skysight-inc/HackerNews huggingface dataset:
TURN doesn't have anything to do with number of participants; it's there for when NAT hole-punching completely fails and you need a relay. TURN is application-protocol agnostic and just forwards packets; it does not need to decrypt whatever it's relaying. Now, one could run a malicious TURN server that MitMs connections, but I'm not sure how obvious that would be to the end-parties.

For more than two users, you mainly have three options:

* MCU (Multipoint Control Unit), which IIRC does need to decrypt your video, as it will post-process it and possibly re-encode it to send a single stream to the other participants.

* SFU (Selective Forwarding Unit), which in theory doesn't need to decrypt your video, but does need some metadata about it in order to make smart decisions as to what streams to forward to whom (for example, forwarding only the stream of the person who is talking). In practice, I believe some (many?) SFUs will do decryption, thought it's not a strict requirement.

* Dumb peer-to-peer-to-peer-to-... multi-forwarding. You can of course theoretically stream your video to each other participant, and they can all do the same, but that quickly fails to scale. It might be ok for three, maybe four participants, but even then there will likely be problems.
I've been using Wire [1] for years on desktop in large part because of their E2E claims; I wanted something simple and secure that worked relatively fluidly for video calls. I've had mostly pleasant experiences with it, and with many calls I'm surprised by the video quality. I've never tried their mobile app, but they've got one and it looks nice, aesthetically. Main drawback has really been that few people I know use it and I've had to cajole people into doing so a little bit, which stinks.

But I'm not a cryptographer and am unable to verify the company's security claims. For all I know it's go zero encryption whatsoever. Are there people on HN who feel qualified to comment? Has anyone used Wire before?

[1] https://wire.com/en/
First of all, nobody knew what it was, what it did and what it could do when it first hit. No one said, "oh, this is the coronavirus COVID-19, and this is the test for it." All this had to be discovered as it got worse.

I want to know why this pandemic blew up right after the mysterious vape flu in August last year that has the exact same symptoms as COVID-19 and why this flared up in Wuhan after soldiers from all over the world, about 200 from the US, were in Wuhan for the World Military Games.

Wet markets and exotic meats are all over China. Why did it just start in Wuhan?
Well, every contract has a force majeure clause, so...
My understanding of how these E2E products often do their (video) call encryption is not that they use a clever communication protocol like the one used in Signal to protect each frame/packet (which would likely introduce huge amounts of delay - not a good user experience!). Instead during call initiation, they do the key negotiation/sharing over the same messaging protocol they use to transmit their normal messages; i.e. effectively they generate the call encryption key on the device, send it as a E2E encrypted message to the call recipient(s), and use the standard call encryption methods (probably based on SRTP?) to actually protect the call.

Thus, assuming the call encryption methods work correctly (which I have no immediate reason to believe they don't), for an adversary to obtain the key (and decrypt the call), they would need to break the E2E encryption used to transmit the messages; therefore the call is E2E encrypted.
> Interestingly, sometimes—because of one of these slight variances—the fastest [and so preferred] version of a game to speedrun, is a Nintendo-sanctioned emulated (e.g. Virtual Console) release of the game.

Not that that necessarily has anything to do with bugs. Some VC games simply have reduced lag when a lot is loaded, because they throw somewhat more power at the game than the original console could.
I agree that every life must be saved, but every month is a battle, and there will be a war.

China locked down and won a battle, but you will likely see another outbreak in a few weeks, and if they lockdown again, there will be another outbreak when they open up again. The daily cases chart will look like a dribbling ball.

Notice that US officials are focusing flattening the curve, instead of a strict quarantine to prevent all infections. It's not only because they're worried about the economy or the logistics. It's because a strict quarantine only works if everyone is doing it - I mean EVERYONE in the world. If we do a Nationwide lockdown, we will need to do another one when an asymptomatic visitor/citizen enters/returns to the US.

I see two outcomes:
1) Eventually, most everyone will either be infected or immunized for this pandemic to stop.
2) We do a global lockdown for 5 weeks.
Jitsi Meet works pretty well (though I agent used it for really big meetings). But in the context of this article, it suffers from the same issues it outlines because it's based on WebRTC.
IOMED | Data Engineer | Barcelona, Spain | Full Time | Onsite
Are you looking for a job with a direct impact on healthcare?

* Problem: Clinical data is messy and makes research slow. * Mission: To structure clinical data and give unified, standardized access to it. * Product: Natural language processing models and a unified SQL data access interface for researchers. * Traction: Validated idea, Validated business model, growing and scaling stage. * Funding: +2y runout and growing. Backed by national and international VCs. * Stack: Python, Cython, SQL, Postgres, Kubernetes among others * Values: Scientific, methodic, transparent, hard workers with a HUGE emphasis on work-life balance. Join a multidisciplinary team working hard to make clinical research faster, accessible and ubiquitous. Also it's a nice excuse to enjoy Barcelona's vibe and nice weather!

Want to know more? Ping me at rocio@iomed.health Check our site for more info https://iomed.health/en

IOMED | NLP Data Scientist| Barcelona, Spain | Full Time | Onsite Are you looking for a job with a direct impact on healthcare?

* Problem: Clinical data is messy and makes research slow. * Mission: To structure clinical data and give unified, standardized access to it. * Product: Natural language processing models and a unified SQL data access interface for researchers. * Traction: Validated idea, Validated business model, growing and scaling stage. * Funding: +2y runout and growing. Backed by national and international VCs. * Stack: Python and Data Science libraries (pandas, numpy), general ML knowledge, experience with NN (libraries: keras, tensorflow) and NLP * Values: Scientific, methodic, transparent, hard workers with a HUGE emphasis on work-life balance. Join a multidisciplinary team working hard to make clinical research faster, accessible and ubiquitous. Also it's a nice excuse to enjoy Barcelona's vibe and nice weather!

Want to know more? Ping me at rocio@iomed.health Check our site for more info https://iomed.health/en
No, the third party doctrine allows for compelled disclosure (through warrants) of a user's data which the service acted as a carrier for. That's why law enforcement can send warrants to Google (or your ISP) to get the contents of your email account, rather than having to serve you a warrant.

The part that is often cited as being "voluntary" is that you decided to volunteer your information to a third-party (even if the service requires you to do so, and thus you actually had no meaningful choice in the matter) and thus you have "no reasonable expectation of privacy".
At Qovery (https://jobs.qovery.com) we are hiring :) - We helps developer to deploy their apps in the Cloud in just a few seconds
Please don't take HN threads into partisan flamewar. It only makes this place worse.

https://news.ycombinator.com/newsguidelines.html
It's very simple, the vast majority of popular chat applications out there don't have open source backends. Which means we basically have to trust their owners to do the right things and hope for the best.

The business model of choice in this space is to (sometimes) have partially open source clients but almost never use OSS in the backend. There's a lot of secret sauce and magic that these companies use to differentiate from each other and most of that is proprietary. This provides these companies with a control point to lock in their users to their network.

For the same reason attempts at standardization of protocols and federating chats and calls between networks have largely stalled/failed. XMPP is technically still around; it's just that none of the popular solutions in this space use it.

I'd say Signal is the positive exception in this space where both server and client are OSS and the client UX is pretty decent. Telegram talks a lot about security as well but their OSS seems limited to mostly client side. Of course a lot of the crypto is client side so depending on how paranoid you are that may or may not be good enough. Either way there probably is a lot of server side stuff that is relevant to end to end security that is not being scrutinized outside Telegram.

For both, even if the client is OSS, what goes into the app stores may still include stuff not accounted for in the source code. Auditing the source code and the binaries are two things. And then there's the runtime environment to consider, which is a OS that is probably proprietary that includes lots of stuff that is a bit icky from a security point of view.

So, there's multiple levels of "trust us, we know what we are doing" that you'd have to buy into in order to feel secure. IMHO that has been a problem for a while but most people/companies seem to be indifferent when it comes to security and happily pay through their nose for 100% proprietary security snake oil peddled by the sales people of e.g. MS, Zoom, Slack, etc.
https://tiny.cc/maskswork
This is an interesting point. I was recently working on research for how to apply model predictive control theory to TCP congestion control. We basically wanted to minimize latency while maximizing throughput. One of the challenges was that, while we could match latency and throughput set-points if known apriori, actually determining what the set-points should be was very difficult.

Here's an early paper on it https://arxiv.org/abs/2002.09825.
Note that if some of our control theory concepts seem a bit screwy, it's because we come from networking, not control theory :).
Isn't this default behavior in Gnome? At least when using Fedora, Ubuntu or the more integrated distros. I'm pretty sure I used the fingerprint reader to access SSH with one of my keys on Fedora a few years back.
Simpler than sending a cat into a tunnel:

ssh-copy-id -i id_foo_ed25519.pub foo@bar
SEEKING WORK

devops-/cloud engineer, full-stack developer:

* location: innsbruck, austria, eu

* remote: heavily preferred, but on-site would be okay too

technologies:
# containers and kubernetes
# cloud platforms (mainly AWS, GCP)
# linux based infrastructure
# ansible, helm, ...
# scripting in python, javascript, bash
# webapplications with python-django
# common sql & nosql databases
# ci/cd pipelines with jenkins
# prometheus, grafana, elk
# agile processes - mainly scrum (dev) and kanban (ops)

* resume: send me an e-mail, please

* e-mail: freelance@schuetz.in

* web: https://schuetz.in
The first commit was in late 2004, which was well before WebRTC was a thing.
Notable that the first three are TypeScript to LLVM, they are aimed for AOT compilation of TypeScript instead of source translation to C/C++. Together with a good FFI this could work better than source translation.

The compilers with C++ target on that list don't "do a lot more". The others are not directly comparable.
Well, there is no security problem to host a public web site on e.g. AWS. I think the restrictions more affect internal, confidential data.
> I think op is saying, at the cost of an undetectable fraction of a second rounding error when you SSH somewhere, so what?

I tried switching from a 2048-bit to a 4096-bit key to control a modestly sized VPS (~4GB RAM, 2CPU) and scp file transfer speeds plummeted.

I have a symmetric 1GB FTTH connection and I'm used to everything being pretty quick. Using a longer key was like a return to dial-up speed. If you don't plan to transfer large files or directories you can safely ignore it, but I bet your patience will run out pretty quickly if you do.
Has anyone noticed how hard some late-night-US-TV-shows are pushing (advertising) Zoom?
Stephen Colber, Seth Meyers...
Zoom is spending big $$$$ to advertise. While competition (WebEx for example) has been silently killing it. I feel that Zoom wants to be "the new cool kid" in town for which nobody knows anything about.. and while we do learn it looks that it's got some shady practices (as we discuss here).
Step-by-step instructions in the form of to-do lists – Quarantine Team Buddy
Reinvented ‘Iron Lung’ Technology
TLDR:

WebRTC supports e2e encryption between peers. full mesh p2p videoconferencing is very inefficient for large conferences so an SFU (Selective Forwarding Unit) is used - a server acting as a peer that redistributes the streams to call parties. This SFU is basically a middleman - it decrypts the stream, and reincrypts it as it forwards - meaning that there is no e2e encryption. This is a current limitation of webrtc mediastreams. There is discussion underway to fix this with "Insertable Streams", allowing you to transform streams (e.g. insert an additional encryption layer).

MY THOUGHTS:

Zoom already bypass the usual webrtc mediastreams - instead they use wasm ffmpeg to record from a canvas and send that data over a data-channel to their SFU. It seems to me that they could instead encrypt this data before sending it over the stream, and distribute keys directly between peers via a full mesh - this would give them full e2e.

As an aside, the ability to implement something like this is SEVERELY hampered by apples decision not to support webm. I simply do not understand why they refuse to do so. If they supported webm (and the MediaRecorder API) then there would be no need to perform unaccelerated wasm-based patent-encumbered video encoding in the browser in order to provide e2e encrypted media streams via sfu.

DISCLAIMER:

I don't work for zoom, but I do work on a product that handles e2e webrtc via SFU using similar mechanisms to that I explained above.
Possibly to avoid confusion with the company that makes doorbells.
Palantir Is Providing Coronavirus Monitoring to the CDC
Bothe are due to unfortunate decision to run Clojure on JVM and conform to Java calling convention.
Coronavirus news around the world, translated
And, backup is optional.
It's entirely possible to do multi-device end-to-end encryption. See Signal or XMPP+OMEMO.
I just saw this page https://statecharts.github.io/faq/an-event-always-has-one-ac...

>Because if you think harder about it, an event will usually have some deviation from doing that action. Most buttons are clickable, and when you click it, then you perform the action. However, some users doubleclick most buttons, and in those cases, rarely do you want to repeat that action.

This type of event duplication has been the source of glitches in pretty much every html5 based game. What happens is that there is a dialogue with an onclick handler and triggering the handler causes the dialog to close with an animation. If you click the dialogue again before it closes it will execute the onclick handler again. This lets you duplicate quest rewards in a lot of RPGs.
Doesn't Vala compile to C and handle memory safety somehow? Obviously that depends on some GObject stuff but I think a similar approach could probably be used in this case.
Huh, I guess I was out of the loop. I never got the thing about Jewish people either so I guess this is normal though. Thanks for explaining!
I don't think they'd have done this without a plan. It looks to me like they're trying to force a court battle, and they've cleverly chosen to do it at a time when public opinion will be overwhelmingly on their side.
Base it on just the adult population of around 254 million and it goes up to over $78k/year.
”... non-invasive method of ventilation that is cheaper and easier and which works at least as well if not better than traditional ventilation.”

“... This is cheap and easy and can be built with off-the-shelf materials available in the UK with very few moving parts for around £1,000. A standard ventilator starts at 10 times this.”
If they're living paycheck to paycheck and in tech, I do wonder if basic financial literacy has escaped them. It's not uncommon for people in this field to maximize for one skill only at the cost of all other knowledge.

I've met enough people in this field who are completely inept when it comes to anything that doesn't involve typing code.
Oh wow this is excellent!

I was just about to hack together something like this.
Another great resource for interesting sheet music/tablature: https://www.soundslice.com/community/

It's mostly jazz, blues, rock and pop, as opposed to classical music. Each piece of music is synced with at least one performance recording.
I put a hex on you Notorious Ruth Ginsburg Bader!
Kudos for using GetTogether instead of Meetup, Matrix/Riot instead of Discord or Slack, Discourse instead of whatever close source alternative. It matters a lot for some of us. Is vvvv open source or libre too?
Kapow - Making a Game in Real-Mode x86 Assembly (Part 1)
I tried Jami recently and it just doesn't work, I think it has problems with punching through NAT and routing.

I would love to see a messenger/audio call/video call app built on the zerotier SDK, I never had connection problems with zerotier.
This is how you deal with BGP route leaks
Secret Google UX Playbooks
Veldrid, a cross-platform, graphics agnostic and compute library for .NET
And for all of us who appreciate the things we can do with IKEA stuff (without spending 5 salaries on it), I believe it's worth mentioning the IKEA Hackers (https://www.ikeahackers.net/). Those folks are doing some crazy/interesting stuff.
I've used this while trying to find open source video conferencing solutions and chat applications in the past. It spends significant amounts of time not finding my friends before timing out.

As an aside, I don't believe in the virtues of P2P anymore. It's clear to me that centralised systems scale further and faster, and what we need are benign organisations to run them. Legal forms like cooperatives and community benefit societies (nonprofits in the US I guess) are the way forward. I'd choose a community instance of Jitsi as being the best approximation of this for now.
What does record from a canvas mean in this context? Is that html canvas? If so, how are they filling it with local screen content?
My experience with conference calls overwhelming confirms that dialing in and entering a code will waste ~10 mins of any meeting.
Show HN: Coronavirus Simulation with SIR Model
So... US, UK, and apparently they've been shopping their surveillance tech around Europe as well [0]?

I kind of get the US here but how on earth do the other governments think this is an even remotely sensible idea?

[0] https://www.bloomberg.com/news/articles/2020-04-01/palantir-...
Why?

If someone tests positive to the flu but also have cancer, should be considered a flu victim?
100+ Concepts or Components of Resilient Distributed Systems in 37 Minutes
Running a Hubot in the Kubernetes cluster – part 2
Hello, I'm Chethan Bhat. I'm a full stack developer with 4 years of experience.

Location: Mangalore

Remote: Yes

Willing to relocate: No

Technologies

> HTML, CSS, JavaScript

> React (with hooks + context api), Redux (State Management)

> Node + Express (for backend apis)

> PHP

> MongoDB, MySQL, Firebase

Website: https://chethanbhat.com/

About me: https://www.reddit.com/r/forhire/comments/frvpwc/for_hire_fr...

LinkedIn: https://www.linkedin.com/in/chethanbhat90/

Email: hello@chethanbhat.com, devchethan90@gmail.com
HTML canvas, yes. They use a webgl context (but you can also do similar with a 2d context) containing a video texture (from the mediastream - video/webcam/screencap/etc).

You can find a number of examples by searching "getUserMedia" and "canvas" - for example: https://webrtc.github.io/samples/src/content/getusermedia/ca...

edit: apologies, here they read the pixel data from the video element, but the principle is the same. One reason for using a canvas intermediary (or even multiple) is to provide multiple sizes, or perform some processing, such as background removal, for example.
>First, I think all companies that do a lot of technical calls right now should provide their employees with iPad pro. The drawing feature is just so good that it replaces any whiteboarding.

lol, as if our company's bean counters that bought us the cheapest, crappyest Lenovo laptops they could find are suddenly gonna justify shelling out the cash for iPad Pros for everyone. That's a good one, thanks for the laugh.
The problem with Zoom isn't, that it doesn't have end-to-end encryption. If you consider the problem, it is extremely difficult to solve, as in contrast to a 1:1 video call, the server somehow has to to multiplex the streams and thus at least some access to them. With a trustworthy provider, this isn't a big issue. A trustworthy provider will have a clear policy which ensures that only the multiplexer has access to the unencrypted data. After all, you are running a proprietary client from that provider, and each client of course has access to all unencrypted data.

The problem is, that the actions of Zoom doesn't make them look like a trustworthy provider. They lied about the end-to-end encryption. What they should have done instead is to be transparent on how unencrypted data is used on their servers and what their protocols are to prevent unauthorized access to that data. Which is especially important in a business context, because the business users themselves have confidentiality agreements, they need to guarantee and using an external provider for confidential data required that provider passing the neccessary scrutiny.

And of course, the huge pile of security issues coming up with their client, the web server, the mac installer, the script host, give any reason to believe that they either don't know what they are doing or completely reckless at least. And the term "reckless" doesn't fit in a conversation about security :).
> The temporary closure of polluting industries improves air quality

That is not true and it doesn't reduce anything

It's not a few days that change things

Besides, in Lombardy the real pollution problem is due the lack of strong winds and the actual low precipitations
I disagree.

I think the administration is so extreme in its extra-constitutional world view that it's actually unethical to work within or support it in any way.

There is no question that Fauci is competent and making the best of a bad situation, but participating in this administration is aiding and abetting it.

Given their willingness to politicize the courts, the justice department, the state department, even the FDA, CDC, and NOAA; not to mention their kangaroo impeachment hearing regarding bribery in Ukraine, it is impossible to justify cooperation, let alone employment.

If more people had done this earlier (most notably the senate), we wouldn't have the loss of life to which we've already consigned ourselves.
Ok this looks like best yet.
Open source and also available as a free hosted service via their .org.

Share URL. Talk of quality video.

Only feature I couldn’t find was breakout rooms (key thing needed)
Deno v1 release date: May 13, 2020
Apart from packaging I also love the idea of consolidating configurations from different dependencies into a single place.

But when I first moved to pyproject.toml I didn't find its use as widespread as I hoped (flake8 being the dependency I hear about the most without support), so I started collecting a list of projects currently using it, and discussing its use, in an awesome list format. Hopefully it will be useful for other people as well:

https://github.com/carlosperate/awesome-pyproject
HoloLens Telepresense