skysight-inc/HackerNews huggingface dataset:
Quickly scanned article.

Doesn't account for the data leaks caused by ballot processing, which eliminate the secret ballot.

With paper ballots cast at poll sites, voters sign prior to being issued a ballot. This order is preserved (in the elections I'm familiar with). With the Australian Ballot, dropping the ballot into the box is the secure one-way hash which (mostly) anonymizes the ballots.

With postal ballots, even more care is required. Returned ballots arrive in bins. So its very likely that your ballot is the only one from your precinct in that bin. Making it trivial to tie that ballot back to you. The mitigation is to sort ballots by precinct prior to processing. Which is not easy or feasible, because ballots are generally processed as they arrive. This loss of secrecy is quite surprising to first time observers to how an election board works to certify elections.

--

Source: Burned out election integrity activist. I actually got some minor laws and procedures changed. Plus poll worker, judge, observer for about a decade. It took me forever to get up to speed on election administration and I'd say I know maybe 20% of what I'd need to know to do the job. There are so many nooks and crannies, and it's always changing, and every where has its own quirks. Meaning election administration is surprisingly difficult and arcane. So it's very hard to have casual constructive conversations about this stuff.

--

PS- Chewing on this article a bit more more. Two things.

#1

Huge shout out for this point:

"5) The salt is crucial for ballot secrecy – since there a finite number of permutations of the ballot, without it, an adversary could determine the contents of a vote simply by enumerating possible ballot permutations and matching the resulting cipher texts."

THANK YOU!

This is so hard to explain. Especially to crypto advocates.

Back when I studied the available crypto voting systems, manually simulating a real world election, I stumbled upon this realization.

Any one advocating a new voting system HAS to clearly state the operating parameters, assumptions. Number of voters, precincts, contests per ballot, etc. And be very clear for when their system NO LONGER WORKS.

#2

This article does mention shuffling. I'll admit that I haven't followed the advances this last decade. I'd want to verify that "shuffling" is one-way (irreversible) and not simply hashing (hash collisions).

No one will be happier if someone figured out how to preserve private voting, public counting (Australian Ballot).
Also useful: https://reasonstreet.co/business-model-library/

More like tear downs of each business model and what to measure when deciding
Badly worded on my part, but it's my own product. I use Puppeteer to run headless Chrome instances in AWS Lambda to evaluate the network traffic associated with advertising data collection. I have a toolchain built around Puppeteer and CDP, which is in use by customers, so migration isn't a viable option for me.
The Psychedelic Inspiration for Hypercard
Makes sense. But why wouldn’t currently-free husbands do the same?
> I thought users had to pay a monthly amount if they wanted to support the sites they visited.

Exactly, this is how it should be. Skipping ads/ad-revenue not glorify them by paying user to click it away.
Please have a look at Coil.com it's exactly what they do.
German Courts Bans Whatsapp and Instagram in Blackberry Patent Case (German)
Google has had a lot of success blacklisting domains that spam. Getting blacklisted and losing 30-90 days worth of traffic because you wanted to bump your pagerank a bit is a bit silly.

We could potentially have sanctions that require Google to block commercial sites in China. That would definitely get their attention without massive financial implications on the economy.

This type of behavior CAN NOT be allowed to continue.
Open source it, learn from it, and build upon it to continue to push forward the frontier of AI.
From what I understand session types capture the valid state transitions, and messages for each, that define the hyper-state of the two parties communicating. This means that they are only capable of describing session-oriented protocols. But a protocol can, in theory, involve more than two parties, and not involve any kind of logical or persistent notion of a session. It's just that sessions are really, really common.

That doesn't mean that session types aren't worthwhile, only that they attack the problem of safely representing one particular next-higher-level abstraction.

Session types also predicated somewhat on formal guarantees being something worthwhile. As an academic exercise I'm in favor, but in terms of having practical, working tools that I can use today that useful but lack formal guarantees, well I'd rather have good tools today rather than perfect tools never.

And that's my lament. I've yet to see good tools for building protocols.
Ah, I had assumed you could run one node.
For a little more of a history lesson: Much of the core of Boston is artificial land added at various times throughout history.

The seemingly crazy street layouts and orientations (especially in the Downtown/North End areas) make much more "sense" when you realize how the original landmass was shaped, which was a peninsula only connected to the mainland by a single very narrow road out to the south/southwest.

You can find more detail and scope elsewhere, but here's a quick image that illustrates most of it: http://i.imgur.com/dWSGEjQ.jpg
Regarding Scaleway lack of rDNS for IPv6: it's because they don't support it. Customers (like I was) asked for it many times since 2016 but it seems too hard to implement for them.
If you're using Firefox, consider using the CanvasBlocker add-on to reduce the effectiveness of canvas fingerprinting.

https://addons.mozilla.org/en-US/firefox/addon/canvasblocker

https://github.com/kkapsner/CanvasBlocker
You could say this about almost every product out there. How is brave any different?
Docker, it works on my machine.

---

But to add a serious note, why is every dependency on the environment so complicated that we just wrap it in some container to just get rid of it?
Just an Image of a Tree...
Id' be interested in some examples of past recommendations from the FTC that lead to indictments or at least investigations.
DeepMind founder behind NHS data slurp to be beamed up to Google mothership
It is associated with name. A domain held by them had a link record that pointed to this bucket. Also previous acquisitions of TikTok have buckets, currently open, and those have metadata which shows ownership.

Either way, TikTok won’t even respond, which is very sad and absolutely deserves a response so the few researchers don’t have to waste time following up.

NOTE: Your point makes sense though and I’ve run into this before. 100% agree with you and I should have mentioned the anchor link found.
Best value is hard to evaluate objectively, which is one of the reasons why this mess even happened.

And corruption can affect it evaluating the value too
It's not because they are bigger.
Elon Musk Did Not Defame Cave Explorer with ‘Pedo Guy’ Post, Jury Finds
Is it an insult to say that someone is congratulating themselves? I think it's more of an observation.
Of course, what is noticeably lost in these discussions is always any consideration for whether the underlying leaked documents are true. If there was any hint of that in this case we can safely assume it would be getting trumpeted throughout the British press.

As with the Hillary/DNC email leaks, you're meant to focus on where they came from as opposed to the actual underlying corruption they indicate.
If I could get something like that as a desktop monitor replacement, I would be ecstatic. (Assuming appropriately high resolution and refresh rates - but if it's doing eye tracking that'd have to be the case)
They could potentially refer, but they would at best be referring for further investigation since many of the investigative tools necessary to pursue individual criminal indictments are not available to them. The FTC is limited to administrative powers and can take civil actions -- that's it. As far as going after investors for fines, I've never heard of such an attempt by the FTC against backers of an LLC, and I suspect that would be tied up in courts and legally inviable. It's nice to fantasize about regulators making these kinds of smackdowns, but their real world powers are quite limited by statute and case law.
Not everyone, in any given community, are located at the same place on the rationality spectrum.

Not everyone, in the HN community, is a software engineer.
The "I have nothing to hide" defense of public or private space is great unless you are on the run from domestic or other types of violence. Then, you will want the right not just to be forgotten, but to be hidden.
Not OP, but that helped me at least, so thank you. The description of the mixnet seems a bit similar to the way Tor anonymizes where requests come. What I'm not clear on is how a voter can know that the mixnet is working correctly. I.e. I understand how the voter can verify that their second bubble from the top was recorded, but can they also verify that that was correctly counted as a vote for John Jackson?
It's insane to me that canvas and audio fingerprinting actually work.

Are there any strategies that allow us to keep canvas without it being a security risk?
I don’t know if anyone read the details, but the reason there’s concern is two babies died from receiving measles vaccines in 2018: https://www.bbc.com/news/world-asia-50625680

“Samoa's low vaccination rates are in part due to the deaths in 2018 of two children given a wrongly-mixed vaccine.”

I think most rational people who are questioning the safety of vaccines are not the Jenny McCarthy autism fearists, it’s parents who are worried about vaccine safety from situations like this where two babies died. If it was your baby and you were doing the right thing by vaccinating and your baby died, how would you feel about vaccines after that? What if that baby that died was a relative? Your neighbor next door? Your coworkers baby? You might question the safety of vaccines after that.

The parents are already feeling bad about putting their trust in pharmaceutical companies, are they nuts to stay away from vaccines now?

I think many people take the side of “anti-vaxxers are the worst people in the world!” for granted because they’ve never had a relative or someone close to them die from a vaccine.

If vaccines are supposed to be safe, then why did this happen? Mistakes happen, but would you gamble that risk after having someone close to you dying from a vaccination?
Well, I don't know the details. But AFAIK canvas drawing is GPU accelerated.

So I would guess you are effectively fingerprinting the combination of browser and GPU. And that does not sound like its easy to fix on the browser side.
I would suggest reading about Ansible and working on an initial collection of Ansible playbooks that might help on that. Check out https://www.thecloud.coach/ansible-crash-course. Of course nothing beats a dedicated devops but some playbooks regarding main security compliances might do a great job. Anyone correct me if I am wrong but I am seeing it as a good base practice for these cases.
(good + hype) > good
I am loving the troll-y nihilism! <i>Knowledge</i> and experience are the basis for prioritizing information, efficiently handling a patient's complaint(s) without doing a week of reading, and accessing reference sources when needed.
But here's the thing - it does cost money and customers to properly authenticate people. 2FA will lead to less sign ups but it will give you a more secure user base - in a world where DAU is the number to live and die by then security is compromised in order to help float that DAU stat. For sign-ons collect a per account activation fee or subscription fee - if your goal is to only have real users then enforce that with money, if your goal is to allow people to freely browse your site unless they're abusing your site then yea - that's where fingerprinting comes in, and it comes in because that isn't a solvable problem. If you want to know who your users are you need to be upfront about collecting that information securely and if you want any old joe who gets a link to immediately get sucked into browsing your site and looking at ads then just stop basing your business off of dark user patterns - deliver value, charge fairly for that value, realize that lots of potential business ideas would never be profitable because people simply can't be bothered to actually put out money for that service.

This whole fingerprinting debacle is part of the ad-support web assumption, and the assumption that websites can be entirely ad supported is false outside of exceptional circumstance and certainly highly limiting and concerning for free speech - expecting a business to be ad supported, that's pretty much an impossible dream, we're living in a bubble where advertisers and marketers continue to sell lies about the ratios of converting views to actual sales.
It's changed, but apparently no one was punished for it, or even for the false claim that the funds were held "in escrow" when Brave was holding funds itself and eventually claiming them.

When someone commits fraud, gets caught, shows no contrition, and then takes a little step back so it's no longer obviously fraud, I think the emphasis in that sentence needs to be on "obviously", not "no longer". I wish they'd quit spoofing their User-Agent so it'd be possible to opt out of the new version of this scheme, but they'll only send an accurate header to sites that sign partnership agreements.
> The UK kept trade with the US when slavery there was rampant.

And we’re I a citizen of the UK in this tortured analogy (with my contemporary morals and all that), I wouldn’t want my money supporting that.

> Any country will have hiccups throughout its development.

Right, but we don’t have to support those “hiccups”. Anyway, China had 60 million hiccups in the last century. They’re all out of hiccup passes.

> It's convenient but counterproductive to categorize every argument against yours as "whatabouttism".

Not every argument, only the ones that start with suggest I can’t criticize China until <other countries that I presumably support> are completely without blame. Such as yours.
I don't think she has to. As long as your ISPs run GNS themselves, and offer you DNS via DHCP, then you can just forego the ISP DNS server and drop in your own local GNS. Mount .com and the other TLDs you want from direct from ISP off their pubkey, and overwrite the TLDs you don't care much for.
[Disclaimer I work for Cliqz] This is 100% personal opinion, not a spokesman neither for Cliqz nor Burda.

As all German media? Yes, it seems that they were lobbying for it, not clear if they still are part of the consortium or not. Why? No idea, really. Perhaps they are diversifying, lobbying on one hand, trying to build a competitor with another. But to make an assessment of the "goodness" of their intentions I prefer to stick to the facts: besides complaining to regulators, or not, they do fund a potential alternative. That's very commendable, cannot name many companies that are crazy/adventurous enough to put a ton of money on something as risky as what Cliqz is trying to do. To sum up, if the lobbying is a minus, the building is a massive plus, a clear positive outcome IMHO.
Hopefully never in the west. Using the power of the state to silence people is decidedly illiberal.
Yes, however.. the sad, frustrating and unfortunate thing is that police agencies 1. don't maintain their records very well and 2. police agencies use tons of tactics to prevent the public from getting access to its records. So the public's access to use police agencies' own self-monitoring to create conditions of somewhat reciprocal privacy is stymied by intentional resistance. Often times the only way forward is through very time consuming law suits.

That said, if you want to know how to help out, you can start by submitting public records requests for information on your local law enforcement agency. There's so much to do!
In 2003, a friend told me she ignored Firefox because "it sounds like it was named by an eight-year-old boy". My response: who cares? Why does that matter in the slightest? Is "Internet Explorer" really better? Would you prefer a search engine called "Web Searcher Site"?
There merely boring procedure of having election workers count out in the open in front of observers is a more accessible process for laypeople to understand and build trust than printing out the assembler instructions being executed on a tabulation machine plus hardware schematics of the machine running it.
The Rest Is Up to You
This one is going on my permanent list of links to recommend.

When it comes to learning these sorts processes, there is a hierarchy of related phenomena required to succeed:

motivation > intuition (experience) > patience/persistence/determination > skill (aptitude) > tools

When people are learning to program, I always tell them that regardless of their preference between books, videos, classes or peyote, the most important thing they need to persevere is a problem or project that they passionately want to see through to the end. This urgency translates directly to giving a shit, which is something I believe is critically missing when implementing a TODO clone in language framework X.

My hierarchy above can be viewed from another lens: in what order does having ample supply of this trait open the aperture for all of the others that follow?

Being really patient and having access to Stack Overflow can make up for a lack of skill. Doing something for a long time can occasionally make short work of a project if you see the answer quickly. However, nothing else in the chain matters if you aren't urgently motivated to reach the conclusion. When you feel genuine need to see something through, everything else clicks into place.
> I think this doesn't guarantee bug-free event code at all.

Please don't misinterpret me. The goal is to have fewer issues, not zero issues.

> Additionally versioning is needless if you have strongly typed events that get checked at compile time. Any time you need to add an abstract feature to the event architecture, the compiler would tell you what other part of the app broke as a result.

I disagree. Most type systems, especially those describing data, are really only good for checking syntactic consistency and not very good at semantic consistency. That is, it can tell if field changes from an Int to a String, but not if the content of a String field changes it's semantic, i.e. from a user id to an email address.

Lack of ability to validate content pervades wire-appropriate encodings.
The whole concept that the registry owner has an ownership interest in domains is just wrong. Registrars have gotten uppity. Here are the current terms from Network Solutions:

"Web.com expressly reserves the right to deny, cancel, terminate, suspend, lock, or modify access to (or control of) any goods or services (including the right to cancel or transfer any domain name registration) for any reason (as determined by Web.com in its sole and absolute discretion."[1]

You don't have to put up with that overreach. Compare Gandi:

"You are the owner of the domain name, i.e. the individual or legal person who is declared as the owner as soon as the domain name is registered and visible as such in the "Whois" domain name directory"[2]

[1] https://assets.web.com/legal/English/TermsOfUse.pdf
[2] https://contract.gandi.net/v5/contracts/18056/DomainNameCond...
Apparently deliberations were less than an hour: https://twitter.com/rmac18/status/1203084858630791169
Well said but little sympathy for the author.
Wealthy and powerful people tend not to walk the streets in the same way as regular folk, in much the same way they don't do their own grocery shopping or stand in line to buy movie tickets.
> Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on the net.

But that is literally what web users want.

Everything you named is a fine opinion, but runs contrary to the wishes of the vast majority of millions and millions and millions and millions of web users.

EDIT: That said, browsers have features for users such as yourself to disable JavaScript, and there are third party extensions for finer-grained control. Again, adding these limitations is unpopular among web users.
You’re right: they don’t. They tell us the progressives are exaggerating.
> And they suggested that Unsworth was looking for a payday in court

I think this is the key issue. $190m is clearly exorbitant for a defamation lawsuit.

Shame because Musk crossed the line and an example needed to be set that corporate executives should be held to account for their actions.
I've looked at verify a site that I control through Brave to start earning some BAT tokens but I'm really not to keen to have to also give PII (government photo and a selfie) to their only payment processor Upstart.

I'm not familiar at all with this company and I'd really rather not go giving them data just to earn revenue on my site that Brave has taken away by blocking ads.

Could someone who's more familiar with Upstart assuage my concerns? Are they legit, have they got a good track record?
The Ed department has great data on this too:

https://nces.ed.gov/programs/digest/d18/tables/dt18_334.30.a...

Expenditures in real per-student dollars are up, but at nothing like 7% a year. Tuition is up because of disinvestment by state legislatures:

https://fivethirtyeight.com/features/fancy-dorms-arent-the-m...

Even there, net tuition actually paid by students at private schools is also largely flat, as while the nameplate tuition has gone up, few students pay that, as they get grants, financial aid, etc.:

https://research.collegeboard.org/trends/college-pricing/fig...
Wow, genuinely surprised by this.
Wood burning is a pollution problem only when burned incompletely i.e. improperly. Unfortunately, properly burning solid fuel for home heating is not typical.
That is a very bad argument, along the same lines of “why do you need privacy if you have nothing to hide”.
Seems more than fair to me if I understand correctly.

If you're not accepting money, you don't get to keep it but they give you a buffer of 90 days (which they didn't have to) and if the buffer is exceeded it goes back to the user wallet.
And what about if your baby dies from measles because you didn't vaccinate them? What if the baby that died was a relative? Your neighbor next door? You coworkers baby? You might question the sanity of anti-vaxxers after that.

Worse yet, what if your baby can't get the vaccine because they have another disease that precludes getting a vaccine? What if your baby dies because there isn't any more herd immunity?

Two babies dying in 2018 from a wrongly-mixed vaccine is a travesty, but that was a medical mistake. Thousands of babies dying because of ignorance and arrogance is the real sin.