourage the adoption of safer programming languages to build more cyber-secure software.

Estimates made in research carried out by Consumer Reports contended that around 60-70% of browser and kernel vulnerabilities are discovered in codebases largely comprised of C and C++ code - two languages known for poor memory safety.

One of the report's chief conclusions was that monetary or regulatory incentives could be needed to convince an industry notoriously reliant on older, less memory-safe languages to make the switch to newer languages such as Go, Ruby, and Rust.

Both the private and public sectors could also benefit from enacting policies that promote the creation of memory-safe code, the report suggested.

"As much as possible, companies, government organisations, and other entities should commit to using memory-safe languages for new products and tools and newly developed custom components," the report read.

There are numerous barriers to adoption when it comes to memory-safe languages. Government agencies, for example, can't just purchase memory-safe solutions out of the box, the report noted, so the issue also requires strong advocacy from engineers to move towards memory safety as a priority.

"The carrot approach for memory safety may include not just decreased future costs in cyber security, but also reliability and efficiency. Ideally, memory safety will be viewed as a proxy for funded, competent risk management strategy and for software that's currently evolving and malleable."

Such a transition is likely to take substantial amounts of time given the inherent complexity of rewriting large codebases in newer languages with different functionalities and performance levels, the researchers noted.

Other suggested steps forward the report made included: asking engineers to list memory safety mitigations as part of a software's feature set; training development teams on how to program memory-safe code; and developing public awareness campaigns.

"Languages such as C and C++, which are older than more modern programming languages, lack memory management being built-in," said Eleanor Watson, IEEE fellow, machine intelligence researcher, and AI singularity expert to IT Pro.

"Competent coding of an embedded system with limited updates may be reasonably safe, especially if combined with tools for the formal verification of the system and its functionality. Personally, I feel that the phase-out of memory unsafe programming in applications makes sense, but that there should be different rules for embedded systems which are bounded in a limited range of activity and which require high performance."

What is memory safety?

The US' National Security Agency (NSA) has been vocal on the topic of memory-safe programming languages recently.

In November 2022, it made a public call to move away from languages like C and C++ due to the proportion of exploitable security vulnerabilities being attributed to sub-optimal handling of memory in software.

As yet, the NSA's stance hasn't been enacted in the form of regulation or legislation, but as calls grow for a transition towards safer languages, the report's suggestions could feasibly become reality.

Use-after-free and out-of-bounds read/write bugs are among the most common affecting systems presently and both would be automatically ended by using memory-safe languages, rather than having to rely on a developer to code the necessary safeguards.

"While developers using memory-unsafe languages can attempt to avoid all the pitfalls of these languages, this is a losing battle, as experience has shown that individual expertise is no match for a systemic problem," the report read.

"Even when organisations put significant effort and resources into detecting, fixing, and mitigating this class of bugs, memory unsafety continues to represent the majority of high-severity security vulnerabilities and stability issues.

"It is important to work not only on improving detection of memory bugs but to ramp up efforts to prevent them in the first place."

Barriers to adoption

A number of barriers exist when it comes to transitioning away from older, memory-unsafe languages. The report suggested it all starts with education and the professors in charge of some computer science courses displaying reluctance to transition from C and C++.

"Professors have a golden opportunity here to explain the dangers of C and similar languages, and possibly increase the weight of memory safety mistakes on exercise grading, which proliferate in student-written code just as they do outside of the classroom.

"Another opportunity is to switch languages for part of those courses."

The researchers conceded that teaching in languages such as Rust could lead to "inessential complexity", so a balance needs to be struck between teaching languages that have real-world value while raising awareness of their dangers and possible alternatives.

This reluctance for change is also replicated in the executive levels of a company where management might not trust new languages or their ability to maintain the same functionality.

“Perhaps the tools are workable but there is the sense that C/C++ equivalents are more reliable or easier to use,” read the report.

There are also inherent challenges when it comes to actually rewriting large and complex codebases in new languages.

Considerations when embarking on such a change include balancing tradeoffs between cost of implementation, runtime performance, toolchain complexity, and overall safety. In some scenarios, factors such as runtime performance may outweigh safety in some organisations, for example.

The National Security Agency (NSA) has recommended only using 'memory safe' languages, like C#, Go, Java, Ruby, Rust, and Swift, in order to avoid exploitable memory-based vulnerabilities.

The agency explained that memory issues in software make up a large portion of exploitable vulnerabilities. Due to this concern, the authority has advised developers to consider moving from programming languages with little or no memory protection, like C and C++, to a memory safe language.

Memory-safe languages provide various degrees of memory usage protections, and the agency recommended using code hardening defences, like tool analysis or operating system configurations, as well. By doing this, many memory vulnerabilities can be prevented, mitigated, or made harder for cyber actors to take advantage of.

The US security agency underlined that exploitable software vulnerabilities are still frequently based on memory issues. This includes overflowing a memory buffer or leveraging issues with how software allocates and deallocates memory.

Popular languages, like C or C++, provide a lot of freedom and flexibility when it comes to memory management, said the NSA. Here, the programmer must perform the checks on memory references and if they make a mistake, it can lead to exploitable memory-based vulnerabilities.

“While the use of added protections to non-memory safe languages and the use of memory safe languages do not provide absolute protection against exploitable memory issues, they do provide considerable protection,” stated the NSA. “Therefore, the overarching software community across the private sector, academia, and the US Government have begun initiatives to drive the culture of software development towards utilising memory safe languages.”

The NSA did say software analysis tools are able to detect instances of memory management issues, while operating environment options can provide protection too. However, it underlined the protection offered by memory safe software languages can prevent or mitigate most memory management issues.

Despite the warning, however, transitioning to memory safe languages, for many businesses, is not practical. “There are trillions of lines of code being used today written in C/C++ making it impossible to consider rewriting it all into a memory safe language,” said professor John Goodacre, director of the UKRI’s Digital Security by Design (DSbD) challenge and professor of computer architectures at the University of Manchester.

“Even when new code uses such languages, it's inevitable that it will be relying on code written in an unsafe language through its use of libraries or an operating system. Further, many of the higher-level languages are sandboxes by their runtime making them unsuitable for many classes of applications.”

Goodacre explained that in DBsD, an initiative supported by the British government, a new approach known as CHERI has been applied to both Arm and Risc-V prototype chips. He said this makes the hardware itself memory safe and brings memory safety to existing software and offers resilience and security features for new code.

“The risk from memory unsafe code is significant with around 70% of ongoing reported vulnerabilities rooted in such issues,” said Goodacre. “Moving to CHERI enabled hardware will not only block exploitation of these memory safety vulnerabilities, but it also offers developers new capabilities that reduce the risk that bugs find their way into production, increasing developer productivity.”

Snowflake has revealed new enhancements designed to make it easier for developers to build apps on its data cloud platform while reducing reliance on third-party tools.

Following its acquisition of Streamlit in March 2022, an open source app framework in the Python language, the company is now integrating the framework with its own technology. It said this will help developers bring their data and machine learning (ML) models to life as secure and interactive applications on Snowflake.

The cloud data company hopes the Streamlit integration will help developers build powerful applications without the complexity of building and deploying web applications. The integration will help developers create applications with Python using their data in Snowflake, and then deploy and run these applications on Snowflake’s platform before sharing them with business teams.

“As we continue to disrupt application development, we’re giving builders the data access and tools they need to accelerate their pace of innovation securely under Snowflake’s one unified platform,” said Torsten Grabs, director of Product Management at Snowflake.

“Snowflake’s advancements provide developers with the capabilities to build powerful applications, pipelines, and models with the utmost confidence, and eliminate complexity so they can drive value across their organisations with the Data Cloud.”

To further reduce the need for developers to turn to third-party tools, Snowflake is also providing access to Python and its open source libraries to all users and teams, with the general availability of Snowpark for Python. This means developers will be able to use Python to query and process data queries in a data pipeline while remaining on the company’s platform.

Snowflake said that since its public preview announcement in June 2022, Snowpark for Python has seen six times growth in adoption, with hundreds of customers building their data using the platform, including EDF, Sophos, and Northern Trust.

Through Snowpark, developers also get a streamlined architecture that natively supports users’ programming languages of choice, including Java, Scala, SQL, and Python. Snowflake is also releasing Snowpark-optimised warehouses, which are currently in public preview in AWS, so Python developers can run large scale ML training and other memory-intensive procedures directly in Snowflake. They can also use Python Worksheets, which is in a private preview, to develop applications, data pipelines, and ML models inside Snowflake.

Lastly, Snowflake is also making it easier to work with streaming data within a single platform and further eliminate silos for customers. Users are able to boost productivity by onboarding faster with Schema Interface, and execute data pipelines with Serverless Tasks on Snowflake’s platform.

Researchers have discovered a 15-year-old vulnerability found in a Python module and found that hundreds of thousands of repositories are exposed to it.

Trellix Advanced Research Center discovered the vulnerability in Python’s tarfile module, the group revealed yesterday. First, the centre thought it had found a new zero-day vulnerability but then realised it was CVE-2007-4559, a vulnerability first discovered in 2007.

The vulnerability is a path traversal attack in the extract and extractall functions in the tarfile module that allow an attacker to overwrite arbitrary files by adding the “...” sequence to filenames in a TAR archive.

Tarfiles are a collection of multiple different files and metadata which are then used to unarchive the tarfile. The metadata in a tar archive can contain information on its name, size, owner, and when it was archived.

Attackers simply need to add “...” with a separator for the operating system, either “/” or “\”, into the file name to escape the directory the file is meant to be extracted to. The tarfile module also lets users add a filter that can be used to parse and modify a file’s metadata before it’s added to the tar archive. This lets attackers create their exploits with as little as six lines of code.

Throughout its research, Trellix found that hundreds of thousands of repositories were exposed to the vulnerability.

“While the vulnerability was originally only marked as a 6.8, we were able to confirm that in most cases an attacker can gain code execution from the file write,” wrote the centre.

Treliix added that the vulnerability is incredibly easy to exploit, requiring little to no knowledge about complicated security topics. It added that it’s patching as many open-source repositories as possible as well as providing a way to scan closed-source repositories.

Another Python vulnerability was discovered in May this year but in one of its popular open-source packages. Two open-source packages, Python’s CTX and PHP’s phpass, were found to be compromised which led to developers trying to understand their exposure to the vulnerability. Around 3 million users were expected to be affected by the compromise, with one business already reporting it had been affected.

The CTO at Microsoft Azure has called on the industry to pivot away from the C and C++ software development languages and embrace Rust for future projects.

Mark Russinovich said Rust should be the new favoured language when developing projects that do not require a language that supports garbage collection “for the sake of security and reliability,” he said.

Russinovich’s comments come after several high-profile industry figures have confirmed their adoption of Rust in their respective projects during this month.

Cloudflare announced last week that it built a new HTTP proxy called Pingora. Built in-house, Cloudflare’s engineers chose Rust “because it can do what C can do in a memory-safe way without compromising performance”.

Memory safety is one of the most widely touted benefits of Rust and according to Cloudflare, it guards Rust-built projects against undefined behaviours and instils confidence that services will run correctly. Rust code also runs more efficiently compared to Cloudflare's old Lua code, the company said.

Linux’s creator Linus Torvalds also said earlier this week at the Kernel Maintainers Summit that Rust code will play a significant role in the new 6.1 version of Linux, ZDNET reported, although the kernel itself will still be written in C.

Away from tech giants adopting the programming language that’s “most loved” by developers for seven years running, Rust is becoming a new favourite for ransomware organisations, too.

First BlackCat and more recently the Hive ransomware-as-a-service operations have publicly announced their shifts to Rust as the programming language of choice to develop their encryptor programs.

In addition to its memory safety which increases the program’s efficiency, Rust’s compiler is another significant reason why the language itself is so popular among all kinds of software developers, including black hat hackers.

Its compiler increases the safety of a program by refusing to compile unsafe code by default which guarantees the smooth running of whatever software it’s used to build.

Hackers also appreciate Rust’s anti-analysis properties, another feature of its compiler which makes it difficult for prospective reverse engineers to see how the code works due to how it converts human-readable code to machine-readable code.

A score of tech giants including Meta, Amazon, Microsoft, Mozilla, Dropbox, and Figma all have adopted Rust in various projects in some capacity.

The language is among a ‘newer breed’ of development tools that aim to eliminate some of the antiquated, difficult-to-use features of older languages.

During the darkest days of lockdown I kept myself amused by practising jazz guitar chords and writing Python programs. I write a lot of small, off-the-cuff programs, for everything from updating phone codes or solving maths puzzles, to playing with simulations to do with Games Theory. Python is just the last of a long list of languages I’ve used – Basic, Forth, Pascal, Lisp and Ruby are a handful of others – but the one I remember with most affection is Turbo Pascal.

My programmes are so small and ad hoc that it’s never worth investing too much time writing graphical user interfaces (GUIs), so Windows was a nuisance rather than a liberation. Although I played with Visual Basic and Delphi for several years, eventually both metastasised into such baggy monsters that I dumped them. I wrote myself a little toolkit in Turbo Pascal 5 that created simple windows, menus and pick-box widgets from ASCII characters, quite good enough. I shared my code in Byte and am proud to say I saw it on screens in more than one science lab where they had similar minimalist requirements.

Now I use QPython 3.6 on Android, which has no native ability for colour or cursor control, just scrolling teletype output. There are plenty of add-on graphics libraries such as Kivy, all way more than I need, and there’s a simple interface to Android dialogues and media components called SL4A that I occasionally use but it’s still not what I had with Turbo.

The impulse to recreate my Turbo widgets was finally triggered by, of all things, Wordle. I enjoy playing Josh Wardle’s clever and elegant little puzzle (almost as much as I deplore posting screenshots on Facebook or bragging about stats). It’s just difficult enough to maintain an interest, but still simple enough to pose real questions over strategy, which is exactly what I love in a game. I never actually cheat but I do use tools that some purists might consider cheating, namely a mobile version of the Oxford Dictionary with wildcard search and an anagram solver; once I have three or four letters these will finish the job in a couple of minutes.

Getting those three of four letters soon enough is what my Python programme does, searching for effective first guesses using the known frequency distribution of letters in English at each position in a five-letter word: it outputs delightful combinations such as AUDIT SNORE CLAMP and CAMEO UNITS GRIND WHELK. I discovered that my old buddy David Tebbutt, one of the founding editors of Personal Computer World, is also fond of Wordle and it was he who sent me the letter frequencies list in a fine example of nerd-aid. He also has access to Wordle’s own internal word list, but in a fit of hubristic rectitude I decided that was a step too far for me.

My Python Wordle Helper program’s scrolling teletype interface became a real bore, and while looking up how to write a clear-screen command using OS calls I discovered how to issue ANSI codes from Python, and hence how to do a 256-colour character-based terminal better than Turbo’s. QPython can in theory access the Linux library, but that refuses to work for me and in any case is pretty horrible. I set to and have now written a widget set that does everything I want, enabling single lines of code to invoke a box, a window, pick list, input box, progress bar, table or bar chart.

I doubt that my new widgets will prove as popular with nerds in science labs as those Turbo originals were; those hark back to when IBM-compatible PCs running DOS were still ubiquitous in technical and process control contexts. I know that there are still far too many public institutions such as hospitals and libraries that retain such dinosaurs, but they will at least be running Windows XP.

Of course, anyone under 70 is using a smartphone instead of a computer anyway, and an ANSI terminal on a smartphone screen is about as welcome as a turd on a sushi. So I’ll keep my little ANSI world to myself, going back and rewiring some of my old programmes using the new interface. My 5-Card Drawer and 5-Card Stud Poker games actually look rather splendid.

When people talk about writing code on a computer, the terms ‘coding’, ‘programming’ and ‘scripting’ are often used interchangeably. In fact, most people aren’t aware that there are subtle but important differences between the three activities. But just what are they?

What is coding?

Put simply, coding is the act of inputting commands into a computer in a language that it can understand. At the smallest level, computers process everything in binary — 1s and 0s — also called machine code.

Far back in computer science history, there was no other way in which users could write code, but quickly programming languages were written to give programmers a far more user-friendly coding experience.

Today, almost all code is written in one of many programming languages, which have their own libraries, documentation and syntax.

All of the most popular programming languages have their differences, with more or less overlap between them, and it takes time to learn how to use each one effectively.

When you strip each one down to its core, however, all each does is interface with a computer on its own terms, while simultaneously allowing a user to create commands in a way that they can understand and easily remember.

What is programming?

If coding is translating intention into language that computers can understand, programming can be understood as taking this language and making it into a comprehensive list of instructions.

Every decision you make on your computer, whether it’s right-clicking or pressing ‘search’ on Google, sets in motion a chain of code that varies in complexity depending on the demands of the user.

Usually, these chains have been written line-by-line in code inside a program called a compiler, which translates the program from the language in which it was written into machine code that the computer can run as a cohesive program.

Very recently, AI models have reached a point where they are beginning to be able to overtake humans in writing programs of their own, but this is still far from proven technology.

What is scripting?

Scripting is typically used to automate a process that would otherwise be undertaken by a human operator. Some programming languages are considered good scripting languages, with a prime example of this being Python. This is due to its ample documentation, speed, and intuitiveness.

Unlike programs, which are compiled into machine code by a compiler, scripts are usually run by something called an interpreter. This runs the program line-by-line from the source code, with no translation of the script into any other code.

The benefit of scripts is that they are much easier to understand for beginners, as they are generally laid out in a more easily digestible format. On the other hand, scripts can only run on a computer that has the right interpreter installed.

A relatively new programming language on the scene, Rust was launched in 2015 and has quickly become a favourite not only for the pleasant experience it offers developers but also for the benefits it affords malware miscreants.

In the most recent 2022 Stack Overflow Developer Survey, Rust was, by far and away, the ‘most loved’ programming language among surveyed developers – a crown it’s claimed for seven years running since it was first released. Perhaps it came as no surprise, then, that Rust was also the language the most number of developers wanted to add to their repertoire, narrowly edging out Python.

This week, Microsoft revealed that the Hive ransomware group’s namesake payload has been almost entirely rewritten in Rust, moving away from Go – another favourite among malware and ransomware authors.

After BlackCat, Hive has become the second ransomware group this year to rewrite its program using Rust. This raises the question of what makes the industry-favourite language so appealing to ransomware gangs, specifically?

Rust’s killer duo of features

Safety first

Like many of the more modern programming languages designed to replace older ones, Rust claims to be “blazingly fast and memory-efficient” – much more than the likes of C and C++.

Microsoft’s analysis agrees, stating Rust offers better memory, data type, and thread safety over other languages. Memory safety is hugely important when writing secure software as memory-unsafe programs can lead to crashes. Ransomware strains also need to remain operational – to continue to lock users out of their systems – in order for the ransom demands to be valid. Memory-unsafe programs are also responsible for the majority of software vulnerabilities in non-malicious software, according to Okta.

Rust is an incredibly safe language thanks to its compiler that outright refuses to compile unsafe code by default, meaning developers who code ransomware using Rust won’t even be able to run it unless the program is guaranteed to run in a stable way.

Evasive manoeuvres

Newer languages Like Rust and Go are thought to be better at disguising the ways in which they work from malware analysts. This, in turn, prevents them from being reverse engineered to release decryptors, which would kill its ability to generate business.

Again, Rust’s compiler is to thank for this. Due to the comparatively complex way in which Rust code is compiled into machine-readable code, the language makes it difficult for analysts to view the inner workings of the program. Proofpoint said in one analysis that it has observed previous malware strains being rewritten in Rust to avoid detections based on features of the program written in C.

Rust is also a command line-driven language. The newer Rust version of Hive ransomware places different parameters in the command line which means things like the credentials required to access the ransom payment site cannot be accessed by analysts from the individual sample itself. The parameters in Hive are also being constantly updated, Microsoft said, and when coupled with string encryption, makes analysis increasingly difficult.

Examples of malicious Rust programs

Examples of major malware programs written in Rust date back to 2016, shortly after the language was released. Doctor Web researchers discovered a Linux backdoor trojan with functionality limited to just four commands sent over internet chat relay (IRC).

A year later, ESET published details of the TeleBots campaign that targeted Ukraine months before the NotPetya outbreak was observed. It used a pair of backdoors in order to compromise companies in the region, including one that was rewritten in Rust from Python.

As mentioned previously, Proofpoint also published its research into the re-writing of the Buer malware, the Rust iteration of which it named RustyBuer in 2021. The campaign saw the rewritten strain being distributed as part of phishing emails masquerading as shipping companies, and other associated campaigns purporting to be from the likes of logistics company DHL. The emails typically included links to download Microsoft Office documents that used macros to drop the RustyBuer malware - a technique that Microsoft continues to battle against today.

There are also the most recent examples from BlackCat and Hive, the first and second ransomware programs to be re-written in Rust respectively. BlackCat is a prevalent strain of ransomware that prompted the FBI to issue a security advisory warning against it earlier this year. According to Varonis Threat Lab, the group behind BlackCat has actively recruited developers from the now-shuttered REvil, DarkSide, and BlackMatter ransomware organisations – all of which are believed to be Russia-affiliated.

Testing isn't a software developer's favourite job. The fun part is writing the code; who wants to jump through hoops that tell you just how little of it works? Nevertheless, it's a mandatory practice for good programming. It will help prevent bugs that could affect the performance of your code, make it less usable, or worse still, allow cyber attackers in through the back door.

Building testing into your programming from the beginning makes it easier and less time consuming to fix bugs, but how do you do it? For Python developers, the language comes with its own testing framework called Unittest, but there are also third-party testing frameworks that aim to improve on the original. Here's a look at some of them.

These testing tools aren't just useful on their own. You can use some of them in combination with each other. For example, Selenium is good for testing user interactions, but is at its most powerful when used with other frameworks. Because it uses Python, you can parameterize Selenium by calling it from your PyTest functions. You can also fold it into behaviour-driven development by calling Selenium from within your Behave session's steps file.

Whether you're using unit testing, behavioural testing, or both, building these tests into your coding process throughout can help to increase the quality of your final product.

Unittest (PyUnit)

As Python's baked-in testing module, Unittest's main advantage is that you don't need to install anything else to use it out of the box. It handles unit testing (as you could probably guess), which ensures that a software function produces the correct output, even when presented with unusual input.

This testing tool requires you to create a class that holds your tests by subclassing its TestCase class, like so:

You then create a function for each of your tests inside the class. You use one of its assert functions to determine test outcomes. For instance, self.assertEquals() tests whether a function's output equals your expected output. There are lots of these, including boolean assertions (testing whether something is true or false), greater or lesser, and matches for regular expressions. A newer version, Unitest2, supports more of these assertions.

One useful feature of this tool is its ability to support fixtures. These are environments that you set up to support the program. For example, you might need to log into a database and retrieve a record before you can test whether a function updates it correctly with a given input. A fixture enables you to do that.

Unittest is a great framework for writing basic tests. Its use of a class for test cases allows you to group tests that map to software features. However, it quickly gets unwieldy thanks to its insistence on inheriting tests in classes.

Nose2

Unittest's limitations left room for improvement, so third party developers updated it with their own testing framework called Nose, subsequently replaced with Nose2.

Because this testing framework extends Unittest, it can run Unittest tests alongside its own. Nose2 is extensible, providing support for plugins that give it the potential to offer more functions than unittest. It also adds another important feature: parameterisation.

Most tests need multiple inputs to be sure that no strange elements slip through. For example, if you're testing a function that validates a product price, you might want to try entering various prices with different numbers of digits. You might also want to enter other prices that might fail the test, such as 0.00, a negative price, and perhaps prices with non-numeric characters. Rather than creating a single test for each of these inputs, it would be better to make a test that could rerun itself with inputs from a list. Nose2 allows you to do this.

Pytest

Pytest is an alternative unit testing framework to Unittest and is designed for simple but highly functional testing. Even the developers of Nose2 recommend it as a good option for those new to testing on their GitHub page.

Because PyTest is a third-party open-source testing library, you must install this open-source tool before using it. One difference to Unittest is its use of functions without the need for a class. This means that Pytest requires less code to create tests than Unittest does.

Let's say we have a function to add 1 to an input:

Whereas unittest requires you to contain a test for this system in a separate class, you can simply write a test as a separate function, simplifying the whole process.

Then we use a simple assert function to test the result as a separate function in the same file:

Just as in unittest, the assert function lets you describe what a test looks like when it passes. In this case, running the function inc with an input of three should return a result of 4. If it doesn’t, then PyTest will report that the test has failed.

Pytest is also extensible and features a full plugin library.

DocTest

For an alternative method of testing code, how about writing your tests directly into your documentation? DocTest directly references your code documentation for its tests. You write your documentation as you normally would, but you embed examples of function calls with appropriate input and results within it.

You can embed these tests in docstrings at the function or module level. Then you can either invoke it at the command line or you can include instructions to run it at the bottom of your modules. Alternatively, you can embed the tests in separate .rst help files for larger documentation files.

Like Nose2, DocTest has the advantage of integrating with existing Unittest tests, and provides an elegant way of combining tests and documentation together. On the downside, however, it doesn't include fixture management.

Behave

Those tools are all useful for unit testing, where you test individual functions against basic inputs. However, they might not enable you to test combinations of functions that produce business results your users care about. A business executive might not care that a function validates a customer's login email address, but they'd like to be sure that the program lists a user's outstanding orders after they've logged in.

This is where behaviour-driven development comes in. It tests scenarios and outcomes that map closely to tasks that software users care about. These are known in development parlance as user stories.

The Behave testing library uses specification files to test these stories, which developers must write in a language called Gherkin. It defines application scenarios, and then uses a structure of steps to define the tests, such as:

The given statement sets up the environment to run the test. In this example, I log in describes that the user should be logged into the system before the test is run. The when statement then describes the condition that you’re testing (in this case, it’s testing what should happen when a logged-in user has an outstanding order). Finally, the then statement describes the desired outcome when the condition is met (the user should see their outstanding order)..

You define the code tested in these steps within a separate steps file using Python decorators. For example:

As with other testing frameworks, you can write these tests before putting together any of your code. They'll all fail, of course, until you then write the functions to support them.

The great part of behaviour-driven development is that by writing the tests, you're documenting your user requirements in a structured way up front. You can then use these tests as a guide when writing your application.

Selenium

These tools are all very well suited to testing application code running locally, but how do you relate them to user actions in browser-based applications? You might write tests to run at the controller level if using a model-view-controller architecture, as we documented in our series on Flask development, but a more useful, intuitive way to test browser-based inputs is to simulate the browser itself. Browser automation enables you to test program input from the user's perspective, and there's one go-to solution for that in Python: Selenium.

Selenium simulates a browser that you can program to automatically carry out common user actions, including entering text into web forms and clicking buttons. You do this by writing scripts in a range of languages including Java, Ruby, and Python. The script finds elements in a web page using their names or other parameters, and then takes actions on them.

Rather than functioning as a testing tool itself, Selenium is a library that you can call from within your Python testing framework of choice, such as Pytest.

For example, you might use this tool to test a form which asks for a user’s postcode and another that asks for their country. You could use PyTest to carry the relevant test data, such as ‘90210’ and ‘United States’. You’d then manipulate Selenium to enter that data into the browser by calling Selenium to find the field named postcode and then entering the postcode. It would then select the relevant country from the drop-down country list, and finally it would find the submit button and automatically click it.

Then, you’d call Selenium to interpret the browser’s output, passing it to an assert statement in Pytest so that you could compare it against your expected result.

Selenium enables you to test your program from a user’s perspective. By marrying it with parameterisation in your testing framework, you can submit dozens or hundreds of combinations to test a multitude of complex form entries and other browser interactions.

Microsoft has released the latest version of TypeScript (4.7) in beta and introduced various new features that have met with excitement from the language’s programmers.

The tech giant has continued its rapid development with the programming language after only having released the previous stable version (4.6) in March this year.

The introduction of ECMAScript Modules (ESM) in TypeScript is one of the standout additions to the latest release and has been described by users as a “huge step forwards” for the language.

ESM is a module format Node.js has been working to implement for years but development has been “very difficult”, according to Microsoft, since Node is built on an older system called CommonJS (CJS) which uses modules differently.

TypeScript 4.5 previously introduced nightly-only support for ESM in Node to get feedback from users and with version 4.7, support for interoperability between ESM and CJS is now available in TypeScript.

Some developers have expressed concern about how they will be forced to implement ESM in existing projects, despite widespread excitement.

Certain existing TypeScript code will have to be re-written to accommodate a new syntax of ESM, with some files having to use a JavaScript file type (.js extension) even when referring to TypeScript files.

Developers have called this confusing, and Microsoft said the re-writing process “might feel cumbersome at first”, but in many cases, TypeScript tooling like auto-imports and path completion will make the change automatically for developers.

TypeScript version 4.7 also introduces instantiation expressions which allow developers to specify type arguments for generic functions or constructors without calling them.

Developers can now create specific instantiations of generic class constructors or functions using a new expression syntax, feeding them type arguments directly.

When a function or constructor is given one or more type arguments, they essentially make an alias of the original and replace the corresponding type parameters with the provided type arguments while dropping all the other signatures as it will assume these are not meant to be used.

Programmers also stand to benefit from variance annotations for type parameters, which bring the potential for clearer, more explicitly typed code for outsiders to more easily see how a type parameter is used. It can be difficult to understand if a type should be read, written, or both, especially with more complex types, so it stands to benefit teams working on a complex codebase.

Microsoft also said the feature can also bring performance benefits since TypeScript can type-check larger structural types with more precision and speed.

Full details on the host of new features coming to TypeScript can be found in Microsoft’s detailed release notes.

The development team behind the Google-created Go programming language has released what it’s calling the “biggest change ever to the language”.

Go version 1.18 is available to download now and brings with it support for generic code using parameterised types – often simply referred to as ‘generics’ – a most-requested feature from the Go community, the development team said.

Generics is an approach that can be found in other popular programming languages like Java, Python, Rust, and Swift, and allows developers to write data structures and functions in a way that they can be applied to many different cases.

For example, a developer may want to code a ‘reverse’ function for integers, but also want it to apply to strings – two different types of data. Generics makes this less difficult to achieve by opening up the function to accept different, unspecified data types.

“Supporting generics has been Go’s most often requested feature, and we’re proud to deliver the generic support that the majority of users need today,” said Go. “Subsequent releases will provide additional support for some of the more complicated generic use cases.”

Go said the generics support is a “major” addition but is fully backwards-compatible in the language. While it believes the feature has been implemented well, it said it does not have much testing data from real-world applications, and so advises developers to exercise caution when deploying generic code.

It's the first implementation of generics in Go and there is a possibility that generic code written in Go 1.18 may break in later releases if the method of implementation has to be changed, the development team said.

“We will minimise any such breakage as much as possible, but we can't guarantee that the breakage will be zero,” it said.

Full details of what Go supports with generics and what its current limitations are can be found in the official release notes.

Fuzzing

Go has also implemented fuzzing – another of the most requested features from its community and the first major programming language to fully integrate fuzzing into its toolchain, the development team said.

Fuzzing is an automated testing tool that feeds invalid or random data into an application’s code as a way to test it for bugs or problems that could lead to crashes.

Go said its fuzzing can be particularly useful for developers looking to test for security exploits and vulnerabilities in the edge cases humans often miss.

The developers warned that using fuzzing in an application can consume a lot of system memory and that developers may experience significant performance dips on their machines while it runs. There is also no limit to the number of files or total bytes that can be written to the fuzz cache, which may lead to multiple gigabytes of storage being used.

Workspaces and performance improvements

Go has introduced multi-module workspaces that allow developers to tell the Go command that code is being written on multiple modules at the same time.

It addresses one of the chief challenges identified in the development team’s annual survey of Go programmers that showed it was difficult to work using Go across multiple modules. The new workspace mode makes this a more streamlined process.

Go also said the latest version delivers performance increases of up to 20% when using Apple M1, ARM64, and PowerPC64 thanks to an expansion of Go 1.17’s register ABI calling convention to the architectures.

The improvement is significant, and Go emphasised that while it’s proud of the speed increase, it’s still only the fourth most important part of the release, underlining how significant the other changes are.

Microsoft has released the latest version of TypeScript, version 4.6, which brings with it an array of features including some that weren’t included in the beta or release candidate (RC) versions.

Among these is the ability for developers to narrow types based on discriminate properties, something that would throw an error in previous versions of TypeScript.

Microsoft said it comes down to each developer’s preference and how they like to destructure objects into properties.

“When destructuring individual properties into a const declaration, or when destructuring a parameter into variables that are never assigned to, TypeScript will check for if the destructured type is a discriminated union,” said Daniel Rosenwasser, senior program manager of TypeScript at Microsoft. “If it is, TypeScript can now narrow the types of variables depending on checks of other variables.”

Another of the never-before-seen features in TypeScript 4.6 is the support for es2022 in TypeScript’s --target option. It means features like class fields now have a stable output target where they can be preserved.

It also means more recently added TypeScript functionality like the at() method on arrays, Object.hasOwn, or the ‘cause’ option on a new Error can be used with the new --target setting or with --lib es2022.

A feature that was present in the previous RC release but went undocumented was the suggestions for mismatched JSDoc parameter names. Developers can document parameters using an @param tag but when these fall out of date TypeScript editors will now provide suggestions for when parameter names don’t match between a function and its JSDoc comment.

One change from the beta that made it to the current release is the removal of unnecessary arguments when programming in --jsx react-jsx mode. When compiling certain code, JavaScript would produce code containing a ‘void 0’ argument that simply wasn’t necessary. Overall bundle sizes can be reduced as a result of the argument’s removal, said Rosenwasser.

Further code improvements have been made to classes; developers will now be able to write their constructor’s code before declaring super().

Classes made JavaScript, a language on which TypeScript builds, require the developer to call super() before referring to ‘this’. The rule used to apply to TypeScript too but Rosenwasser said the langauge was too strict in how it enforced the rule - it was a “cheap” implementation that rejected a lot of valid code.

There are a host of other changes brought to TypeScript including, but not limited to, an expansion of binding errors in JavaScript files. The full release notes can be found on Microsoft’s TypeScript developer blog.

Microsoft has offered an early look at the new features coming to the C# programming language as part of the new updates to Visual Studio (Visual Studio 2022 Update 1) and the latest .NET SDK (6.0.200).

All features revealed by Microsoft this week are preview features, meaning they’re in the early stages of development and Microsoft has invited feedback from all corners of the developer community.

Said feedback has already been pouring in since the announcement, with developers specifically vocal on one of the proposed new features: Parameter Null-checking.

The feature aims to introduce a more succinct syntax for checking null values by moving the checking method code to the parameter name, replacing it simply with a !! operator.

Example code snippets above show a traditional way of checking for null values against the more succinct preview feature announced this week.

Using the new parameter operator will generate code to perform the null check, said Kathleen Dollard, principal program manager at .NET, and the generated null check will execute before any code in the method body. For constructors, the check performs before the field initialisation, calls to base constructors, and calls to these constructors.

There are a number of restrictions regarding where the syntax can be used in code, interested developers should consult the full release notes for more information.

One individual commenting on Microsoft's blog post announcing the proposed change said the “syntax is ugly as hell. It adds noise to the code”.

It was one of many comments voicing mixed feelings towards the new syntax. Others criticised the new feature for making the code easier to write, but more difficult to read.

There were also suggestions that the existing notnull keyword could be used in place of the !! syntax and enhance compatibility with Nullable Reference Types – a group of features introduced in C# version 8.0 to reduce the likelihood that executed code throws an error.

Replying to commenters, Dollard said: “We’d love any feedback with alternate syntax suggestions”.

Among the other new features is an improvement to string interpolation. Both verbatim and non-verbatim string interpolation styles remain unchanged in their core behaviour, but newlines will now be allowed in the holes of interpolated strings.

“Previously, these restrictions extended to the holes of non-verbatim interpolated strings,” said Dollard. “Holes is a shorthand way of saying interpolation expressions and are the portions inside the curly braces that supply runtime values. The holes themselves are not text, and shouldn’t be held to the escaping/newline rules of the interpolated string text segments.”

The last of the new features is List Patterns, which allow developers to match elements against lists and arrays. Developers can also optionally include a slice pattern that matches zero or more elements.

For example, a pattern such as [1, 2, .., 10] will match any array of integers that contains both a 1 and a 2 at the start of the array and finishes with a 10. These arrays could have any number of additional integers in between those set conditions and still match the pattern.

The team working on the Flutter development framework have launched Flutter for Windows, marking the first stable release on a desktop platform.

The first Windows-specific stable build of the Google-created Flutter framework will allow developers to build Windows-first applications using the cross-platform development toolkit. The framework also functions on other platforms like iOS, Android, macOS and Linux, though these have yet to receive stable Flutter builds.

Flutter is a relatively new cross-platform framework that builds on the Dart programming language, allowing developers to build apps for mobile and desktop all with a single codebase. It has been used by the likes of BMW, ByteDance, and Betterment, plus 30 teams from inside Google to make business-ready apps since its first launch in 2017.

Developers can use every part of the Flutter framework to build Windows-first apps, and it can also talk to the Win32, COM, and Windows Runtime APIs either directly through Dart’s C interop layer, or using a platform plugin written in C++.

As well as Google adding Windows support to some of the most popular Flutter packages, and the community adapting a wider selection of packages for Windows too, there are a number of packages available to developers to develop a fully tailored UI for Windows apps that express the Microsoft Fluent design system.

"We’re delighted to see Flutter adding support for creating Windows apps," said Kevin Gallo, corporate vice president for Windows Developer Platform at Microsoft.

"Windows is an open platform, and we welcome all developers. We’re excited to see Flutter developers bring their experiences to Windows and also publish to the Microsoft Store. Flutter support for Windows is a big step for the community, and we can’t wait to see what you’ll bring to Windows."

Flutter 2.10 includes additional features, performance improvements, and bug fixes, said Tim Sneath, product manager for Flutter and Dart at Google.

"In the coming months, you’ll hear more from us on completing stable support for macOS and Linux, making the full set of desktop, web, and mobile platforms available for your production Flutter apps," he added.

The majority of developers have welcomed the update with a positive reception, with specific attention being placed on the applications that have already been updated to harness the new Windows-first features.

Flutter said it's "very exciting" to see its maturing ecosystem of apps take shape, such as the Rive graphics tooling suite (pictured above), Nevercode's Codemagic CI/CD tool, and Flutter's own low-code Flutter app design tool, FlutterFlow, in addition to a number of other projects too.

Flutter is still in its infancy as a development framework and while developers are excited for the latest update, there are still some bugbears held by the community, such as lacking support for web-based apps.

Flutter launched a 'stable' version for web apps in August 2021 that aimed to allow the seamless transformation of code designed for mobile apps to the web, but developers still criticise Google for not fixing the numerous bugs still affecting that arm of the framework.

Flutter is also not yet highly regarded in the professional space - it didn't make the top 50 in the TIOBE index, a monthly ranking of the most in-demand development languages, though Dart - the language that underpins Flutter - is ranked at 37.

The core Python developers have launched three new "cursed" releases of the Python programming languages today, each of which causing headaches.

The developers were forced to release the new versions without Windows installers - a less than ideal circumstance but the launch was necessary due to a memory leak bug in the previous version which impacted certain apps.

The developers were unable to issue the new releases with Windows installers due to unexpected complexities regarding the Windows certificate renewal. Two lead developers are working hard to resolve the issue and Windows installers are expected to added by the end of this week.

"The releases you’re looking at were all cursed in some way," said Łukasz Langa, CPython core developer. "What a way to start 2022! Besides the certificate hold up, Python 3.10.2 is an expedited release, Python 3.11.0a4 had almost 20 release blockers before being finally green, and Python 3.9.10 was made from a new M1 Mac on macOS Monterey which made the usually boring process quite a ride. We’re hoping 2022 won’t be this intense all year!"

Python 3.10.2

The latest release for the up-to-date main Python build is a special bug-fixing edition which has been released ahead of schedule to address a memory leak bug. The issue was affecting apps using certain function calls when using Cython - a superset of the python language that compiles code into C, offering performance boosts.

"The memory leak consisted of a small constant amount of bytes in certain function calls from Cython code," said Langa. "Although in most cases this was not very noticeable, it was very impactful for long-running applications and certain usage patterns."

The release also addresses more than 100 other bugs which are now fixed and developers are highly encouraging the community to upgrade to Python 3.10.2 as soon as possible.

Python 3.9.10

Python 3.9 is the most recent legacy Python series and the update marks its ninth maintenance release. Python 3.9 will receive three more bug-fixing updates before users are expected to migrate projects to the latest 3.10 build, but will receive security updates until 2025. The final bug-fixing update is expected to land in May 2022 and the next one is scheduled for Pi Day, 14 March 2022.

With the latest 3.9.10 release, the developers have made 130 changes since 3.9.9 which represents a higher number of fixes made to the build in this stage of its development cycle compared to Python 3.8.

The developers served a reminder for macOS users that the default installer is now the new universal2 variant. It's compatible with Mac OS X 10.9 and newer, and will work natively with Apple Silicon machines.

Python 3.11.0a4

The next generation of Python 3 is still in alpha development with 3.11.0a4 representing the fourth of seven planned alpha releases before it succeeds Python 3.10 as the main build in October 2022.

"Alpha releases are intended to make it easier to test the current state of new features and bug fixes by the community, as well as to test the release process," said Langa. "During the alpha phase, features may be added up until the start of the beta phase (2022-05-06) and, if necessary, may be modified or deleted up until the release candidate phase (2022-08-01). Please keep in mind that this is a preview release and its use is not recommended for production environments."

Features for Python 3.11 are still being planned and written, but among the most exciting for developers will be the implementation of the Faster CPython Project. The project aims to find performance improvements in the speed of executing Python code without breaking the C API.

Python creator Guido van Rossum said at the 2021 Python Language Summit that he and a small team, funded by Microsoft, were working on making performance improvements to the language. At the time, van Rossum said improvements were possible but the degree to which speeds could be improved was unknown.

The latest alpha build of Python 3.11 has shown around 19% faster performance compared to Python 3.10 on the geometric mean of the PyPerformance benchmarks, Langa said.

Cyber security researchers have discovered evidence of a years-old ransomware strain returning after being rewritten in Golang - a cross-platform programming language capable of reaching a higher number of users across different operating systems.

The TellYouThePass ransomware was first discovered in 2019, however researchers at Crowdstrike have now spotted a new strain being used as a second-stage attack following a successful exploit of the Log4Shell vulnerability revealed in December 2021.

The Java and .NET languages were used to create TellYouThePass before it emerged into circulation three years ago, but the pivot to Golang, often referred to as 'Go', has enabled attackers to target users across Windows and Linux with minimal changes to the malware's code.

Once encrypted, victims are greeted with a demand of 0.05 Bitcoin (£31,960) in return for a decryption tool to recover all their files.

The ransom note displayed to victims

When examining code from malware targeting Windows and Linux machines, more than 85% of the code was near identical across the operating systems. This means Golang eliminates much of the leg work typically required to re-write malware for different operating systems, according to the researchers.

This interoperability has resulted in a steady growth in the popularity of Golang among malware authors over the past few years, according to Crowdstrike.

Researchers noted that hackers who have re-written TellYouThePass in Golang have done so using a number of obfuscation techniques to make analysis of its code more difficult for researchers.

The binary of the malware is patched in the new version of TellYouThePass to make it difficult to use string-based signatures to detect that the malware is even written in Golang at all.

Hackers have also taken to randomising the names of the malware's functions, leaving just the main function easily identifiable - another tactic used to impede technical analysis of the ransomware.

Analysis of TellYouThePass shows how function names are randomised

Before initiating the encryption routine, TellYouThePass attempts to kill certain tasks and processes, but on Linux this requires root privilege in order to perform that process. Such tasks include email clients, database applications, web servers, and document editors.

What is Golang?

Golang, or 'Go', is a versatile, cross-platform programming language created by Google in 2007 and is among the most in-demand languages currently in use by the IT community, according to the University of California, Berkeley.

Crowdstrike noted in a November 2021 report that it noticed a steep rise in uptake from the cyber crime community in 2021 with an 80% increase in use between June and August 2021.

The cyber security firm said cryptocurrency miners are the most popular form of malware using Golang with miners accounting for 70% of all Golang-written malware as of August 2021. As evidenced with TellYouThePass, ransomware is also seeing Golang uptake, as well as password-stealing trojans and downloaders, Crowdstrike said.

Among the other strains of ransomware written in Golang, the likes of Babuk and HelloKitty - the ransomware that targeted CD Projekt in 2021 - are the most prominent, according to cyber security firm Morphisec.

"Golang’s versatility has turned it into a one-stop shop for financially motivated eCrime developers," the company said in a blog post. "Instead of rewriting malware for Windows, macOS and Linux, eCriminals can use Golang to cross-compile the same codebase with ease, allowing them to target multiple platforms effortlessly."

Despite having the ability to target users on a cross-platform basis, Crowdstrike said the vast majority (91%) of malware written in Golang targets Windows users - due to it market share, 8% is targeting users on macOS and just 1% of malware seeks to infect Linux machines.

Pivoting to Golang is also an attractive proposition given that it performs around 40 times faster than optimised Python code. Golang can run more functions than C++, for example, which makes for a more effective product that can be more difficult to analyse.

"Portability in malware means the expansion of the addressable market, in other words who might become a source of money," said Andy Norton, European cyber risk officer at Armis, speaking to IT Pro. "This isn’t the first time we've seen a shift towards more portable Malware; a few years ago we saw a change towards Java-based remote access trojans away from .exe Windows-centric payloads.

"The ability for security controls to inspect payloads is also another factor threat actors take into account, and drove the prevalence of file-less attacks up in recent years. The scrutiny and patching of Java currently on the back of Log4j vulnerabilities may be reducing Java's attractiveness as a threat vector and driving change in the criminal groups."

Our list of the best C++ courses aims to provide an overview of what's available on the market today. Leaners will be in different stages of development, and so we've tried to cater for a variety of experiences.

An extension of the C language, C++ is a popular object-oriented programming language that's used across operating systems and web browsers, as well as in language compilers and interpreters, gaming engines and apps, graphics, banking applications, and much more.

According to Statista, C++ is in the top ten most used programming languages globally and it’s unlikely to disapear anytime soon. With this in mind, learning C++ is a fantastic place to begin if you want to establish a career in programming.

To help you get started, we’ve assembled a list of the best C++ courses available, for absolute beginners through to the more advanced.

Our list of the best C++ courses has been populated based on a combination of factors, including community reviews, the convenience of each course, and whether they cater for absolute beginners or a current professional looking to up-skill or retrain. Our goal is to provide a broad range of options to give you a good sense the market today.

The best C++ courses

Beginning C++ Programming - From Beginner to Beyond

Provider: Tim Buchalka, et al (via Udemy)

Price: $119.99 (£59.99)

Course link: Beginning C++ Programming - From Beginner to Beyond

Course length: Over 46 hours

In this course, you’ll learn modern C++ through 46 hours of video content and 75 downloadable resources, plus quizzes, coding exercises and assignments.

You’ll be taught C++ features from the basics to more advanced inheritance and polymorphic functions, as well as key concepts of programming that apply to other languages.

You’ll also learn about using C++ lambda expressions and how to use Visual Studio Code with C++ – a recent addition to the course.

Learn C++ from Scratch

Provider: Educative

Price: Free

Course link: Learn C++ from Scratch

Course length: Ten hours

This free interactive course is broken up into nine sections, starting with a simple ‘hello world’ program. It then moves on to cover core concepts such as conditional statements, loops, and functions in C++, plus advanced topics like inheritance, classes, and templates.

You’ll learn through quizzes and challenges, and three ‘exams’ assess your competence. By the time you're done, Educative states you'll be an intermediate level C++ developer.

C++ Programming: Essential Techniques and Best Practices for Developers

Provider: Bill Weinman (via LinkedIn Learning)

Price: £25

Course link: C++ Programming: Essential Techniques and Best Practices for Developers

Course length: Four hours

This course covers the history of C++ and modern C++, explaining the C++ toolchain before diving into topics like syntax, statements and expressions, identifiers, variables, pointers, and references.

Areas of focus include flow control conditionals, loops, data types, operators, and functions, as well as classes and objects. You’ll also learn how to use templates, including STL.

This is a great course for both beginners and advanced users, covering a solid range of topics in impressive detail.

Unreal Engine C++ Developer: Learn C++ and Make Video Games

Provider: Ben Tristem, GameDev.tv Team (via Udemy)

Price: $139.99 (£59.99)

Course link: Unreal Engine 5 C++ Developer: Learn C++ & Make Video Games

Course length: 39.5 hours

Love games and fancy having a go at creating your own? Well, Udemy has you covered. This course teaches you the game design principles you need to create and mod video games using Unreal Engine 5 – even if you're a complete beginner.

You’ll be taught C++ through project-based learning, creating different kinds of games including ‘Toon Tanks’ and a simple first-person shooter (FPS).

By the end of the course, you'll be very confident in the basics of coding and game development, and hungry to learn more. If you're a complete beginner, this will teach you all the coding and game design principles you'll need.

C++ For C Programmers, Part A

Provider: Ira Pohl, UC Santa Cruz (via Coursera)

Price: $49 (£38)

Course link: C++ For C Programmers, Part A

Course length: 13 hours

This course is designed for experienced C programmers who want to learn how to program in C++, and so the examples and exercises require a basic understanding of algorithms and object-oriented software.

Through the five modules – two in C, two in C++, and then a final exam – you’ll learn how to convert programs, apply the principles of Dijkstra’s shortest path algorithm and use basic container classes.

Developed by the University of California, Santa Cruz, this is part of a larger Coding for Everyone: C and C++ Specialization course.

IBM: Data Structures & Algorithms Using C++

Provider: Josephine Simi N.A., et al (via edX)

Price: Free - optional paid upgrade available

Course link: IBM: Data Structures & Algorithms Using C++

Course length: Eight weeks

This intermediate level course, taught by professionals from IBM, discusses the characteristics of commonly used data structures and algorithms and how to implement them in order to conduct efficiency analyses in C++ from scratch.

Amongst other things, you’ll gain experience with various algorithms required to build efficient programs, and learn how to measure the efficiency of the program you’ve written.

Google's C++ Class

Provider: Google

Price: Free

Course link: Google's C++ Class

Course length: Self-paced

One of the best ways to learn how to program in a new language is by examining lots of example programs. Google’s informal class does just that – it gets straight to the point, teaching you the basics of C++ through practical application.

The best thing to do is to copy and paste each program below into a text file, and compile it. Then, try the experiments. By extending these example programs, you’ll gain familiarity with various aspects of C++, and you’ll feel more confident when it comes time to write programs from scratch.

Practice is key to success in this class, which over time goes into more depth, ending with a quiz (read test) for you to see if you’ve understood everything you’ve learnt. Simple, yet very effective.

C++ Nanodegree Program

Provider: David Silver, et al (via Udacity)

Price: $249 (£194) per month / $2,390 (£1,862) per year

Course link: C++ nanodegree program

Course length: Four months, at ten hours per week

This nanodegree program is broken down into six courses, covering everything from the foundations of C++ and object-oriented programming through to memory management and concurrency.

The course includes learning how to build a route planner using OpenStreetMap data, write a process monitor for your computer, implement smart pointers, and build a multithreaded traffic simulator.

You’ll end by building your own application following the principles you’ve learnt, or can choose to take an optional seventh course, which focuses on career services, with support optimizing your GitHub and LinkedIn profiles.

One of the most popular languages in the world of data science to program in is R. It is the 12th most popular programming language, according to recent RedMonk ratings.

It helps users analyze structured and unstructured data, which has made it the standard language for carrying out statistical operations. It has features that set it apart from other languages used in data science.

It was initially developed in 1993 by Ross Ihaka and Robert Gentleman. Like the S language, R is a GNU project, but it is a different implementation of S. While there are significant differences, most code written for S runs unaltered under R.

The S language is used for research in statistical methodology while offering an open source way to participate in that activity.

Why learn R?

As mentioned earlier, R excels at statistical computing. Data visualization is known to be easier using R than with Python. It also has built-in functionality and useful tools that make performing tasks simpler in areas such as visualization, reporting, and interactivity.

There are over 2,000 free open source libraries for finance, cluster analysis, high-performance computing (HPC), statistics, machine learning, and data science. R is open source, so users can freely install, use, update, clone, modify, and redistribute it. It is also cross-platform, so it runs on Windows, Mac OS X, and Linux. It can also import data from Microsoft Excel, Microsoft Access, MySQL, SQLite, Oracle, and many others.

Python is known for being friendly for beginners. However, when you understand R’s syntax, you learn it offers a big advantage in learning data science basics, as it was designed with data manipulation and analysis in mind.

Organizations worldwide use R with data manipulation and analysis in mind.

What are the best courses for R

There are many online courses people can take to learn this powerful language. Below is a selection of the best.

R Programming A-Z: R For Data Science with Real Exercises!

Provider: Udemy

URL: https://www.udemy.com/course/r-programming/

Course length: 10.5 hours

This step-by-step course helps students learn to program in R. It teaches the core principles of programming and how to create variables. Parts of the course teach you how to use R Studio and customize it to your preferences. There is also practice in financial, statistical, and sports data in R. Students will also learn about Normal distribution and Law of Large Numbers.

R Programming

Provider: Coursera

URL: https://www.coursera.org/learn/r-programming

Course Length: 57 hours

In this course, students learn how to program in R and use it for purposes such as data analysis. Students learn how to install and configure software necessary for a statistical programming environment and describe generic programming language concepts as they are implemented in a high-level statistical language.

The course covers practical issues in statistical computing, including programming in R, reading data into R, accessing R packages, writing R functions, debugging, profiling R code, and organizing and commenting R code. Topics in statistical data analysis will provide working examples.

Programming for Data Science with R

Provider: Udacity

URL: https://www.udacity.com/course/programming-for-data-science-nanodegree-with-R--nd118

Course Length: 3 months at 10 hours a week

This nanodegree program helps students learn the programming fundamentals required for a career in data science. By the end of the program, students will use R, SQL, Command Line, and Git.

The introductory program has three modules: Introduction to SQL, Introduction to R Programming, and Introduction to Version Control. The module on R Programming teaches fundamentals such as data structures, variables, loops, and functions. Students will learn to visualize data in the popular data visualization library ggplot2.

Data Science: R Basics

Provider: edX

URL: https://www.edx.org/course/data-science-r-basics

Course Length: 8 weeks at 1-2 hours per week

This is the first part of a multi-part course that leads to a Professional Certificate Program in Data Science. It introduces students to the basics of R programming and builds a foundation that paves the way for the more in-depth courses later in the series where concepts such as probability, inference, regression, and machine learning, are covered.

Students can develop a skill set that includes R programming, data wrangling with dplyr, data visualization with ggplot2, file organization with UNIX/Linux, version control with git and GitHub, and reproducible document preparation with RStudio.

Statistics with R Specialization

Provider: Coursera

URL: https://www.coursera.org/specializations/statistics

Course Length: 7 months at 3 hours per week

There are five modules in this course from Duke University. These are Introduction to Probability and Data, Inferential Statistics, Linear Regression and Modeling, Bayesian Statistics, and Statistics with R Capstone.

The capstone project will be an analysis using R that answers the course team’s specific scientific/business question. A large and complex dataset will be provided to learners and the analysis will require the application of various methods and techniques introduced in the previous courses.

R Programmer

Provider: Datacamp

URL: https://www.datacamp.com/tracks/r-programmer

Course Length: 44 hours

This course provides programming skills needed to successfully develop software, wrangle data, and perform advanced data analysis in R. Students need no prior coding experience and will learn how to manipulate data, write efficient R code, and work with challenging data, including date and time data, text data, and web data using APIs.

There are interactive exercises to gain experience working with R libraries, including devtools, testthat, and rvest, that will help students perform important programmer tasks, such as web development, data analysis, and task automation

Data Science and Machine Learning Bootcamp with R

Provider: Udemy

URL: https://www.udemy.com/course/data-science-and-machine-learning-bootcamp-with-r/

Course Length: 17 hours 45 minutes

This course is designed for beginners with no programming experience or experienced developers looking to jump to Data Science.

Students learn how to program with R, create data visualizations, and use machine learning with R. This includes linear regression, decision trees, random forests, neural nets and deep learning, and support vector machines.

R for Data Science: Lunchbreak Lessons

Provider: LinkedIn Learning

URL: https://www.linkedin.com/learning/r-for-data-science-lunchbreak-lessons

Course Length: 13 hours 8 minutes

Lunch Break Lessons teaches R in short lessons that expand on what existing programmers already know. Students can review language basics, discover methods to improve existing R code, explore new and interesting features, and learn about useful development tools and libraries to make their time programming with R more productive.

R Programming: Advanced Analytics in R For Data Science

Provider: Udemy

URL: https://www.udemy.com/course/r-analytics/

Course Length: 5 hours 58 minutes

This course is for anyone who has basic R knowledge and would like to take their skills to the next level to become proficient at data science and analytics with R.

Students are expected to have taken and completed the R Programming A-Z course. Students learn how to prepare data for R analysis, perform the median imputation method in R, work with date-times in R, what lists are and how to use them, and what the Apply family of functions is.

Python has firmly established itself as a cornerstone programming language, celebrated for its remarkable versatility and developer-friendly syntax. Its widespread adoption across diverse industries is a testament to its power and ease of use, making it an essential skill for IT professionals. Whether you're embarking on your coding journey or looking to expand your existing skillset, Python, in tandem with other top programming languages, offers a gentle learning curve combined with the depth required for complex applications.

As a general-purpose language, Python's applications are extensive. While prominently used in web development to power server-side logic for countless online services, its reach extends far beyond. Today, Python is integral to cutting-edge fields such as data science, machine learning, and artificial intelligence, where its robust libraries and frameworks enable sophisticated data analysis and model development. It's also a go-to language for automation scripting, helping to streamline IT operations and repetitive tasks across systems.

Beyond these prominent areas, Python is leveraged in game development, building network tools, creating prototypes for new software, and even in embedded systems. Major technology corporations routinely use Python for testing and building critical components of their products. Its utility isn't confined to tech-centric roles either; finance and accounting professionals increasingly use Python for data manipulation and automating calculations, underscoring its broad appeal and practical value.

Popular uses of Python include:

• Website and software development
• Task automation
• Data analysis
• Data visualization
• Web development and frameworks
• Embedded systems
• Graphic design
• Network development
• Rapid application development
• Testing
• Automation scripting

Is Python development a good career?

The demand for skilled Python developers remains exceptionally high in 2025, solidifying its status as a rewarding career path. Employers across diverse industries actively seek Python expertise, leading to competitive compensation packages. This sustained demand is largely fuelled by Python's critical role in rapidly expanding fields such as artificial intelligence, machine learning, data science, and web development, ensuring that proficiency in the language continues to be an asset for IT professionals.

In the US, Python developers command impressive salaries. As of early to mid-2025, data from Talent.com indicates an average Python developer salary of approximately $125,111 per year, with entry-level positions starting around $105,052 and experienced workers earning up to $156,149. Reinforcing this, Salary.com reported an average for Entry Level Python Developers at $122,695 as of May 2025.

Across the United Kingdom, Python developers also benefit from strong earning potential, though figures vary by region. IT Jobs Watch indicated a median UK salary of £85,000 as of May 2025. In London, experienced developers (3-5 years) can expect salaries ranging from £85,000 to £105,000 according to Morgan McKinley's 2025 Salary Guide. Roles outside the capital, such as in Manchester, typically see averages for developers of £69,962, as suggested by data from Indeed.com.

Python's dominance is further evidenced by its top ranking among programming languages. GitHub's Octoverse reports from late 2024 and early 2025 consistently show Python as the most used language, driven significantly by its indispensable role in the AI and machine learning boom – fields that saw nearly 100% growth in related GitHub projects in 2024. Coupled with its famously gentle learning curve and a vast, supportive global community, Python remains an accessible yet powerful choice for both aspiring and established developers looking to thrive.

What are the best Python courses?

If you’re interested in learning Python, the best courses can help you master the language and put it into use with a range of complimentary technologies.

The Complete Python Bootcamp from Zero to Hero in Python

Best online Python course for beginners

Provider: Udemy

Price: Udemy courses are frequently discounted. List prices can range from $100−200, but sales often reduce this to $15-30. Udemy also offers a "Personal Plan" subscription for access to a curated collection of courses.

Course link: The Complete Python Bootcamp from Zero to Hero in Python

Course length: 22 hours

This highly-rated and comprehensive course by Jose Portilla is continually updated to teach modern Python 3. It's designed to take absolute beginners to a proficient level through numerous hands-on coding exercises, covering everything from Python installation and basic syntax to advanced features like object-oriented programming, modules, and error handling. Completing this bootcamp provides a strong foundation for further specialization.

30 Days of Python | Unlock your Python Potential

Best intensive online Python course

Provider: Udemy

Price: Subject to Udemy's dynamic pricing and frequent sales (often available for $15−30 during promotions, from a higher list price).

Course link: 30 Days of Python | Unlock your Python Potential

Course length: 9.5 hours

For those seeking a focused and practical introduction, this course by Justin Mitchel offers a hands-on approach to learning Python 3. It covers core programming concepts and quickly moves into practical applications, such as working with CSV files for data tasks. By the end, students will be equipped to tackle projects like web scraping, gaining valuable, real-world skills.

Advanced Python: Language Features

Best online Python course on LinkedIn Learning

Provider: LinkedIn Learning

Price: Included with a LinkedIn Learning subscription (typically around $29.99/month billed annually or $39.99/month billed monthly; a one-month free trial is often available). Individual course purchase prices vary.

Course link: Advanced Python: Language Features

Course link: Advanced Python: Language Features

Course length: 2 hours 30 mins

LinkedIn Learning offers a variety of specialized "Advanced Python" courses taught by industry experts. These courses delve into topics such as advanced object-oriented programming, concurrency, metaprogramming, and efficient data structures. They are ideal for developers looking to deepen their understanding of Python's more powerful features and write more sophisticated, optimized code.

Python and Django Full Stack Web Developer Bootcamp

Best online Python course for web development

Provider: Udemy

Price: Subject to Udemy's dynamic pricing and frequent sales (often available for $20−40 during promotions, from a higher list price).

Course link: Python and Django Full Stack Web Developer Bootcamp

Course length: 32 hours

This comprehensive bootcamp by Jose Portilla guides learners through building complete web applications using Python and the latest stable versions of the Django framework. It covers front-end technologies (HTML, CSS, JavaScript) alongside back-end development, database integration, and REST API creation. It's an excellent choice for those aiming for a full-stack web development career using Python.

AI Programming with Python

Best online Python course for using AI

Provider: Udacity

Price: Udacity Nanodegrees typically operates on a monthly subscription (e.g., around $249−399/month) or offers a bundled price for the estimated program duration. Check Udacity for current pricing and promotions.

Course link: AI Programming with Python

Course length: 3 months (around 10 hours per week)

This Nanodegree program is designed to provide a strong foundation in AI programming using Python. It covers essential data science libraries (NumPy, Pandas, Matplotlib), machine learning concepts, and deep learning with PyTorch. Students learn to build and train neural networks, including an introduction to advanced architectures like Transformers, preparing them for more specialized AI roles.

Python Programmer

Best online Python course for those wanting a bit of everything

Provider: Datacamp

Price: Datacamp uses a subscription model (Standard or Premium), with monthly or discounted annual payments. Premium plans often range from $15−30 per month when billed annually. Check Datacamp for current pricing.

Course link: Python Programmer

Course length: 67 hours

Datacamp's "Python Programmer" Career Track offers a structured path for individuals aiming to build a career in programming with Python, even with no prior experience. It covers fundamental Python concepts, data structures, object-oriented programming, and then progresses to practical applications like web scraping and working with APIs, all through an interactive, hands-on learning platform.

Data Scientist with Python

Best online Python course for data science

Provider: Datacamp

Price: Datacamp subscription model (see Python Programmer track above for typical pricing structure).

Course link: Data Scientist with Python

Course length: 90 hours

Specifically tailored for aspiring data scientists, this extensive Career Track from Datacamp teaches how to use Python for data manipulation (Pandas), data visualization (Matplotlib, Seaborn), statistical analysis, machine learning (Scikit-learn), and an introduction to Natural Language Processing (NLP). The interactive exercises and real-world projects help solidify understanding and build a portfolio.

Learn Python Programming Masterclass

Best online Python course for software development

Provider: Udemy

Price: Subject to Udemy's dynamic pricing and frequent sales (often available for $20−40 during promotions, from a higher list price).K)

Course link: Learn Python Programming Masterclass

Course length: 74 hours

This detailed masterclass by Tim Buchalka's Learn Programming Academy is designed for both beginners and existing programmers wanting to master Python 3 for software development. It covers a vast range of topics from basic syntax to advanced concepts like object-oriented programming, database interaction, web development basics (e.g., with Flask), and GUI development. While it may offer context on Python 2 for legacy understanding, the primary focus is on modern Python 3 practices.

If you have ambitions to become a professional software developer, this course will give you a foundation to build upon. And existing programmers will also benefit by expanding the languages they are proficient in.

Python for Everybody Specialization

Best online Python course for data visualization

Provider: Coursera

Price: Courses can often be audited for free. To earn a certificate and access all graded assignments, Coursera Specializations typically require a monthly subscription (around $49-79/month for the Specialization, or access via a Coursera Plus subscription). Financial aid may be available.

Course link: Python for Everybody Specialization

Course length: 2 months (10 hours per week)

This highly respected Specialization from the University of Michigan, taught by Dr. Charles Severance ("Dr. Chuck"), is an excellent entry point into Python and computer science. The five-course series covers Python 3 basics, data structures, accessing web data (APIs, JSON, XML), using databases with Python, and culminates in a capstone project involving data retrieval, processing, and visualization. It's renowned for its clear explanations and practical approach.

Hackers are increasingly turning to relatively obscure programming languages when coding malware in a bid to avoid detection and pose greater challenges for the cyber security industry.

Security professionals are coming across greater numbers of malware strains that are being written in ‘exotic’ languages such as Go, Rust, Nim, and DLang, according to researchers with Blackberry. Operators are even adopting these languages to rewrite existing malware families and create tools for new malware sets.

It has been found that these coding languages typically thwart signature-based detection, while malware analysis tooling doesn’t always adequately support unconventional programming languages.

These languages themselves also serve as a layer of obfuscation, because each of them is relatively new and has little in the way of supported analysis tooling. However, these four languages identified in the report are each fairly developed and have a strong community backing.

“Programs written using the same malicious techniques but in a new language are not usually detected at the same rate as those written in a more mature language,” the report concluded. “This is the latest trend in threat actors moving the line just outside of the range of security software in a way that might not trigger defenses in later stages of the original campaign.”

“Malicious binaries written in languages like D, Rust, Go, or Nim currently comprise a small percentage of the languages being used by bad actors in the world today, but it is imperative that the security community stay proactive in defending against the malicious use of emerging technologies and techniques.”

Each language has its own benefits and drawbacks in different scenarios, the researchers also explained. Nim, for example, can be compiled into several languages such as C, C++, and even JavaScript. DLang has many syntax improvements over C, as well as being fully interoperable with, and syntactically similar to, C.

Rust is known for having a very low overhead, and is efficient where performance is concerned, while Go is widely touted as C for the 21st century, according to the paper.

Although C-language malware is still the most widespread, malware operators, including major groups such as Fancy Bear and Cozy Bear, are using unconventional languages in their malware sets more often than other groups.

Often enough, entire C-language malware families don’t actually need to be rewritten from scratch, with these groups simply writing loaders, droppers, and wrappers in exotic languages instead. This means they can effectively embed their payloads in harder-to-detect shells that are newly written in order to avoid signature-based detection.

There is a litany of cases cited in the report where such groups have adopted elements written in obscure languages to disguise their attacks. In 2018, for example, Cozy Bear was seen targeting Windows and Linux machines with WellMess, a remote access trojan (RAT) written in Go and .NET.

Fancy Bear was also discovered in 2018 using a Go-based Trojan identified as a rewritten version of the original Zebrocy malware. The following year, the group was seen using a Nim downloader alongside the Go backdoor in the same campaign targeting embassies and ministries of foreign affairs in Eastern Europe and Central Asia.

IBM unveiled a suite of new artificial intelligence (AI) services on Monday ahead of its virtual IBM Think 2021 conference.

The new features include software that teaches AI how to translate code, a cloud migration service, and more functions for the firm's Watson Assistant.

The most interesting of the announcements was a Rosetta Stone-like service for programming code called 'CodeNet', which is an expansive dataset designed to teach AI and machine learning systems how to translate code. It comprises some 14 million snippets and 500 million lines of code spread across more than 55 legacy and active languages, such as Cobol, Java, C++, and Python. The dataset is constructed in a way that allows for bidirectional translation, enabling Cobol legacy code to be translated into Java, for example.

"Given its wealth of programmes written in a multitude of languages, we believe Project CodeNet can serve as a benchmark dataset for source-to-source translation and do for AI and code what the ImageNet dataset did years ago for computer vision," the firm said.

AI featured heavily in the updates, with new features for Cloud Pak for Data, an SaaS integration platform called 'Watson Orchestrate', and a Watson Assistant collaboration with healthcare providers handling increased workloads due to the pandemic. The tech giant also revealed 'Maximo Mobile', a mobile platform based on IBM's Maximo asset management service.

The updates also included a new cloud migration service called 'Mono2Micro' that also uses AI to analyse large enterprise applications and provide recommendations on how to best adapt them for the move to the cloud. IBM said it can simplify and speed up an error-prone process, which can reduce costs and maximise returns on investment.

Beyond artificial intelligence, the announcements included a hybrid cloud-based financial services platform, built with Red Hat OpenShift. There was also a $1 billion investment to support IBM's partner ecosystem which includes skills training, and a streamlined service for quantum computing called Qiskit Runtime.

IBM is offering the quantum industry’s first developer certification in a bid to help workforces become “quantum-ready”.

Developers will have to display their knowledge of Qiskit, IBM’s open source quantum development kit, and answer 60 questions in the certification exam.

IBM hopes this will allow people from all development backgrounds to earn a certification in programming Qiskit, “allowing them to leverage their quantum coding skills into a potential opportunity in this exciting new workforce.”

Armed with the knowledge of how to use Python and basic linear algebra, Qiskit allows users to programme quantum computing hardware. Since IBM launched it in 2017, thousands of users have developed applications, maintained and improved code and more.

Now, the company wants to “build a diverse, global, cloud-based ecosystem of developers who can bring quantum computing skills to their own communities and industries.” It hopes that with this new certification, it will help companies and research institutions get their workforce “quantum-ready”.

The certification takes the form of a 60 question exam offered on the Pearson VUE platform and those who pass it must demonstrate experience of using Qiskit to create and execute quantum computing programmes on IBM quantum computers and simulators. They must also display the ability to perform these tasks with little to no assistance from product documentation, support or peers.

IBM also hinted that this is the first of several in a series of new certifications. Upcoming certifications are said to tap into the skills displayed in this newly released certification to demonstrate familiarity with building quantum computing applications to solve problems in optimization, chemistry and finance.”

Earlier this month, IBM unveiled a range of new and enhanced services to help organisations manage their cloud security strategy and controls for hybrid cloud environments. These would be available on the IBM Security Services for Cloud and help enterprises to adopt a consistent and unified security approach across IBM.

Renowned programmer and founder of the Python programming language, Guido van Rossum, has come out of retirement to join Microsoft’s development team.

More than a year after announcing his retirement, van Rossum has decided to take up a role with the company’s ‘Development Division’, with a view to making Python generally better to use, and not just for Windows 10.

The Python creator left Dropbox in October 2019, having worked at the company for almost seven years, making contributions to Python at Dropbox but also exerting major influence over the company's engineering culture, and staff. Prior to this, van Rossum developed software for Google.

Few details have been disclosed about the nature of van Rossum’s role, although it’s expected his presence will continue to influence Microsoft’s deepening integration with Python. Van Rossum also hinted at “lots of open source” when it comes to his duties.

His latest move coincides with the Python language flying past Java to break into the top-two most popular programming languages for the first time, according to the TIOBE index.

Python ranked second in the latest monthly rankings for the first time in the index’s 20-year history, with C still the most popular language. C and Java have traditionally been the most prevalent languages among developers up to this point.

The TIOBE index is updated once a month, and ratings are based on the number of skilled engineers worldwide, courses and third-party vendors. Popular search engines are used to calculate the ratings. C scored 16.2%, followed by Python on 12.1% and Java on 11.7%.

Supplementary research has reinforced this point, with Stack Overflow reporting separately last year that Python and Typescript were the joint-second most popular languages among developers. In this study, Javascript was found to be the most popular language.

Python’s relative simplicity against other languages makes it a highly accessible language for developers, including people who want to get to grips with the fundamentals of coding.

Photo by Daniel Stroud / CC 4.0 International

As tech continues to dominate our lives, more and more people are looking to software development as a career choice, and an increasing number are entering the workforce as self-taught coders. Tools like Codecademy and FreeCodeCamp have allowed more people than ever to pick up skills in JavaScript and Python, as well as more esoteric languages like C++, Ruby and R.

But with so many different flavours to choose from, how can aspiring coders identify which programming languages are worth their time to learn? In this week’s episode, we talk to Jess Cregg, a self-taught developer who has gone from working in comms to being an associate solutions engineer at Twilio, to find out how she made the jump, and what languages prospective devs should start off with.

Footnotes

• What is JavaScript and why should I learn it?
• How to become a senior JavaScript developer
• What is TypeScript?
• Learn to code for free: The best UK coding and app development courses
• UK developers are most contented in the world, finds report
• How to become a Python developer
• Can I become a coder?
• Should you learn to code?
• How to become a computer programmer without a degree
• Taking the road less travelled to a career in IT
• The ultimate guide to becoming a programmer
• Whatever happened to the 1980s coding heroes?
• The IT Pro Podcast: Why cool kids code with COBOL
• IT Pro 20/20: The learning revolution starts now
• Is there still an app for that?
• FreeCodeCamp.org
• Codecademy
• Codebar.io

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Before taking the leap into the wild world of tech careers, you must first ask yourself what's your goal of working in tech and why you want to be a part of it. Did a particular type of technology pique your interest, or is it just the entire tech field that excites you?

For Liz Beavers, senior sales engineer ITSM at SolarWinds, starting a new tech career meant leaving behind her old public relations job. Once she saw all the job opportunities in tech, Beavers saw it fit to get to work honing her technical know-how and work toward becoming a sales engineer.

“Over time, I found that I was hungry to learn more about the technology, pushing the boundaries past the ‘norm’ of what our product supported and that I truly enjoyed solving problems,” Beavers shared. “This led me to take the next step in technology as a sales engineer. As a sales engineer, I was challenged to understand the intricacies not only of our platform but of the IT world and with that came the opportunity for certifications, like ITIL 4.”

The tech industry offers many career seekers a virtually limitless supply of career opportunities. If you're already interested in the tech industry or considering switching to tech from another field, you must understand it takes time, dedication, and a commitment to always learning and growing to be successful.

Facts about working in the tech industry:

• In May 2020, the median annual wage for careers in computer and IT occupations was $91,250.
• Job opportunities in the tech industry are projected to grow 13% by 2030, much faster than the average for all occupations.
• There's projected to be 178,00 new tech jobs in 2022.
• In 2022, there were 3.6 million job postings in tech.

Breaking into tech means embracing constant learning

Those wanting to get into the technology industry need to start thinking of themselves as constantly learning and developing, according to Nikola Baldikov, Brosix’s digital marketing manager.

The good news is that there are hundreds of different ways you can study and fine tune your IT abilities. You might go to university and earn a bachelor degree in computer science or even find a suitable certification online. There are plenty of different routes to pursue to build up your tech skills and work as an IT professional.

First, you need to become an expert in an industry niche that you have an interest in. A good place to start is trawling job boards to see which certifications are popular and investigating which are worth the time and expense to acquire them, says Jennifer Curry, product and technology SVP at INAP, an IT infrastructure solutions provider.

Curry also encourages fine tuning your soft skills, especially if you’re interested in climbing the rungs of the corporate ladder. “The ability to translate business goals into technical reality will keep you highly sought after for the rest of your career,” Curry says.

Safwaan Rahman, a talent acquisition manager at the DMW Group, believes that, like Curry, if you work in the tech industry you should try to get certified in a field that interests you.

“Certifications are worth it,” said Rahman. “They really help you move into an area if you lack the experience to show credibility in understanding a particular field. If I see someone who holds CISSP for example, I am comfortable they know Information Security in depth even if their CV is focused in other areas. If you're looking to start a career in cloud, a cloud certification is the best way to help you on that journey.”

Although a certification can add more to your portfolio, and demonstrate you know what you’re talking about, don’t expect them to be a golden ticket into the industry. Carlene Jackson, Cloud9 Insight’s CEO, believes that the industry is welcoming to newcomers and certificates are useful for establishing a strong bedrock of your tech knowledge. Those with a hunger to learn new things will be the ones who are the most successful, she thinks.

Landing a job in the tech industry

If you’ve ever had to search for a new job, you probably know that hunting for one can be a long, challenging, journey. It takes a lot of effort and energy to find a job in tech, especially considering the amount of job boards you have to trawl through or networking events you have to take part in.

It’s important for jobseekers to start their search by ensuring they have a firm commitment and interest to the tech industry itself, says Uliana Lysunets, recruiter and HR manager at KeenEthics. “You have to feel like a true member of the IT world before you actually become a member,” says Lysunets.

To accomplish such a feeling, Lysunets tells aspiring tech workers to subscribe to tech blogs and newsletters, listen to IT podcasts and follow industry headliners and leaders of thought. Lysunets encourages applicants to work on developing their personal brands too.

“The IT market is oversaturated, so recruiters look for unique people. You should have your own opinion, practice critical thinking, do not follow the crowd,” says Lysunets. “Try developing your personal brand, for example, by writing a blog on Medium, recording podcasts, or speaking at community events."

Riseapps CEO, Vladlen Shulepov, encourages tech hopefuls to consider using an internship or apprenticeship as a stepping stone into the tech industry. Petra Odak, CMO at Better Proposals echoed this sentiment, adding that you should find companies that reflect your area of interest and share why you want to get started with that specific company when applying.

Don’t discount the benefits of networking events. While many people shy away from these events, connecting with others in the tech industry can be extremely valuable. Not only will it help you meet others in your field of interest, but it can also lead you to new job opportunities.

“Networking can be a little daunting when you aren’t already in the industry, but it’s something that can really help you get noticed,” says Carla Diaz, co-founder of Broadband Search.

Of course, job boards will always be one of the most useful resources you’ll have at your disposal when applying for a tech job. From national sites like Indeed to more niche boards like DataJobs, job boards are an excellent tool and can be a great way to find your first tech job.

Cyber security conference organiser Black Hat is being urged to change its name after a Google’s VP withdrew from the upcoming Black Hat USA virtual conference.

David Kleidermacher, who is VP of Android security and privacy at Google, announced would no longer be attending the event on Twitter on Friday, saying that “society needs to change - now - how it talks and acts, in support of racial justice and equity”.

‘Black hat’ is a computer security term which refers to a malicious actor who participates in cyber crime for personal gain.

Kleidermacher’s statement was met with backlash from numerous Twitter users who refuted the term’s racial connotations and argued that the term originated from classic Western movies, where lawful cowboys wore white hats while their ‘bad’ counterparts donned black.

The Google engineer reiterated that “the need for language change has nothing to do with the origins of the term black hat in infosec[urity]”.

“Those who focus on that are missing the point. Black hat / white hat and blacklist / whitelist perpetuate harmful associations of black=bad, white=good,” he added.

“Language change is not 'the answer', it’s but one (small) part of the fight against racial, ethnic, and other injustice and inequity that has a many important battlefields. The fact that we’re having this conversation, even with inevitable twitter trolling, is a win.”

Information security expert Brian Anderson agreed with Kleidermacher’s opinion, adding that Black Hat events lack minority representation.

“Black people have struggled for lifetimes with negative imagery associated with blackness. The studies are clear that children see goodness and beauty in whiteness, ugliness and bad in black. MY children have to deal with this just like our parents did before us. That is harm,” he tweeted.

Anderson added that the high cost of attending the Black Hat events is “prohibitive for a lot of minorities”. The price of admission for one person for the US event in August starts at $2295 (£1836).

IT Pro reached out to Black Hat to ask whether any other speakers had withdrawn their attendance following Kleidermacher’s decision, but the organisation has yet to response. The Black Hat US event is set to take place virtually on 1-6 August.

Last week, Twitter decided to drop the terms "master", "slave" and "blacklist" in favour of more inclusive language in its programming. The social media site is following in the steps of a number of tech firms that have already pledged to ditch the terms in light of the black lives matter protests.

Twitter is dropping the terms "master", "slave" and "blacklist" in favour of more inclusive language in its programming.

The social media site is following in the steps of a number of tech firms that have already pledged to ditch the terms in light of the black lives matter protests.

The terms are very common in programming, with "master" referring to the main version of code that often controls other "slave" protocols. "Blacklist" is a label for items that are automatically denied or for forbidden websites. These were included in a set of words posted by Twitter's engineering division that it will remove on the recommendation of two of its black engineers, Regynald Augustin and Kevin Oliver.

DevOps specialist The Scale Factory removed references to master and slave in its code a few years ago. The company's CEO and CTO Jon Topper told IT Pro that it was fairly straightforward to change the names of variables and methods in its own code and configuration files, but it wasn't possible to entirely remove this language.

"If you're working with MySQL replication, for example, that software itself uses master/slave terminology and so it has to appear in your code too," Topper said. "Renaming Git branches from "master" to "main" is similarly straightforward, though might require changes to CI servers and other systems you work with.

"The real question here is whether, as an organisation, you're also working on the human side of the problem. Dismantling structural racism in our organisations will take more than just a couple of cosmetic code changes... I've heard black voices say that it's good to challenge our use of this language in tech, but way more that say this isn't enough on its own. We all need to do better."

There have been calls within the tech industry to drop the terms long before the death of George Floyd and the black lives matter protests. In 2018, Red Hat programmer Victor Stinner issued a change request for avoiding the terminology in Python, which is often thought of as one of the world's most popular programming languages.

"For diversity reasons, it would be nice to try to avoid 'master' and 'slave' terminology, which can be associated with slavery," he wrote, also citing a number of complaints in the thread.

Despite a heated debate breaking out, with some Python developers suggesting that only "slave" should be removed because they didn't deem "master" an offensive term, Stinner's request was upheld. "Slaves" was subsequently changed to "workers" or "helpers", while "master process" was changed to "parent process".

CNN reported back in 2003 about a discrimination complaint concerning the use of the words "master" and "slave" on a videotape machine in Los Angeles. The complaint led to a request from County officials for electronics manufacturers to remove the terms from their products when doing business in the county.

It worked. I couldn’t believe it, but it actually worked.

Stephen French and I had just spent all afternoon tapping code from a textbook into our computers – me into my Commodore 64, him into his Spectrum. It was probably no more than 20 lines of BASIC code, but once we’d typed it all out, run it, fixed the inevitable typos, finally got it to work and then saved it to tape, it had taken us all afternoon.

Being good programmers, we tested the code. He slipped a note through my letterbox, I ran upstairs, loaded my program and typed in the cryptic, handwritten jumble of letters. “Meet you at my house after The A-Team,” Frenchy’s message read, having been decoded by the Commodore 64. We were officially spies.

Admittedly, this basic, schoolboy encryption was some way short of 256-bit AES. I suspect the program merely substituted one letter of the alphabet for another, a code that – had we given it ten minutes and a Biro – even the cat would have cracked. But it was my first step into programming, getting a computer to do something other than play games, and I remember it like it was yesterday.

My next step came some 35 years later. Earlier this year, in fact, when I decided I wanted to teach myself how to code something more sophisticated than a primitive encryption system. I’ve dabbled with HTML over the years, can look at JavaScript and get a rough idea of what’s going on, but for one reason or another I’d never formally sat down and tried to learn a programming language since the days a crack commando unit was sent to prison for a crime they didn’t commit.

I settled on Python, the language that consistently appeared in all of the “10 programming languages you should learn NOW” articles I could find online. There was no shortage of books, online courses and apps willing to teach me. But could I actually do it? Could I reach a point where I could code something useful without setting foot in a classroom or lecture hall? I could, and here’s how.

Hitting the books

I’m a bit old school. I learnt most things from textbooks and good teachers, and it was a book that gave me the gentle shove I had been waiting for. To be precise, when Learn Python In One Day and Learn It Well appeared in the Amazon Prime Reading catalogue.

I’m immediately suspicious of any get-rich-quick-type title such as Learn Python In One Day. Nobody learns a computing language in a day, even if you had time to read all ten chapters and digest them. Nonetheless, I recognise we’re living in the age of clickbait and this kind of title helps shift books. And from skimming the first few pages of the book on my Kindle, it didn’t seem anywhere near as trashy as the title suggested.

However, a couple of chapters in and, having got my head around basic Python syntax, variables and lists, I wanted to put what I’d learned into practice with a few practical exercises. But this book didn’t seem interested in that, being more of a whistle-stop tour of the main Python commands and procedures.

I’m not knocking the book – it will stay on my Kindle and I’m sure will come in handy for reference as I progress – but it wouldn’t teach me how to code, let alone in a day. I needed something more structured, something that’s going to hold my hand as we shuffle into the complex stuff.

The online classroom

I decided an online course might be the best way forward, but where to start? There are so many online Python courses that you could spend a year just shortlisting them.

A number of forums had mentioned Microsoft’s free Python For Beginners course. It comprises 44 videos, co-hosted by a chap who sounds scarily like Kermit the Frog, and an interactive online course to go with it. That very much ticked the box of writing code as I learned, which is what I wasn’t getting from the book.

I watched the first ten or so videos, and although they were a little rudimentary to start with (if you need to be taught how to install apps on a PC, I’m not sure coding is for you yet), they gathered pace and I could follow along comfortably.

What put me off was the online tutorials. For example, in one you’re asked to write the code for a basic calculator – but all the examples of the code you need are on the previous page. When you flick back to see the code, you lose everything in the browser-based sandbox where you enter the code to the right. It didn’t like it when I had two tabs open at the same time, either.

Maybe I should have memorised the code from the previous page – it wasn’t blisteringly difficult after all. But I’m the kind of guy who works best with examples open in front of me as I type. And if I was stumbling on these basic tasks, I couldn’t see it getting better as the stuff got more complex. I needed another approach.

The best of both worlds?

In the end, I decided to go for a best of both worlds approach. After blowing out midway through the Microsoft course, I read a news story that Google was running a new online Python course for beginners via Coursera. That piqued my interest, not least because the last certificate I had earned was my Cycling Proficiency.

On a serious note, it seemed like that certificate could actually lead to gainful employment opportunities, but when I looked at the course syllabus my enthusiasm waned. It was largely pitched at people who wanted to use Python to administer IT networks and that’s not my bag.

However, elsewhere on Coursera, I came across Python for Everybody. This is a course delivered by the University of Michigan’s Dr Charles Severance and – handily for textbook-loving me – he’s written a book of the same title to accompany the course (or the other way round, I’m not sure which is the chicken and which is the egg).

That instantly appealed to me, as I could have the textbook open next to me on my tablet as I watched course tutorials or took on coding exercises myself. Better still, that book is free from the Python For Everybody website or only 99p to download on Amazon Kindle, which is a small price worth paying for not having to deal with the messy way Kindles handle PDFs.

The Coursera course is broken down into a series of “weeks”, with assignments to be carried out at the end of most weeks, although you can learn at your own pace. The first part is meant to take seven weeks, but I whistled through it in two.

The first part – or “specialization”, as Coursera dubs it – of this course basically follows the same structure each week. Us coders might call that a “loop”, with a “break” after week seven. You watch one or more videos, delivered by Dr Severance. You answer a ten-question quiz to make sure you’ve understood all of the concepts that have been explained. And then you take on a practical coding exercise that’s “auto-graded” by a piece of software. If that sounds clinically impersonal, it is, but Coursera has ways to bring the human element back into teaching, which I’ll come to later and that help justify the £37 per month you’ll spend doing this course on Coursera instead of doing much of the same material for free on Dr Severance’s PY4E website.

Dad jokes and daft hats

One thing that’s definitely not clinically impersonal is Charles Severance, or Dr Chuck as he calls himself (he’s @DrChuck on Twitter too). He sounds like Danny Concannon from The West Wing, doesn’t look entirely dissimilar and has the same easy-going style as the fictional reporter. He explains concepts patiently, bordering on laboriously, to make sure you don’t suffer from code blindness. He makes dad jokes, he occasionally turns up in silly hats, and he’s constantly slurping coffee as he delivers his video lectures – the latter of which sounds amateurish, but genuinely helps give the impression you’re sitting in a real lecture delivered by a real human being, not a presenter reading a polished script.

That’s further reinforced by watching him type code onscreen. I thought I was the worst touch-typist this side of Shanghai, but Dr Chuck knocks me out of the park. Coursera could have edited all those typos and mistyped commands out of the videos, but they’ve left them in and it helps you warm to a tutor who makes the same silly mistakes you do. If that’s deliberate, it’s subtly done.

The course isn’t perfect, occasionally leaving me stranded. As I mentioned previously, there’s a free textbook that accompanies the course, which is required reading. However, you’re largely left to work out for yourself which chapters you need to read before each week. You’ll get the hang of it after the first few weeks, but there have definitely been moments of head-scratching, when you’re expected to know something that’s not been covered in a video.

The graded exercises also had me thumping the desk in frustration once or twice. At the start of each exercise, you’re given instructions on what to do and given some sample code in the online editor to get you started. Yet that sample code isn’t always necessary or is occasionally even a red herring.

Worse, for me, is that you don’t always get to see how The Doc would have coded the exercise after you’ve completed it. I understand why they don’t want pupils sharing the code in Coursera’s online forums, because it spoils the exercises for people who haven’t done them yet, but once you have completed an exercise, it would be great if Coursera could email you Dr Chuck’s code and a short video explaining how he did it, just so you learn best practice.

I made this point on Coursera’s discussion forums and a tutor replied that: “There are multiple ways to write code and many different solutions can be both efficient and elegant. Which is why we also cannot give you one solution as a standard.” I get that, but I still feel that seeing an alternative way to crack the same nut would be beneficial.

That said, it’s clear that Dr Chuck and the course tutors don’t want to spoon-feed you everything. Coding is essentially problem solving; if they give you all of the solutions, it doesn’t encourage you to find alternative answers or better ways of reaching the same result yourself. As Dr Chuck himself says in one of his early lectures: “One of my whole goals in design of this class is for you not to try to rush through it, but to feel a mastery of it. And feel free to do the same problem over and over and over again, and hide the solution from yourself, until you realise, oh wait a sec, this is easy. Because frankly, up to this point and going forward, none of this should be very difficult. And you should really understand every single thing that’s going on in every one of the assignments.”

If you do find yourself staring glumly at a screen, failing to work out why a piece of code won’t deliver the desired result, you can upload it to the online editor and ask a staff member to take a private look via the discussion forums. They reply promptly, normally the same day, patiently explaining the error of your ways. On one assignment, my piece of code wasn’t running properly because I’d failed to de-indent a single line. It was both a relief and a punch-yourself-in-the-face moment when the tutor explained the problem.

This is the biggest drawback of distance learning. In another exercise, I methodically worked through a task where you had to import a batch of emails, run a search to look for a spam identifier string, strip out everything except the numbers at the end of those strings, convert them to integers and calculate an average. I took my time, solved each problem bit by bit, but got stuck on the final hurdle for a few hours. And what was my downfall? Not declaring the value of a variable at the top of the code instead of midway through. If I were sitting in a classroom with Dr Chuck, I’m pretty sure that he would have looked over my shoulder, pointed to the innocuous error and my stress levels would have remained sub-Trump. Instead, I beat myself up for a few hours, trying to rewrite perfectly good code that wasn’t working because of one small mistake.

But, determined not to rely on the in-house tutors once more, I did eventually work it out for myself. And although my cardiologist might disagree, that process will serve me well in the long run because there are not always going to be ready-made solutions to coding problems. I’m going to have to work through stuff. And it is exhilarating when you do manage to crack a problem by yourself, even if I may have to reinforce my office walls to prevent fists going through them for the preceding six hours of every task.

Certified coder

At the time of writing, I’ve just completed the first part of Python for Everybody and have the certificate to prove it. I’m currently midway through the second of five parts of the course, and it’s just starting to get interesting. We’re now importing and manipulating real data, starting to see how the previous eight chapters of theory might be put to good use. For example, I’m already thinking of ways I can take the masses of analytical data we get at the non-league football club I help run and use Python code to help spot trends. Likewise, I’m starting to think of Python scripts that might be useful for the tech website I publish. I’m keen to push on – the challenge is finding enough time to do so around the day job. (The irony of having to stick learning on the back burner so I can write a feature about teaching myself Python has not been lost on me.)

My Coursera certificate might mean nothing in the wider world. It’s not an accredited course, it won’t get me a job nor even a foot in the door. But as someone who has long yearned to learn how to code, it means something to me.

2019 has been a landmark year for the field of natural language processing (NLP), from the rise of self-supervised learning and unstructured data to major model breakthroughs such as the Transformer models and BERT.

These techniques are now becoming much more mainstream and translating into real-world business applications. With the increasing availability of massive neural network models pre-trained on publically available unlabeled data, companies can now leverage these NLP models on their own data within their organisation.

This whitepaper explores the emerging trends and techniques in the field of NLP; the recent landmark breakthroughs in NLP architecture, in particular with regards to the Attention technique and Transformer models; and finally, the emerging business applications of NLP that these technological breakthroughs are unlocking, and that we’re likely to see implemented at a large scale across organisations in the years to come.

Skills and training are a crucial element of running any business, but it’s especially critical when it comes to IT. It’s a running battle to just keep up with what’s needed to operate a company’s current tools, let alone developing proficiencies that will allow you to start expanding into new areas.

In this week’s episode, we talk to Brad Mallard, CTO of Fujitsu Global, to find out how one of the world’s largest technology services providers trains and educates its staff. We discuss the e-learning tools that have helped make skills training fun and accessible, the gamification of professional development, up-skilling those already in the business and why learning COBOL gives young engineers a license to print money.

We also discuss the hackers who had a sudden attack of conscience, the latest blow in the video conferencing arms race, and whether or not the current crisis caught network security specialists with their pants down.

Footnotes

News

Troldesh hackers hang up their boots

• Hackers retire Troldesh ransomware and release 750,000 decryption keys
• Ransomware gangs shift focus to big businesses
• Mirai: Trio confesses to creating the world's most powerful DDoS botnet
• What is ransomware?

Google Meet enters the free video conferencing fray

• Google Meet goes free in bid to counter Zoom
• Zoom quietly corrects misleading claims of over 300 million daily users
• Facebook rolls out video conferencing upgrades to take on Zoom
• WhatsApp tackling group video calling limitations to take on rivals

Network security plans found wanting in coronavirus outbreak

• Almost a third of businesses lacked a network security plan prior to the pandemic
• What is network forensics?
• What is network topology?

In-depth

• CompTIA launches online testing to ease certification amid coronavirus outbreak
• How to keep your IT team's skills current
• Is a degree still necessary to get ahead in IT?
• Taking the road less travelled to a career in IT
• What should I be looking for when hiring a developer?
• Are autonomous databases the doom of database administrators?
• CompTIA makes certification testing possible in the social distancing era
• Why the mainframe is still going strong
• Professional development trends in IT
• Gamify your business growth
• The IT Pro Podcast: How upskilling can improve diversity

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

GitHub has signed an agreement to acquire widely-used JavaScript platform npm, with parent company Microsoft eventually hoping to integrate the newly bought company into GitHub in the longer-term.

Considered an essential part of the JavaScript ecosystem, the npm package manager is home to 1.3 million packages and sustains 75 billion downloads per month. The platform will be integrated into the GitHub development platform, which Microsoft took under its ownership in 2018.

The firm is planning to invest in the registry infrastructure and wider platform, with investments made to ensure it’s fast, reliable and scalable.

Microsoft will moreover, improve the core experience for developers while retaining npm’s open-source status. Additional features, such as Workspaces and improvements to multi-factor authentication (MFA) processes, will be developed with time.

Finally, the company wants to actively engage with the JavaScript community so the views of developers can be fed into future builds of npm.

“The amazing energy and creativity of millions of JavaScript developers is evident every day in the work that appears in npm,” said GitHub chief executive Nat Friedman. “We are honored to support that community in a new way. The future of npm and the JavaScript ecosystem is very bright.”

The eventual goal is to integrate GitHub and npm to improve the security of the wider open-source software supply chain, the company said. Users in future would be able to trace a change from a GitHub pull request to the npm package version that fixed it.

Friedman added users who use npm Pro, Teams and Enterprise to host private registries will continue to be supported under the GitHub-npm umbrella. The firm says it’ll invest heavily in packages so it serves as a wide-ranging multi-language that’s fully integrated with GitHub.

Later in 2020, Microsoft will allow npm’s paying customers to move their private npm packages to GitHub packages, with an exclusive focus on ramping up the public registry for JavaScript.

The move to integrate the JavaScript platform signals the extent to which Microsoft is aiming to build GitHub into an all-encompassing hub for developers and coders.

JavaScript has long been considered to be one of the most popular coding languages. Despite the rise of newer languages like Python, MDM and Kotlin, JavaScript was still found to be the most popular language for businesses, according to research from 2019.

The average salary for a UK tech worker increased by 13% in 2019, jumping to £74,000 per annum, according to recruitment site Hired.

Software developers now earn £37,000 more than the average British worker, according to Hired's State of Software Engineers report, which looks at 2019's software engineering roles around the world and the programme languages they use.

UK developers saw a larger wage increase than any other tech hub around the world, even beating San Francisco which saw a 6% jump year-on-year.

Search engineers in the famous Bay Area still get paid the most, though, with an average wage of $157,000 (£122,000).

The three best-paid developer roles in the UK were for embedded engineers, who earn £82,000 on average, blockchain engineers, who earn £81,000 a year and computer vision engineers who also get paid around £81,000 per annum.

Global demand for Blockchain engineers has increased by 517%, according to the report, while gaming engineers saw the biggest wage increase in both London and San Francisco.

Other software developer roles that saw an increase included machine learning engineers, which ranked in the top ten highest-paid jobs for most of the hubs listed, with an average salary of £101,000.

"While salaries for software engineers continue to rise globally, the UK led the way in 2019, cementing the country's place as one of the world's top tech hubs," said Gordon Smith, European GM at Hired.

"To continue this unparalleled growth in the UK, employers, aside from offering competitive salaries, need to ensure that understanding what top talent want from their jobs is the main priority for hiring managers."

Google's Go is the world's most in-demand coding language, according to the research, but JavaScript came out on top for most use. Although TypeScript is the most popular programming language in San Francisco, Toronto and London, while Ruby was more favoured in New York and Go in Paris.

The UK has the happiest IT programmers in the world, according to French coding platform CodinGame.

The Montpellier-based firm released its annual IT developers survey, which asks programmers about their work and the industry at large.

Over 20,000 IT developers from 120 different countries took part in the survey, answering questions on how and where they learnt to code, which language they use and how happy they're in their jobs.

When asked how much they love their work on a scale of one to 10, globally 66.4% answered between 7 and 10. The UK came out on top with its developers averaging of 7.40 for happiness. Canada and the US came second and third respectively.

With regard to the tools of the trade, the most popular languages were Javascript (65.46%), Java (62.74%) and Python (57.13%) with over half the respondents saying they knew how to code in all three. But familiarity doesn't necessarily breed love: Java and Javascript also featured high on a list of most-dreaded languages with 23.93% of developers saying they hated Java and 21.29% for Javascript.

One in three developers considered themselves self-taught coders, according to the survey, learning via free resources such as textbooks and online tutorials on sites like YouTube. However, the majority (58.2%) say they honed their skills at either university or school with none simply learning "on the job".

The studies continue when they leave full-time education as coding, like any language, is a skill that needs constant practice. YouTube, again, features heavily in this regard as 60.8% of the developers surveyed said it is their favourite medium to bone up on coding. Online tutorials and blogs proved very popular with the participants with a massive 64.9% saying they boost coding knowledge this way.

What's more, one in three programmers said they keep up their skills up by coding for more than one hour a day in their own time.

Acquiring robust coding skills through free coding courses in the UK offers a significant opportunity for individuals looking to pivot their careers or enhance their current technological expertise. Proficiency in coding is increasingly vital across numerous industries, empowering professionals to automate processes, boost efficiency, and maintain a competitive edge.

The career prospects in software development are compelling. Junior software developers in the UK can expect starting salaries of £30,000.00 per year or £14.42 per hour, while senior or lead roles can command on average £52,720. This strong demand and earning potential make programming an attractive field for sustained career growth.

Fortunately, learning to code does not require a substantial financial investment. A wealth of free resources caters to both beginners and seasoned learners. Whether your goal is to master a new programming language, upgrade existing skills, or delve into specialized areas of software development, free coding courses provide a flexible and cost-effective path. Below is a curated list of some of the top free coding courses accessible in the UK to kickstart your learning journey.

The best free coding courses in the UK

FreeCodeCamp

Website: https://www.freecodecamp.org/

FreeCodeCamp, a charity, offers an extensive, entirely free learning platform where individuals can master coding through hands-on projects and interactive challenges. With a vast library boasting over 9,000 tutorials and growing, learners can progress at their own pace. 

The curriculum is project-based, enabling practical application of learned skills. Key certifications, which are internationally recognized, cover areas such as Responsive Web Design, JavaScript Algorithms and Data Structures, Data Visualization, Back End Development and APIs, and Quality Assurance. A vibrant community forum provides robust support for collaboration and assistance, enhancing the learning experience.

User review insights: Highly praised for its comprehensive curriculum and hands-on approach. Users on platforms like Course Report and SwitchUp consistently rate it highly (often 4.5-4.9 out of 5 stars) for its practical projects and supportive community. G2 reviewers give it an average of 4.6 out of 5 stars. Other sources continue to recommend it as a strong starting point for web development fundamentals.

Code First Girls

Website: https://www.codefirstgirls.org.uk/

Code First Girls, co-founded by Alice Bentinck and Matthew Clifford, is a social enterprise dedicated to closing the gender gap in the tech industry. It has provided free coding education to over 80,000 women across the UK and beyond. 

The enterprise's CFGdegree programs and other free courses cover foundational topics such as web development, Python, data science, and SQL. These programs are designed to be flexible, enabling women to gain job-ready skills while balancing other commitments. Code First Girls partners with major corporations to connect participants with employment opportunities in tech.

Among these courses are introductions to web development, Python programming, data science, and SQL programming.

User review insights: Participants often highlight the supportive environment and the direct pathways to employment opportunities. Testimonials on their website and in industry articles consistently reflect the positive impact on career progression in tech. While large aggregator review scores are less common, their partnerships with major companies and the increasing number of women trained (over 100,000 as of early 2023) attest to their effectiveness and reputation.

Code Your Future

Website: https://codeyourfuture.io/

CodeYourFuture, founded in 2016, is a UK-registered charity dedicated to empowering refugees and individuals from disadvantaged backgrounds by training them to become software developers. The organization offers free, part-time coding programs in several UK cities, including London, Manchester, Birmingham, and Glasgow. It has also expanded internationally, with active programs in Rome (Italy), Medellín (Colombia), Cape Town (South Africa), and Tunis (Tunisia).

Its full-stack curriculum covers essential technical skills such as HTML, CSS, JavaScript, Node.js, and React, alongside soft skills development in areas like teamwork, problem-solving, and agile methodologies. The program is designed to be inclusive, offering introductory modules that lead into their core Software Development course. A second, much more substantial course also covers full-stack web development. 

To support accessibility, students who complete an initial introductory course may be eligible for financial assistance covering expenses such as Wi-Fi, travel, and childcare in certain circumstances. 

User review insights: CodeYourFuture earns high regard for its profound social mission and its intensive, supportive training environment focused on refugees and those from disadvantaged backgrounds. Graduates frequently praise the strong sense of community and the dedication of volunteer mentors. Reviews on platforms like Google Reviews for its various chapters and numerous testimonials emphasize its life-altering impact. Its recognition as a Digital Public Good (DPG) further validates its quality and open-source curriculum

Codecademy

Website: https://www.codecademy.com/

Codecademy, founded in 2011 by Zach Sims and Ryan Bubinski, has helped millions of learners worldwide acquire coding skills. The platform offers a free ‘Basic’ tier, granting access to introductory coding courses, enabling beginners to learn foundational concepts at their own pace. This makes it an excellent entry point for those curious about programming but not yet ready for a financial commitment.

Codecademy is known for its interactive, hands-on learning environment, where students build real-world projects, such as websites and applications, reinforcing their understanding. The platform provides courses in a wide range of programming languages, including HTML, CSS, JavaScript, Python, Ruby, SQL, and more.

For learners seeking structured and in-depth training, Codecademy offers paid subscription plans: ‘Plus’ and ‘Pro’, which unlock career paths, skill paths, interview preparation, and extensive project work designed to develop job-ready skills.

With its mix of free and paid options, Codecademy remains a popular and accessible choice for aspiring coders, offering both foundational skills and pathways to advanced knowledge.

User review insights: Codecademy is widely recognized for its interactive, browser-based learning platform, making it easy for beginners to start coding without a complex setup. Its free 'Basic' tier is often praised as an excellent entry point. Users appreciate the immediate feedback and hands-on exercises. While some advanced content and career paths are behind a paywall ('Plus' and 'Pro' plans), the free offering remains substantial for learning foundational skills in various languages. 

Coursera

Website: https://www.coursera.org/

Coursera is a major online learning platform that partners with leading universities and corporations to offer a vast catalogue of courses, specializations, and degrees, including numerous options in coding and computer science. Many individual courses on Coursera can be audited for free, providing access to lecture materials and readings. However, to earn a formal certificate of completion for a course or Specialization, a fee is typically required, which varies by program. These certificates can be valuable additions to a professional profile. 

Coursera's coding content spans a broad spectrum of tech skills, from beginner-level introductions to languages like Python and Java, to advanced topics such as machine learning, data science, and cybersecurity. While some content is self-paced, many courses offer structured learning with assignments and community discussion forums. For comprehensive access, Coursera offers a subscription model, Coursera Plus, which provides unlimited access to a large portion of its catalog for a recurring fee.

User review insights: Coursera is valued for providing access to courses from prestigious universities and companies. The ability to "audit" many courses for free is a significant benefit, allowing learners to access high-quality lecture materials and readings. While certificates and graded assignments typically require payment, the free audit option is excellent for exploration and learning specific topics. Users appreciate the breadth of subjects, from beginner coding to advanced specializations, such as AI and data science.

Founders & Coders

Website: https://www.foundersandcoders.com/

Founders & Coders is a UK-based charity that provides tuition-free, peer-led training programs in full-stack web development. Their distinctive learning model emphasizes collaborative learning and employability.

Its primary offering is an intensive, full-time 16-week coding boot camp, designed to equip individuals with the skills needed for a career in software development. The curriculum includes HTML, CSS, JavaScript, Node.js, and PostgreSQL, with a strong focus on project-based learning and agile practices.

A unique aspect of their model is the expectation that graduates contribute back to the community, mentoring prospective applicants and supporting subsequent cohorts, fostering a sustainable, community-driven learning environment. Additionally, profits from their graduate placement services are reinvested into funding the training programs.

User review insights: Founders & Coders is recognized as a unique, tuition-free coding academy in the UK, emphasizing peer-led, collaborative learning. Reviews often praise its intensive, community-driven bootcamp model. Graduates highlight the strong focus on employability and the supportive environment. Its non-profit nature and the requirement for graduates to contribute back to the community are seen as distinctive and positive aspects. Course Report gives it a rating of 4.49 out of 5 stars.

Microsoft Learn

Website: https://docs.microsoft.com/en-us/learn/

Microsoft Learn is Microsoft's official platform for free, interactive, self-paced learning, designed to help individuals and professionals build expertise in Microsoft products and services. It offers a vast collection of learning paths and modules, covering technologies such as Microsoft Azure, Microsoft 365, Dynamics 365, Power Platform (including Power BI), and SQL Server, as well as broader topics like AI, cybersecurity, and data science.

Each learning path is structured into modules, which include instructional content, hands-on lab exercises in a sandbox environment, and knowledge checks to reinforce learning. The platform caters to learners of all levels, from beginners exploring fundamental concepts to advanced professionals seeking specialized knowledge.

Upon completion of specific learning paths and associated assessments, learners can prepare for Microsoft Certifications — globally recognized credentials that validate expertise in various Microsoft technologies. These certifications can significantly enhance a professional's resume, career prospects, and earning potential in the IT industry. Additionally, Microsoft Learn provides community-driven resources, including forums, study groups, and expert-led training sessions, to support learners throughout their journey.

User review insights: Microsoft Learn is highly regarded as an authoritative and comprehensive resource for mastering Microsoft technologies. Users appreciate the structured learning paths, hands-on labs in sandbox environments, and the direct alignment with Microsoft Certifications. The platform is praised for being entirely free and regularly updated with the latest information on Azure, Power Platform, Microsoft 365, and other MS products. It's considered invaluable for IT professionals working within the Microsoft ecosystem.

W3Schools

Website: https://www.w3schools.com/

W3Schools is a widely recognized online educational resource, offering extensive tutorials and references for a broad range of web development technologies. Its content covers programming languages and frameworks such as HTML, CSS, JavaScript, Python, PHP, SQL, Java, jQuery, React, AngularJS, XML, and Bootstrap.

Unlike structured learning platforms, W3Schools provides detailed explanations and examples for individual programming elements, allowing learners to study specific topics at their own pace. A key feature is its integrated "Try it Yourself" editor, which enables users to experiment with code examples directly in the browser and see immediate results. This hands-on approach enhances practical understanding and encourages interactive learning

While the majority of its learning materials are free, W3Schools also offers paid certification programs for users who wish to formally validate their skills in specific areas, which can be beneficial for career advancement. Additionally, the platform offers interactive coding challenges and exercises, helping learners reinforce their knowledge through practice.

User review insights: W3Schools is a long-standing and widely used resource, valued for its straightforward tutorials and "Try it Yourself" editor, which allows for immediate practice. It's often recommended for quick lookups and learning the basics of web technologies like HTML, CSS, and JavaScript. While some find its explanations a bit simplistic for deep understanding, its ease of use and breadth of topics make it a popular free resource for beginners and as a handy reference for experienced developers.

Code.org

Website: https://code.org/

Code.org is a charity dedicated to expanding access to computer science education, particularly for schoolchildren. While its primary audience is younger learners, its resources also serve as an excellent starting point for adults seeking a gentle introduction to coding concepts without any prior knowledge.

The platform offers a variety of free resources, including its widely recognized "Hour of Code" tutorials, which are one-hour introductory activities available in over 70 languages. These activities introduce basic programming principles through engaging, often game-like interfaces, making coding accessible and fun.

For those looking to delve deeper, Code.org provides structured courses tailored to different age groups. Its curriculum is designed to demystify coding, foster problem-solving skills, and encourage participation from underrepresented groups in technology. Additionally, Code.org plays a key role in advocating for computer science education policies, partnering with schools and policymakers to integrate coding into core curricula.

User review insights: Code.org is highly praised for its mission to expand access to computer science, especially for schoolchildren. While its primary focus is on younger learners, its "Hour of Code" tutorials and introductory courses are often cited as excellent, non-intimidating starting points for adults with absolutely no prior coding experience. Users appreciate the fun, game-like approach to learning fundamental programming concepts.

YAML is a popular programming language responsible for coding configuration files, and so is often used in tandem with many other languages.

For example, Google-developed Flutter framework for Dart and Python both use YAML (.yaml) when writing configuration files for application projects. It's also popular among cloud engineers due to its applicability in formatting containerized files.

Unfortunately, it's not the most welcoming language for new users, and slight formatting errors can completely break the code. YAML requires a very precise number of spaces across multiple lines to show how data sits in a hierarchy.

It’s not always easy for a newcomer to detect where there is a spacing error since most integrated developer environments don’t throw errors for broken YAML code, which at times can disrupt the development process.

What is YAML and when was it created?

YAML was first released in May 2001 and has remained a mainstay in the world of programming and coding for more than two decades now.

YAML is actually an initialism – it originally stood for 'Yet Another Markup Language’ but was later renamed to ‘YAML Ain’t Markup Language’ to better emphasize the fact YAML is a language used for data configuration, rather than for documentation.

The language has remained highly popular thanks to its human-readable nature, with a syntax that's highly intuitive. It’s deemed a more readable and developer-friendly version of JSON or XML.

YAML syntax explained

YAML includes features inspired by various patterns and tools embedded in other programming languages in order to ease the process of reading and writing code.

For instance, indentations and new lines may be used to structure code so the way it appears on your screen reflects how it works in practice, such as in Python. You can also configure how deep indentations are to ensure it’s as readable for you as possible, as long as you retain consistency across the code you’re writing. 

You won’t be able to use a tab character, however, which does dodge the compatibility issue of different operating systems processing tabs in different ways. This also negates the tabs versus spaces issue.

Coders may use YAML to adopt tighter formatting in which the two main data types, lists and arrays, also known as maps, are signified by the [ ] and { } figures. Effectively, this renders YAML a superset of JSON, though it’s outlined for machines, and not people, to read. YAML also includes features absent from JSON, such as comments, the latter of which hasn’t been created to support.

The data types might also be nested, as in Pearl, to show more complex structures. There are also features taken from C, HTML and MIME, as well as mail headers, with colons used to denote key:value pairs.

The space function is also included so you wouldn’t need to encase strings and numbers with quotation marks. Types such as integers, clots and Booleans are automatically detected, and there’s support for ISO-formatted dates and times, although you can also establish your own data types.

Structures let you store multiple documents in a single file or refer to content in one part of the document from elsewhere using an anchor (which also lets you duplicate or inherent properties).

That means it's much more flexible than JSON where the hierarchy is fixed, with each child node having only one parent node and while there's a similar option in XML the YAML parse automatically expands the references. 

That way you get a file that's easier to read and you avoid potential errors copying and pasting parameters where only a handful of things change between different instances, but external systems don't need to be told about the structure of the YAML file.

Why use YAML? The benefits explained

YAML is functionally quite easy to use. As the formatting is straightforward and you don't have to worry about closing tags, brackets or quote marks, you can edit YAML in simple text editing tools, and subsections of YAML files are often valid YAML.

But there are also plugins to add YAML support to common IDEs like Visual Studio Code and Atom; these can use the YAML Language Server provide autocomplete and Intellisense, and there are several YAML linters to check code for correctness.

You can't write YAML that validates itself the way XML documents can do, based on schema, but if you need to define a schema for your YAML there are languages that let you do that. 

The combination of YAML and JSON Schema can be powerful: VS Code, the DocFX static web site generator and even the schema for Microsoft's Q# Quantum Chemistry library use them together to achieve a more human-readable version of JSON.

Using YAML files has advantages over typing in command line options: you can create much more complex structures in YAML and you don't have to deal with long and unwieldy strings of parameters. And because they're files, you can check them into source control systems, track versions and changes.

As YAML also treats lines as information, it works better with git-based systems for tracking changes than JSON. That makes it easier to treat configuration as code that you manage, test and consume the same way you do all your other code.

Why wouldn't you use YAML?

Although functionally it's quite intuitive, it's not an easy language for newcomers.

Even small mistakes made when typing YAML code can lead to file-breaking errors. It was designed to be more easily readable by humans and its syntax reflects that, but developers often run into annoying cases where they have to spend time looking for the slight formatting error that won’t allow them to compile their codebase.

Since YAML is more readable than JSON or XML, reading through a YAML file will more likely lead to finding errors than in other languages. With the kind of configuration you perform in YAML becoming more relevant to the adoption of DevOps, configurations you're specifying may become more complex and may demand more expertise - regardless of the language you’re writing them in.

Arguably, there are better languages, such as TOML, but these haven’t been adopted as widely, so YAML is the language more developers will face.

Higher-grade tools will always be easier to work with versus reading and writing YAML files, and there’s a swelling choice of those for Kubernetes. This choice of tools ranges such as Helm, which streamlines installing and managing Kubernetes apps to managed cloud services, to the kubectl command line.

Tools such as Pulumi, which use familiar programming languages like JavaScript or PowerShell, also fall into this camp. 

Ultimately, YAML is a configuration format that's present in so many widely-used tools and projects that it’s worth familiarizing yourself with it, and understanding its benefits and drawbacks.

Software and web development have become two of the most attractive career paths in tech thanks to employers increasingly willing to consider applicants without a computer science background, the variety of job opportunities out there, and the generous salary packages.

The IT talent shortage is well documented, and as it stands, there is still a real shortage of software developers fluent in a variety of programming languages. The good news is that jobs are plentiful, secure, and often pay handsomely.

Determining what language to learn can be a difficult task, though, given the number of languages and frameworks available, each serving a different sector of the industry. For example, if you wanted to learn how to program to handle and manipulate large datasets, you wouldn’t choose a language or framework built for mobile app development, like Swift, Kotlin, or Flutter.

The languages in this list have been informed by Stack Overflow’s most recent developer survey, while the salary information comes from PayScale, correct as of June 2022.

Python

Python is widely considered among the easiest languages to learn, largely due to its simplified syntax, so it's not surprising that it's one of the most popular.

It has become especially popular in the past few years thanks to its capabilities in applications such as machine learning, a fast-growing field. However, it's useful in a range of other areas too such as robotics, AI and big data, so it can be a valuable skill even for experienced devs. What's more, Python was dubbed the 'language of the year' for the second year running by software testing firm Tiobe in 2021.

Python's relative simplicity makes it the perfect skill for new developers to learn, as it provides a great way to get to grips with the basic fundamentals of programming whilst still offering a tangible benefit to earnings potential. Like Java, Python has access to repositories of pre-written codes that will work on most operating systems. This makes it an excellent teaching tool, allowing new coders to think about problem-solving rather than learning a complex language from scratch.

C#

An offshoot of the original C language, C# (pronounced 'C sharp', like the musical note) is a combination of the best features of C and C++. It's built specifically for Microsoft .NET, and is thus one of the best options for developing code for the Windows ecosystem. As such, given Windows' prevalence in the enterprise world, C# developers are rarely likely to be out of work for too long.

The language uses XML and SOAP to include elements of object-oriented programming, which gives developers additional speed when coding. C# is particularly great for developing lean applications; it has a minimal runtime, and it runs incredibly close to the bare-metal it's running on. This makes it a good choice for embedded systems like IoT devices. It's also versatile enough to handle back-end and front-end development.

Java

Not to be confused with the similarly-named but unrelated JavaScript, Java is actually a slightly younger and completely different language. While JavaScript is used almost exclusively for web-based programming, Java is more versatile. It's often used for back-end and server-side tasks, for example, and will run across a huge variety of different environments.

It's used by around 9 million developers on some 7 billion devices and PCs, even propping up some of the most viewed websites in the world, including Netflix and Amazon.

One of Java's main benefits is that it's a highly-scalable language, so is well-suited to enterprise applications. It's also been in use for many years, so is already a key part of many organisations' environments.

It was designed to allow programmers to run their code on different machines and operating systems with minimal fuss, so long as there is a Java Virtual Machine (JVM) installed. This allows the code to speak a common language and is an ideal choice for developers working on cross-platform networks.

SQL

One of the most venerable programming languages still in mainstream use, Structrured Query Language, known commonly as SQL, was first developed in 1972, and has managed to retain its position as an essential part of modern business IT. This is because it's designed for managing large databases from the likes of Oracle, Microsoft and IBM, which still power a plurality of enterprise applications.

While SQL may seem a bit old-fashioned, it's actually surprisingly versatile, and can run big data applications as well as more traditional databases. It's one of the most reliable languages out there, which explains its enduring popularity.

JavaScript

Another language that has remained in pretty much constant rotation despite its advancing age, JavaScript powers a phenomenal amount of the web.

Built specifically for web development, it's the technology that powers things like rich media, online video, dynamic pages and much, much more. It also has a number of associated frameworks, such as React, which can be used for other applications like building cross-platform mobile apps.

There are very few pages that don't include various elements of JavaScript, and it's absolutely integral for building contemporary looking and feeling web-based applications. HTML and CSS simply no longer live without JavaScript, or 'JS' as it's so often abbreviated, and it also benefits from being one of the most widely-recommended languages for coding novices to pick up as their first.

Indeed, it's the fundamental foundation of virtually all browser-based SaaS applications, which makes JavaScript programmers highly sought-after.

TypeScript

TypeScript is the Microsoft-created superset of JavaScript, and is among the most popular programming languages in the market right now. It was the fifth most popular in Stack Overflow’s most recent developer survey, which indicates there are plenty of professional opportunities for developers with TypeScript skills, making it an ideal option to expand your skillset.

Microsoft maintains the language, adding new features to it regularly, and it is most often used to develop large, scalable applications. The ten-year-old language was built to be more easily usable than JavaScript, the most popular in this list, and more maintainable too.

Swift

Developed by Apple for creating iOS apps, Swift is an open source language that's designed to be simple to pick up.

Like Kotlin's relationship to Android, Swift is the preferred language for writing apps for any of Apple's platforms, including iOS, macOS, watchOS, tvOS and iPadOS. It has also enjoyed a period of growth in the past few years, in part due to its ease of use and also the increased confidence in its long-term viability which leads to more developers learning the language.

This makes it an essential tool for any app developer, but it does limit its usefulness outside that arena. It's not particularly widely-used within enterprise IT, and it's not an especially versatile language in terms of its applications.

If you're planning to develop for mobile devices, however, it's well worth knowing. It has enjoyed a rise of several places in the past few years in the Tiobe index and may well further increase in popularity in years to come.

C

C is another easy-to-learn, multi-purpose language in this list that is hugely popular in the Windows, Linux, and UNIX communities for its powerful capabilities in system scripting applications. It's a general-purpose language that can be used for a variety of applications in the enterprise all the way through to the gaming space.

C also plays a hugely important role in the heart of most major operating systems, with the kernels of Windows, macOS, iOS, Android, Windows Phone, and most of Linux all written in C. It could be argued much of the world runs on C which makes it an ideal, versatile language to add to your arsenal.

C++

C++ consistently ranks among the most useful programming languages in the world and is an extension of the aforementioned C language. Often relied upon by major system processes like operating systems, graphical user interfaces (GUIs), embedded systems and more recently, VR applications, it's another multi-purpose language that's likely to put you in work for many years to come.

Because the language can make direct changes to the hardware on which it runs, C++ is a great choice for developers looking to build fast, efficient applications that require limited resources. Developers have a significant amount of control over the tuning of their C++ code, making little tweaks to efficiency easy to accomplish.

Swift has been around for decades, and has succeeded Objective-C as Apple’s go-to programming language of choice. It’s the only way to write code if you want your app to work on Apple’s device ecosystem, avoiding any compatibility issues or workarounds for them.

The uninitiated are often left confused when it comes to the differences between Swift and SwiftUI; the two work in tandem to build apps for Apple’s hardware. The former is the core language that defines the functionality and basic user interface (UI) of an iOS, iPadOS, macOS, watchOS, or tvOS app, while SwiftUI is a framework that lets users get more creative when it comes to building UIs. A reductive way of looking at things would be to say: SwiftUI is to Swift as CSS is to HTML.

Swift has come on leaps and bounds in recent years, not just in functionality but in popularity too. The popular programming language has steadily climbed rankings like the TIOBE index and is often viewed as one of the top ten most in-demand skills for software developers in today’s market.

Before Swift, Objective-C was the default programming language for Apple hardware but, over time, Apple instead adopted Swift which is largely based on Objective-C. There are still examples of pure Objective-C code in Swift, too, and to use them developers have to use special ‘objc’ annotation syntax so Swift can read and compile it properly.

Swift inherits a lot from its forefather but also from other languages too, like Python, Rust, and Ruby. In recent years, Apple has focused on improving Swift, and SwiftUI, to make it as easy as possible for developers to use and build great applications for its various platforms.

Can you use Swift on Windows?

It wasn’t until September 2020 that developers using Windows hardware could actually program using Swift. Until that point, it was a feat only achievable using Apple’s Xcode integrated developer environment (IDE), which itself can only be downloaded on Apple hardware. It was a case of ‘buy a Mac or turn right back’.

Swift released the toolchain images for Windows on 22 September 2020 and it took the open-source project longer than a year to port Swift over to Windows. It involved porting the compiler, as well as the standard library, and the core libraries too, which took a great deal of time to ensure developers had the best experience possible. To bring Swift to Windows, developers should use a toolchain installer and the Visual Studio IDE.

What can I build with Swift?

An example of an app built with Swift is Lyft, with ride-hailing company having completely re-wrote its iOS app using the programming language. While the old codebase consisted of about 75,000 lines of code, the Swift version recreated the same functionality with less than a third of that. Moving to Swift also allowed the app to feature app a new onboarding process; while the old one took more than a month and multiple engineers to implement, the new onboarding with Swift was completed within a week with only one engineer.

Other popular iOS apps built using the Swift programming language include Firefox, LinkedIn, Twitter and WhatsApp.

How to learn Swift programming

Understandably, Apple is keen to get as many people as possible to a point of familiarity with its homebrew language, and it has a series of training resources in order to support this. One such resource is Swift Playgrounds - a free iPad app which helps teach kids the fundamentals of Swift programming through a series of games and challenges.

For complete beginners to the world of programming, this may be a good place to start, but it's probably a little on the simple side for all but the most novice developers. There are e-books and other official Apple resources available for more advanced learners, as well as numerous online courses for learning Swift.

Once you're familiar with Swift, the easiest way to start actually using it to build apps is to download the latest version of Xcode, Apple's IDE for macOS. This includes all the essential tools like a code editor, debugger, testing environments and more, as well as a full version of Swift and all the runtimes you'll need to start constructing apps.