jkeisling/hacker-news-corpus-2007-2022 huggingface dataset:
Addendum to the addendum: Whether there's a fixed hash inside the Signal app or not, here's one thing that crossed my mind last night that I have yet to understand:

Let's say we have a Signal-Android client C, and the Signal developers are running two Signal servers A and a B.

Suppose server A is running a publicly verified version of Signal-Server inside an SGX enclave, i.e. the source code is available on GitHub and has been audited, and server B is a rogue server, running a version of Signal-Server that comes with a backdoor. Server B is not running inside an SGX enclave but since it was set up by the Signal developers (or they were forced to do so) it does have the Signal TLS certificates needed to impersonate a legitimate Signal server (leaving aside SGX for a second). To simplify things, let's assume both servers' IPs are hard-coded in the Signal app and the client simply picks one at random.

Now suppose C connects to B to store its c2 value[0] and expects the server to return a remote attestation signature along with the response. What is stopping server B then from forwarding the client's request to A (in its original, encrypted and signed form), taking A's response (including the remote attestation signature) and sending it back to C? That way, server B could get its hands on the crucial secret value c2 and, as a consequence, later on brute-force the client's Signal PIN, without C ever noticing that B is not running the verified version of Signal-Server.

What am I missing here?

Obviously, Signal's cloud infrastructure is much more complicated than that, see [0], so the above example has to be adapted accordingly. In particular, according to the blog post, clients do remote attestation with certain "frontend servers" and behind the frontend servers there are a number of Raft nodes and they all do remote attestation with one another. So the real-life scenario would be a bit more complicated but I wanted to keep it simple. The point, in any case, is this: Since the Signal developers are in possession of all relevant TLS certificates and are also in control of the infrastructure, they can always MITM any of their legitimate endpoints (where the incoming TLS requests from clients get decrypted) and put a rogue server in between.

One possible way out might be to generate the TLS keys inside the SGX enclave, extract the public key through some public interface while keeping the private key in the encrypted RAM. This way, the public key can still be baked into the client apps but the private key cannot be used for attacks like the one above. However, for this the clients would once again need to know the code running on the servers and do remote attestation, which brings us back to my previous question – where in Signal-Android is that hash of the server code[1]?

[0]: https://signal.org/blog/secure-value-recovery/

[1]: More precisely, the code of the frontend enclave, since the blog post[0] states that its the frontend servers that clients do the TLS handshake with:

> We also wanted to offload the client handshake and request validation process to stateless frontend enclaves that are designed to be disposable.
Part of the reason homelessness exists is to economically say "you can't afford to live here." Why do all these homeless people aggregate to large cities proportionally higher than in the midwest let's say? Cause nobody aspires to get famous and rich there. But homelessness is marginal in most areas because housing is hardly an issue.
This is not surprising to me at all. When I left a management position I decided to cut coffee to something like 100mg per day, down from something like a gram. An espresso shot is 40/60mg, so this is basically only two cups per day or something, not much. I found that for technical work coffee was making it harder for me to control intrusive thoughts that are maybe work related but not related to the task I have to focus now. For management work that was not much of a problem and usually with a notebook and talking to whoever was in a meeting at that time with me I could deal with everything. Working in a more lonely setting while using a lot of caffeine was not easy.

I quit smoking a couple of times, and cutting coffee was definitely harder.
Let’s play a game! You walk into a room where I am standing with a gun. The gun has a 100 round magazine. I explain that 1 of the rounds is live and will kill you. Also 3 rounds will not kill you but will backfire in a way that may or may not permanently injure you. There is also some number of blanks and some number of rubber bullets that would hurt you for a week or two but will not permanently injure you. The rounds were loaded randomly into the gun so the next round fired could be any of the above.

I ask you to point the gun at one of your friends and pull the trigger once. Do you do it? Or do you put on a mask and get vaccinated and wait for the world to open up enough so your friend does not have to face that gun?
Wow I was expecting assholes from 4chan not an obsessive soccer mom.
For mental health, regular conversations (e.g. via phone) and occasional visits ought to work.
Thank you. =).

https://philosopher.life/#2021.04.03%20-%20nkbghost%3A%20no%...
> You have to appeal to some principle to sort out such theories from good descriptions of how the world works.

Yes: testable predictions followed by experimental evidence.

Beyond that I don't see how what you're talking about is anything other than an appeal to aesthetics.
There are great videos of a Swedish three year old on a half pipe on a balance bike! My kids were not so fearless, but my son did a 8 mile ride (flat ex railway line) on a balance bike when he was 3. And before anyone accuses me of pushy parenting... we didn't make him! The plan had always been for my wife to ride with him separately, but he insisted on coming the whole way with his two siblings. It was a really memorable day.
It cannot be a zero sum view by definition, since I said that "rising tide lifts all boats" situations are ethical. I'm sure you know, such situations aren't possible in zero-sum.

What can be zero-sum is if no new value is added, but you shuffle around who gets what. If Peter has a way to make $100 himself if someone else helps, and he decides to go from paying Mary $30 to paying Paul $5, he has enriched himself by taking from Mary.

I'm saying it's ethical for Peter to enrich himself as long as he enriches everyone, and it is unethical to take from others to give to himself.
The part I don't understand:

Say the SEC takes on Tether and it falls. Why then does BTC and the crypto markets crash?
>How would Apple profit from that ?

...by charging for it? Still "free" for iOS/macOS users (paid for as part of hardware purchase), $6/year for Android users (or whatever infrastructure with some margin costs). I mean, I have no idea exactly what uptake would be like versus "free" (paid for with your data). But given increasing awareness of the issue, and network effects from existing iOS/macOS userbase, it'd be a significant option. And there are billions of Android devices, even at Apple's scale potentially billions of dollars are year for minimal effort isn't nothing.

I mean, I find this objection (which seems to come up multiple times, every single time iMessage-on-Android comes up) to be just so weird. Like it's some huge mystery how anyone could possibly make money from a software service. You can make money from a software service by... charging money for said service. And as something that's purely network-based, even the normal concerns about piracy and the like on Android are irrelevant. Apple can see if it's a paying account and what devices it's being used on server-side.
> With tail calls, the call stack frames are completely gone, and cannot be recovered.

You can absolutely record these things under TCO, in much the same way you'd record virtual stackframes when inlining.
Complicated launchers often fail with proton.
Do most people even believe that Tether is backed 1:1? Or are they just playing along because it's in their interest?
Thanks for working on this a sharing it public. Keep going.
I remember when you had to pay a buck a year or so for Whatsapp. I really liked the feeling of this straight forward business model and paid.
If you know what you want you could write a trivial script which
just pushes a Markdown file through pandoc(unless you just write
html), concatenates it with the files for the header and footer
(& maybe an inlined stylesheet) and appends a link to the index
file. The result will be the same but applying changes on all pages
is a matter of seconds.

Nothing against a lightweight stack, but simplicity doesn't
necessarily have to exclude functionality.
They can buy BTC with the newly minted coins.
The problem is not technology but the exponentially growing gap between what we do and use and our understanding of how it works.
I believe they do this for CSS3 features where the spec is still in flux (Note that CSS3 is still in development, at least if Wikipedia is to be believed.)
hi dan,

i apologize, i must have been unclear because it seems that you (& some of the commenters below) are dissecting some of my statements quite literally whereas i put a lot of disclaimery type of statements to try to indicate that this is a combo of personal opinion / hazy memory (if the commenter below ever sees this he can also now receive my apology about mentioning datamapper as an ORM gaining traction, that must be a memory from years ago when i still did RoR). :D

I am aware that RoR has been successfully adopted many places, but i guess part of what i failed to explain here (that thankfully foobarian touches upon a bit) is that i believe that part of the power of "a spec" in a programming context is to maintain a solid core of functionality, that then also paves the way for expanded functionality in the future based on extensions of a similar style of syntax.

I know Ruby & Rails teams are not one and the same, I just have many memories of experiences in that community where library evolution is not incremental, does not expand functionality, deprecates as a rival lib rises in popularity.

In Java you see 2 things -- slow spec evolution & incremental expansion of features. It takes time (I know the fast-moving lang communities hate this) but I find it makes for much more robust codebases that survive upgrade processes with wayyyyyy less re-factoring/re-writing, and in type even some libraries that had their own syntax start to embrace/support the spec (Hibernate implements JPA now...).

So.... I suppose, yes, it is a personal matter perhaps. Some companies have used Rails successfully. But in freelance it has kindof bitten me (the overhead of dealing with security vulnerabilities / gem upgrades alone is astronomically more than I've dealt with in upgrading Java projects). I understand that a competent team can handle this & enterprises can pour money into making it work, but as a programmer who often works alone & hates forced unplanned maintenance, it is a tough pill to swallow.

Also, maybe it is because I am dealing with a lot of enterprise/legacy code at times. Sure, maybe business logic shouldn't go in the database. But if someone supplies me a library of highly complex Oracle functions & tells me i need to wrap these into services ASAP, am I really going to begin an immediate re-write? I would prefer that my framework is just able to wrap these functions until a re-write can be scheduled (if the codebase isn't retired before then...). Also in the enterprise community I don't find as much of a desire to have ALL logic in the app layer... often devs feel that as long as a stored procedure / view / whatever returns a meaningful coherent entity that is useful in the business logic layer, they don't really care where/how the query was aggregated.

I also understand anything can be made to scale & work for an enterprise... but it takes enterprise-level support!! I am more a champion of the rogue programmer trying to build an enterprise with a few lines of code a day. ;)

Best,
john
Unfortunately many bugs are not copied over there. I myself am guilty of not going through the hassle of mirroring every bug report I submit.

In the end, I believe it is more worthwhile to just file bugs [1] en-masse to have a "this issue is public" checkbox in their bug reporting interface. If enough people request this feature hopefully they will add it.

[1]: http://www.openradar.me/radar?id=6399875268739072
>The language seems to encourage poor practices like building query strings directly from remote input without the use of a true query builder.

I won't entirely disagree with you on this, because there is still a ton of that code out there, but PHP has had true 'query builders' for a while now, and the mysql_ functions are being deprecated anyway.
Not the same issue. Inequality can continue to grow even while the poor become wealthier.
An affordable RISC-V board sounds incredible. Sub $15 is something to write home about and I'll definitely pick on up when it releases. Playing with a new(ish) architecture sounds like a good time and this will hopefully get some more CS/CE/EE courses switching over to using RISC-V boards.
I wonder how their Rio thing stacks up? https://rancher.com/blog/2019/introducing-rio
>> I plan to write an article/kind-of-tutorial about the setup.

Please post it here when you do. :)
Why can't I just take out a loan on my credit card to do this?
> Coincidentally my home server is also named Hydra, running Nomad on CoreOS/Flatcar

Author here. Ha, nice coincidence indeed :)

> But I'm missing a community repository of sorts for Nomad.

Indeed. I think it's time to build one!
Indeed
1. Nobody really knows how to do it

2. If you think you have a reliable system for doing it, you're probably doing the computer's job
The programmer is still allowed to specify operations to perform as well as restrictions on the order in which the operations are performed. Not fully specifying what to do just gives the computer more options to pick from -- it will still pick one of those options.
Just FYI, the link that is your name is broken. I love the speed of your mashup. But, it did also crash my iPod browser =( Go Go Mobile
Paul Krugman is well respected among one subset of economists and thought of as a total loon by other major subsets of economists.

I don't know much about Christina Romer, but is there any reason to believe she and Krugman constitute a "range" of economists?
it will still pick one of those options

which is the part that gets rid of the "does what you tell it" bit, since now it's doing what it thinks it should, which might not be very consistent or easily determinable because minor variations during a race can produce wildly differing results.
Can you say more about this? I've been very happy with Ack in Project, and I'm loath to change such a big part of my working environment without some understanding if what I should expect to gain...
That is not the intended audience, it's a book about programming, not about some specific technology.
Amplitude here - Most of our dashboards are powered separately from Redshift. We offer Redshift access as a way for our customers to answer more complex questions not offered by the dashboards.
This popped up on reddit/r/programming yesterday, so I'll just copy my comment from over there:

How well does density [perform] when there's competition
for the I$ and L$? LZ4 in theory is slower than a number
of competitors (like snappy). However, LZ4 actually
handily outperforms them when put into a "live" situations
where it's running as a service alongside the 'real'
program.

The size of the in-memory data-structures is the real Achille's heal of most of the contenders to LZ4 I've seen.
[Edit: an up-to-date piece focusing directly on the carbon budget: http://www.theguardian.com/environment/keep-it-in-the-ground... ]

There are a lot more than 25 coal plants in the world, and we must stop using them very very soon. Here's an EPA-citing source claiming 1 Gt coal -> 1.8 Gt CO2e, and 3.5 Gt used by China in 2011, the latter amounting to ~6.5 Gt CO2e, and ~20% of world emissions that year. [1] If Chinese coal use is now about the same, and if we have 650 Gt left before some particular nasty tipping point is reached, then China's coal is currently using that budget at a rate of 1% a year. There's a lot of uncertainty in the rate measurements, and significant uncertainty in the tipping points, but there is no uncertainty that world will be like nothing humanity has ever seen at 500ppm CO2, and we have no reason to think that, say, Pakistan, India and Bangladesh can adjust smoothly to regular high temperatures of 54° with sporadic heat waves at 57°, or that America and the US can smoothly adjust to most of the farmland that currently feeds them becoming unusable and most of the fisheries collapsing.

Finally, note that we're not going to get to near carbon-neutrality in 30 years by dropping radically next year, continuing at a flat 1/30th of our budget for 30 years, and then dropping to 0. Any plausible route will accelerate GHG reductions something like linearly.

[1] http://www.sourcewatch.org/index.php/Existing_U.S._Coal_Plan...
I wish he would talk about how they protect one customer from running a query that brings down the full stack. When we permitted Tableau to start talking to Redshift, we frequently encountered "Oh crap, Peter is running that query and and that's why everything is at a stand-still..."
But if compilation is compression, what if I zip the aformentioned Basic and Kv2 versions? Do I win?

http://www.pvk.ca/Blog/2014/03/30/refactoring-with-lz77-comp...

(This is a joke, lest someone take me seriosuly.)
Nah, this entire list is just 90s-00s Microsoft (where Joel worked). Whiteboard coding interviews were already standard over there, and I presume they got it from the software companies before them.
> Oh I didn't think I was starting 1000 instances of miners in the EC2 GPU cloud, it certainly exceeded my configured budget, please give my money back..

All AWS accounts start off without the ability to do this (via the quota system) and being able to start 1000 ec2 instances of any type is a setting that needs to be unlocked via a support request (which can never be done by that support person, but always needs to be escalated to the "service team" and takes about 1 business day).
In what sense were they groundbreaking? I think Word was a little bit special among DOS programs because it used the mouse. What else?
As a 33yo in Europe who got diagnosed and prescribed medication 2 months ago I can attest that it is possible to get a prescription as an adult.

I just started working again (on medication) after a 6month work break and it is so refreshing to be able to focus on work for the full 8 hours in a work day.

Like you said, the medication doesn't really help with all the "other" stuff that comes with ADHD. (forgetting to brush your teeth is a real struggle) but at least it helps me to be productive and have a stable income again.
> Facebook needs to be shutdown as it poses an existential threat to democracy

I really would welcome that but no way it will.

1) even if it were banned in many countries it would still survive in the US for Intel/NatSec reasons.

2) it's so ingrained in society that it's unthinkable that it could disappear. In many countries facebook _is_ the Internet and large parts of the economy and social fabric (as toxic and shitty as it is) depend on it. This has implications to 1) (e.g. NatSec) above, because

3) FB is part of the US propaganda[1] machine. Radio free Europe or VoA, etc dwarf in comparison of what US dominated BigTech does[2]. See also trending here recently [3] note especially the title changed from the original official title (presumably to be less inflammatory even though the original title made exactly that point and the new title does the bidding for the propagandists).

FB is too big too fail in every sense. It is impossible to fight legally (or with illegal means it will survive like the stubborn parasite it is)

[1] Propaganda: The Formation of Men's Attitudes by Jacques Ellul https://archive.org/details/Propaganda_201512

[2] https://thenextweb.com/distract/2020/12/21/how-netflix-shape...

[3] How Netflix is creating a common European culture https://news.ycombinator.com/item?id=26696396
I suppose there's probably a few cases where someone had particular brain damage that left their memory intact but could no longer make sense of new information. It's not something I've looked into, honestly. In my instance, I was capable of comprehending complicated subjects, but it took a force of will to stay with the subject long enough.
And US, too.
Real question: do you actually believe this to be positive more so than negative most of the time?

Many people will feel resentment over what is essentially continuous doubt and having to spend time to push back that could be spent thinking about the problem, diving in and making a better idea later. Additionally, your way of presenting the argument seems harmless and emotionless, yet reality is often far away from this. A slew of social dynamics take place which make developers say things to get managers out of their hair more than truly having a discussion on how long it takes.

The far majority of managers also impose these deadlines without clear rime or reason ("because the customer wants it"/"because sales said so", at best). What's really going to happen if we estimate higher and end up overdelivering at the end? Are you truly going to lose customers, or are you just trying to pressure people in "being accurate", which often devolves more into having one's subordinates take the blame and the fall for underdelivering?

With all due respect, it feels like we are normalizing things for the sake of manager's security without much reciprocation (only make-believe that it is being reciprocated).
Gentrification as a counter-argument

If my income remained the same, and suddenly all of my neighbors doubled their incomes, I would indeed be economically worse off. Everything would start costing more: Housing, groceries, health care, education--anything priced by a market, because "what the market will bear" has increased.

While they're not technically "taking anything from you", when someone else gets richer, you indeed get poorer.
We're actually working on this at IndieBio!

http://www.pembient.com
It that also means Swiss companies have an incentive to borrow money and invest it, though.

this is what the effect SNB is going for -- that the CHF will naturally devaluate instead of them piling up risk by holding bazillion of EUR.
Sent. Thanks for the convo!
Wow. Can you be a bit more specific? My experience is mostly opposite to yours in most respects, actually, but I've heard similar horror stories so I'm curious to know how you are (were) trying to get by. I don't think you're entirely typical though. Send me a mail if you're uncomfortable discussing here (although it does seem you've already left?)

(The apartment bit is not accurate, btw, and neither is the visa, compared to the States.)

At any rate, just a quick point of order that the parent may not be an entirely typical case. I know a guy working at smart.fm (or whatever they call themselves now) and he's having a good time of it.
I'll send you an invite as soon as Amazon let's Quora out to play.
I don't think that is an unreasonable requirement. I think they are talking about a decent 2D Android game or productivity aid or a ContentProvider/database-driven/synch app (e.g. not something that looks bad, has no value). And ideally, for a client that was high profile.

Hipmunk's iOS app is awesome. I'm scratching my head as to how you would build their custom UI in Android with custom views and gestures. A Hipmunk widget to monitor a chosen 'I-want-to-go-to-X' flight would be of value. I am confident that they will find the right person and look forward to using or beta testing it. Android developers are hot right now because most iOS developers are scared of the Droid/Java/XML (no IB)