skysight-inc/HackerNews huggingface dataset:
I know plenty of normals who like to joke about Facebook or Google listening to their conversations because they've been shown ads that are related to things they've said out loud. They're joking but they still feel uncomfortable about a large corporation "knowing" so much about their life.

To your point, it's probably a minority but I'd guess it's more than 10%. There's a ton of stuff in the market (identity theft insurance, new VPNs cropping up, Apple's privacy-focused branding and marketing efforts (I'm not saying they're inherently better on privacy, they just are branding themselves as such)) pointing in that direction now.

Normals need to hear more stories of seemingly innocuous things like home movies resulting in identity theft. Maybe fear isn't the best way to motivate people on principle, but it does work. Imagine how many "security questions" and other PII can be gleaned just by watching some family's childhood home movies.
It will happen IMO, they already laid off the servo team and security response team. About 200+ people.
Otoh I'd rather leave a comment on Twitter, HN, or reddit than on some blog.
One-Way System Roads
The argument is that it's already happened. But because Mozilla exists, they can pretend that it hasn't.

In this way, Mozilla is actually helping Google dominate the internet by providing very useful regulatory cover.

Google has free reign to do all of what you listed. They tread lightly only due to fears of regulation.
Perhaps it changed in the last year or so-- but I happily have complete history dumps from several slacks which never had anything except free plans.
I'm arguing that the contact themselves, not the node they use, is the primary threat.

> Signal's goal, however, is to protect the masses and, thus, society as a whole, by protecting as many people's privacy as possible.

Sure, by positioning themselves as the only node, which you are then forced to trust. That hardly seems like an acceptable solution to me.

The chance of a given mainstream node being actively malicious seems unlikely to me. Maybe that's misguided, but at least (as you point out) there will be relatively few big ones to research. Non-mainstream nodes don't pose a significant threat by virtue of having little to no use (and so seeing little to none of your traffic and contact graph).

> ... the vast majority of all acts of communication in the network is going to get routed not through self-hosted nodes ... I hope you will agree that, for society as a whole, this exacerbates the trust problem you mentioned.

Actually, it seems to diminish the problem to me. Instead of everything going through one central authority it's now being split across multiple actors. No single entity has access to the complete picture anymore. Moreover, you as the user have the freedom to avoid such supernodes if you feel the need. Yes, that will likely introduce usability hurdles, but at least you have the freedom to do so (as compared to a strictly centralized model).

> Instead, they can just create new hosts (just like they do in the case of the Tor network).

Doesn't this attack model fail to account for how users go about selecting and using servers? If I join the Mozilla instance to chat with them, that wasn't an arbitrary choice - I selected the instance that the organization I want to communicate with is using. So the other party, which I'm going to communicate with one way or another, is the real threat here.

As far as MITM attacks go, that scenario seems to get a bit out into the weeds cryptographically. I'm not sure how viable a large scale attack would be here - presumably at some point odd traffic patterns would become noticeable? And you still have the issue of a malicious node that actively attacks all traffic needing to somehow manage to grow its user base to a significant degree.
If anyone is required to use Palo Alto or any other closed source VPN, try using Openconnect [1]. It is an open source client for Palo Alto, Cisco, Juniper, etc. VPNs which typically are just cruft on top of IPSEC tunnels. While some of the features these VPNs offer sound cool but at the end of the day they use client side validation in the from of a 'trojan' binary that is downloaded and collects a bunch of metadata about your system. Obviously this can be spoofed pretty easily if you have full control of the machine. I know it works on Linux and it should work on Mac, and Windows.

With some tweaking you can also use it to configure a split tunnel (at least on Linux) VPN so that your employer can't spy on all of your web activity. (Really for any VPN you just need to update the routing table after the VPN software is running).

[1] https://gitlab.com/openconnect/openconnect
I played clarinet, piano, and guitar growing up, but before reading this I had no idea about the story of the relatively modern (i.e. post industrial revolution) invention of the saxophone. I never played jazz, but certainly appreciate it and this quote from the article really struck a chord with me, "Without jazz, what would music be? But without the sax, what would jazz be?"
Gee, big tech using high paid legal staff to attack and silence others unjustly.

Seems like the usual situation to me. :(
I think that’s all still addressed by him saying (paraphrased here) “learning C doesn’t teach you your system; it teaches you the C virtual machine.” You could just as easily teach the usefulness of lexical scoping and memory layout by teaching people a simplified version of a modern JavaScript engine and teaching them to inspect the accompanying intermediate representation. Bootcamps don’t dive into these things and give attendees intuitions for some model of computing because they know what people are paying for (learning the level of JS necessary to land a job as quickly as possible).
It's better to run as a non-root user, and use the CAP_NET_BIND_SERVICE capability (see capabilities(7)) to allow only the minimal privileges necessary to bind to a low-numbered port. A lot of Linux admins are unaware that this is the modern best practice for running applications securely.

Starting as root for the sole purpose of binding to a low-numbered port and then dropping privileges is an outdated practice that is both difficult to program correctly and arguably unnecessary today.
That's a good thing to warn people of, but feels like a complete red flag in a license. If a company isn't willing to stand by their product in reviews, then that should be a reason to disqualify their product from consideration.
This means you can use SQLite as a graph database. The draft documentation for this feature talks about that in more detail here: https://sqlite.org/draft/lang_with.html#rcex3

Also relevant: the draft changelog for the next version (due out in December): https://sqlite.org/draft/changes.html
What's the next step after Mozilla shuts down and Google loses its cover?

Anti-trust cases take at least 10 years. This is plenty of time for Google to make the internet theirs and the then defunct Gecko engine to be too old to use. Blink and WebKit will be the only engines left.

Even if you then pry Blink and Chrome away from Google, there will never be another browser engine and it's naïve to think that just because Blink isn't legally part of Alphabet anymore that they will be instantly independent.
If a stuck video can be detected it should restart automatically.
Single photon detectors have existed for a long timet - though not anywhere near those speeds afaik - hence the one bit part is not particularly strange, not as long as we're talking wavelengths close to visible light.

The speed and ultra low noise seems spectacularly good, but then, if you can avoid electronics and heat+junction noise in preamp you're going to get good figures.
Workaround: set search engine to DDG, then use !ya to search via Yandex.
I haven’t downloaded it myself, but here’s the source for it: https://thirdpartysource.microsoft.com/

Filter for “Edge Linux” to get a tar of the source code.
Core PHP itself has a JIT and is even today expanding its type hint system to be more expressive and powerful/strict
For the database and auth check FaunaDB.

It doesn't have sync or realtime yet, but it's a much better database overall.
Yep. General point: systems scale, people don't.

Or rather, human systems are flimsy.
I don't find these ideas really contrast as much as they initially appear. Curtis advocates optimizing for some absolute best when shopping for stuff (which as a hobbyist product reviewer I find a bit absurd; few products are one-dimensional enough for that). Marlinspike talks about the value of unplanned life experiences.

There's a middle way for a lot of product categories: find an enthusiast community and get their recommendation for a low-cost and beginner-friendly product. It's often listed in their FAQ. The gap between enthusiast-grade and mass-market products in some categories is huge, while the gap in price may not be.
Stalin co conspired directly with Hitler. Russia was instrumental in preparing Germany for WW2.

https://www.feldgrau.com/WW2-German-Military-Soviet-Union/

https://www.historynet.com/devils-bargain-germany-and-russia...

https://warontherocks.com/2016/06/sowing-the-wind-the-first-...
Not making a mess of it is the most challenging task we face when working on complex or even simple problems. A disciplined approach is essential to not making a mess of things.
To clarify, in 1997 Microsoft promised to continue publishing Office for Mac. Arguably many of the core MS Office applications (Word, Excel, PowerPoint) started on the Mac.

Yes, Word for DOS existed before — I used it — but Word for Windows was much more like the Mac version.
Is Proton the Native Port Killer?
> Does scaling a Supabase app basically just boil down to scaling a Postgres database?

Correct. We will soon add vertical/horizontal scaling (early next year). For concurrent connections, we use PostgREST[1] for RESTful calls, and an Elixir/Phoenix server [2] for realtime data. This reduces the number of connections to your DB, handling concurrency in the middleware. We are building the benchmarks now, but "enterprise scale" is top of mind with everything we are doing.

> Do you have a built in authentication solution?

Yes, we use GoTrue [3] for authentication, and we use Postgres Row Level Security for authorization. You can read more about it here: https://supabase.io/blog/2020/08/05/supabase-auth

[1] http://postgrest.org/en/v7.0.0/

[2] https://github.com/supabase/realtime

[3] https://github.com/netlify/gotrue
That's "poor man's cloaking". Most people that genuinely care if it's Googlebot or not will verify it appropriately by doing a DNS lookup and a reverse DNS of that IP to ensure it's one of Google's IPs.

'Faking' the UA is much more likely to annoy site owners and end up with a permanent block.
FEMA flood maps, which are used to determine flood insurance requirements as part of a mortgage origination, are woefully out of date. It doesn’t take a lot of water to cause damages exceeding the resources of your average homeowner.

To the savvy real estate buyer, I recommend https://floodfactor.com to accurately quantify the flood risk of a potential property. They have stepped in where FEMA has dropped the ball.
Google Ads Exec Boasts Company Can Censor ‘Right-Wing’ & Republicans
I haven't played around with it as much as I'd like, but I was investigating IndieWeb tech for doing webmentions and comments on my static site: https://indiewebify.me/

I'm running the comments currently using https://commento.io/. It's nicely small, basically unobtrusive, and isn't Disqus which I feel has privacy problems.
A VPN service is just a cheap and on-brand way to provide independent revenue. It's probably less motivated by actual concern than business necessity.
> just avoid the awkward middle ground of audio-but-no-video phone calls

Off topic but: am I the only one who thinks video calls are awkward and the old-timey audio-only ones are preferable? I have a disdain for people walking down the street with their phone in an outstretched hand, having inane hour long conversations while virtual bunny ears, cat whiskers or horse heads adorn their faces. Not everyone wants to put on a performance every time they speak to you. Sometimes I just want to call and say hello without having to think about whether the shirt I'm wearing is cool.
or better yet: EXPLAIN ANALYZE VERBOSE - that will give you a little bit better picture.
> Citation needed. I've seen people claiming this for years, and I've yet to see a single case where handwritten assembler actually did better than spending the same amount of effort on speeding up the compiled program (e.g. taking 5 minutes to actually set the right target architecture).

Take some time looking at established open source projects where IBM has heavily invested in optimizing for the POWER architecture. I'm thinking things like glibc, gmp, Golang, openssl, ... The results they get from their hand rolled assembly far exceeds what gcc/llvm spit out. (At least, it did 2-3 years ago.)

Back when the Linux Technology Center (LTC) was a thing, I was fortunate enough to meet many of the individuals working on these projects. They are all wizards. Brilliant.

One of them retired recently and went on to start pveclib to make some of these optimizations in number crunching more accessible to others: https://github.com/open-power-sdk/pveclib

I was once in his office asking about assembly instructions for SHA-3 (a project that sadly didn't go very far) and he could quote useful scalar/vector instructions to me and their timing/latency stats faster than I could find them in the manual.
Canadian town Asbestos votes to change its toxic name
Germany broke that pack two years into the war, two years into Russia killing and pillaging on Hitlers side.
Alpine's DNS resolver behaves differently than glibc (in particular it ignores the `ndots` option) which can lead to DNS query amplification. In Kubernetes clusters this can be taxing on the kube-dns service and lead to cluster reliability issues around DNS lookups.
Apple could actually make more money. Say Google is split into two renamed search engines: elgooGA and elgooGB, with evenly divided assets. They would immediately be two search titans competing for the important Apple contract and would try to outbid one another. Perhaps elgooGA wins Apple, but then elgooGB wins Firefox. Every alternative platform to Apple would stand to get more money. And the users would then become more accustomed to having different default search providers and usage might be split. That is a win for DuckDuckGo and all other competitors.
Thank you so much for mentioning Resolve!

I can't find a single other comment among so many emotional messages seeking solutions, for even one other semi professional or Pro tool.

Obviously the first names are BMD Black Magic Design for Resolve which now includes the Fairlight audio workstation for free. And AJA the other end of the budget spectrum, only cheaper than BMD if you have any kind of obligatory work flow or more than a weekend project. Color space transformation so you can watch on wide colour gamut panels in anything close to captured quality comes to mind for what you leave AJA to manage but need to research and invent a new work flow for if using BMD.
Power Vector Library (pveclib) – Functions for Leveraging the PowerISA VMX/VSX
Well, in the sense that everyone rejected goes back in the pool and everyone accepted doesn't. So the pool is dominated by rejectees.
Did you heard about something called Next.js
I find your reply unconvincing and disjointed. Among many other potential avenues for debate, the lowest hanging fruit seems to be noting that you’ve seemingly forgotten about freedom of the press with all your examples.
I really think lock-free concurrency models are the long term best bet. Locks and shared memory scale pretty badly, on top of being super hard to get right.
HeadSpin Under Investigation by DOJ, SEC for Financial Misrepresentations
Just because it's widely used doesn't mean it's good.

Source: they let me interview people at one of those fancy FAANGMO places (and I don't actually know what I'm doing). Interview success comes down to how lucky you get in the loop imo.
If your method is performant, then you should be able to simply file a pull request to improve what's there. I don't see a reason you'd need to tie that contribution to any existing effort.
> the Need Some Anonymity begs to differ

I don't know what this means.

But Google doesn't sell data. They let you buy ads against people that match your data or requirements, and that's a pretty fundamental difference.
But far more effective unfortunately. Imagine the advances that could be made without moral obligations getting in the way.
If you can get into apple’s system processes, you are already on the other side of the airtight hatchway. You can make sufficient changes to the system at that point that you can certainly mess with any user-installed firewall monitoring.
I honestly think it’s an unsolvable problem, via technical means anyway. As it seems to speak to the fundamental nature of human relationships and communities.

God I hope I’m wrong, though!
> I've yet to see a single case where handwritten assembler actually did better than spending the same amount of effort on speeding up the compiled program (e.g. taking 5 minutes to actually set the right target architecture).

C++ with intrinsics can be very close to assembly. Compilers allocate register and do their magic with the rest of the code, but the real workload translates into assembly almost line-to-instruction. Takes longer than 5 minutes to do, these instruction sets are less than straightforward, but I think 80% of real-world performance sensitive compute-bound code is written like that (the other 20% being assembly).

> that will actually tell you what's going on

When I work on performance critical pieces, I already know what's going on. I design my code from the start to minimize cache misses and branches. The profiling tool I find most useful is sampling profiler. Then I either read assembly and try to do better, or rework higher-level logic or data structures.
Mozilla's principal source of revenue is a fat check from Google every month.

Anti-trust is a mixed blessing for Mozilla.org, at best, and a huge negative for Mozilla.com.
We treat wood to fight termites. The treatment is unnecessary if there’s no termites, but it fights them if they’re there so we do it.

In the same vein, we should spread “counter-conspiracy” theories to fight conspiracy theories. A kind of poisoning by noise.

Hopefully, net education levels will rise over time, increasing our resistance to and eventually destroying the harmful viruses that are unfounded conspiracy theories.
I manage a decent size Google Adwords account. The Google adwords "strategist" they have call me is always pushing the Smart Bidding endlessly. So I try it on one campaign. Smart bidding increased the click cost from about $20 to $100. The one click converted but I get conversions on that campaign for about $60 so it was a disaster. Turned off that smart bidding and went back to my own eCpc bidding.
The latter part of your statement isn’t true. Yes, some people formerly in charge of security response were unfortunately laid off, however that is not indicative of that entire team nor its capabilities.
> Expected by whom?

By the people who pay Palo Alto Networks.
That's the stock-juicing story, but self-driving cars were never going to work. At least not in time to support the company in that way.
Oh, how interesting! Thanks for linking this. I'd love to hear if anyone has experience with it---slightly anxious about using unknown software for sensitive tasks like VPN, but it does look like a pretty robust project...
Hmm. I don't know about Windows, but when I've used Linux in the last few years, my impression of systemd is that somebody looked over at Apple's launchd and inexplicably said "yes, that's a great idea, let's do that," then did it just a little bit worse.
And the crazy thing is that UTF-8 came before UTF-16.

https://en.wikipedia.org/wiki/UTF-8#History, published in 1993.

https://en.wikipedia.org/wiki/UTF-16#History, published in 1996.

And yet they ruined Unicode for everyone with surrogates in order to introduce UTF-16. (Surrogates and UTF-16 are by far the worst thing about Unicode, because they’re a pain and technically completely unnecessary, only having been introduced for poor social reasons.)
Heard about this countless times. I’ve felt that pain before, but in a regulated environment where retool wasn’t an option at the time.

Internal tools at many orgs languish as not being sexy - I’ve always found them cool and an opportunity for building some good operation secret sauce.
Branch mispredictions and cache misses might be hard to see in C and assembly, but in interpreted or JITted languages it's borderline impossible to reason about those things. Even compiled languages have trouble there if you cant control memory layout.
And an enormous negative for the rather well-compensated executive.
The funny thing is the researchers always talk about search and rescue applications. They've been inventing search and rescue robots for decades. Flying ones, walking ones, wheeled ones, jumping ones, self-assembling ones, object detection, all sorts of robotics are supposed to be for search and rescue. But in real life, they're for toys, and maybe weapons.
I saw a neat commenting implementation ran on an eleventy site where each blog post has a comment link that takes the user to Twitter and they can comment with the blog post url and at build time it fetches the comments from Twitter and renders them on the blog post.
What was adopted was an adoption of existing encodings mapping, as per rountrip convertability policy. If Hangul had a working composable encoding, it would've been used instead.
The thread is here : https://fossil-scm.org/forum/forumpost/bacf8cf88c?t=h&unf
Ask HN: Landing page vs. Open-source MVP
I have an idea to work on and this idea aims to solve a problem that I face. I'm curious how many people face the same pain point as I do and would even use my product as their solution.

I'm considering between building a landing page to collect emails and building an open-source project on Github to see its traction.

A landing page will take probably 1-2 days. Building a project will take a longer time - might take 3, 4 weeks to build something that is presentable - but I think it is easier for people to see how the product works and understand what it is trying to solve.

What do you think is a better approach?

On top of that, supposed I have talked to a few friends and they understand the pain point but are vague on whether they will pay for a solution, which approach (landing page or open-source project) should I use?
A mixed blessing only if antitrust action doesn't target the browser monopoly. If they do something to constrain Chrome, this could be a boon to Mozilla.
I like lockless synchronization, but livelock can also be an annoying problem.
> your article imagines, for example, the sun rising in the West

This isn't a useful thought experiment. What was the author thinking?
I understand you are frustrated, however, please remember

> Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

> Please don't comment about the voting on comments. It never does any good, and it makes boring reading.

> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.

https://news.ycombinator.com/newsguidelines.html
In any system with any kind of sane security model, being able to convince the Maps app to send arbitrary data to an arbitrary URL is not exactly the same thing as total change-stuff-not-even-root-has-access-to compromise.
That’s like saying your house is for sale because if someone offered you enough money you’d sell it. Therefore all houses are for sale?

Opportunistically earning some extra cash is a lot different than having to work for a living.
This is embarrassing for Mozilla. They've laid their allegiance bare.