skysight-inc/HackerNews huggingface dataset:
It is generally accepted in the security community that hiding source code does not provide security.

The principles for developing secure software were identified in the 1970s by Saltzer and Schroeder, and they're still true today. One of those principles is "open design", that is, don't depend on design secrecy for security of the system. Instead, depend on secrecy of things that are trivially changed (like private keys and passwords). Then, when the secret is exposed (or you think it might be), you quickly change all the secrets and there's no problem. One source of this paper: https://www.cs.virginia.edu/~evans/cs551/saltzer/

In the case of Windows, the source code is not really secret anyway. Most governments have continuous access to the source code, typically through the Microsoft Government Support Program (GSP) https://www.microsoft.com/en-us/securityengineering/gsp
Many businesses and universities also have access to Windows source code. You can see various programs to provide such access in different cases via https://www.microsoft.com/en-us/sharedsource/ In addition, Microsoft employs a huge number of employees who have access to its source code, and you can't really keep a secret long when a large number of people know the secret. Efforts like bribes, appeals to patriotism, etc. will eventually successfully get someone to reveal a secret if there's a large enough group, especially since it's relatively easy to identify who works for Microsoft or otherwise might have such access.

If that's not enough, Microsoft distributes executables, and disassembers & decompilers can provide enough information for static analysis anyway. So you could re-derive what you need to attack Windows if you needed the source code for some reason.

Anyone who depends on secrecy of code to provide security is in trouble. Typically the real reason to keep (some) code secret is to support certain proprietary business models and to meet certain legal obligations, and are not really about security.

Note that Microsoft understands this; they're quite clear in stating that the security of Windows does not depend on keeping its source code a secret.
Please don't take HN threads into generic ideological tangents, which turn into generic ideological flamewars, which are one thing we really don't want here.

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...

https://news.ycombinator.com/newsguidelines.html

This is a surprisingly great and interesting article. The last thing we need in such a thread is people angrily yelling clichés at each other, drowning out the details.
Not persé as a protocol but one of the implementations like Mosquitto, like RabbitMQ, Kafka, etc... was covered.
> sham “revolutionary” front groups used to disrupt a variety of political activities in this country

More recently, the riots leading up to 2020 election. Glad they mysteriously stopped now anyways.
I would have thought most of the jobs outside of Boston proper were in Cambridge or Somerville (essentially cities in their own rights). Unless you were alluding computer manufacturers like DEC or Wang, or defense contractors like Raytheon and MITRE.
It's not a science, so objectively it could be argued either way.

The "No synth" argument - as you say, a good DAW with the right plugins completely covers the space. No one will ever need a physical synth again.

I guess we could both imagine a "Yes synth" argument for the counter.
A good approximation of the geographic similarity between the Netherlands and US is the degree to which Baghdad is considered in the Geography of the Netherlands. At least insofar as Alaska and Hawaii are ignored.

The UN member state equivalence abstraction does not shrink the practical differences in physical reality. Dutch transport infrastructure is built to a much smaller scale because that’s what’s politically warranted. It can ignore problems of the Alps, Caucuses, and Balkins.
Added a note about the consumer groups, and how each consumer group behaves like a queue.
I never ran into anything quite that extreme, but I remember having a number of teachers that openly disliked boys. Mostly unrelated, but it's hard to convince boys in high school that women are discriminated against when their lived experience is authority figures telling them that girls are better than boys
One step toward that might be to enable a "fast forward" and "rewind" functionality, as are common on alarm clocks. Then at least you could set it to your current time.
CSS is such shit that we’re actually impressed with this. What a sad state of affairs for moving animations on the internet. You probably needed advanced calculus for this or something I’m assuming.
It looks like one of may marketing websites, in this case build by clubhouse or zeppel. And I'll be frank, clubhouse does not work at all for complex software projects. Maybe it can fit some web consultancies flows or similar, but it is build for VERY specific niche.
>what makes 'a true photograph' is still hotly debated

And it depends at least somewhat on the context. For photojournalism, compositing, highly misleading crops, removal/addition of objects, etc. is pretty much verboten. Whereas art/nature/etc. photography is much more flexible.

I knew someone who used to be really into photography contests at his camera club and he ended up getting discouraged and stopping doing it with the switch to scanning and then full digital because so many other people had "better" but highly manipulated photos.
They can open source it and still keep the copyright. I mean it is not automatically GPL just becouse they put it on a public git server.
Powershell added curl(ish) support. I think it’s just aliased to http-transport or something but the basic functions I expect seem to work.
"This iPhone was made in part by a 15 year old girl who would have sold herself into prostitution to support her family had this job not been available"
> It’s about having a useful and informative conversation about how these things work.

Looked to me more like you wanted to shut down conversation. One of us seems to have an attachment to Apple that might be making it hard to think clearly, especially when criticism threatens that attachment.

Meeting the low bar of the law for corporations in this country hardly places a corporation beyond criticism. What do you really think the result would have been without the constant fear of blow-back? What sort of trust do you think I or anyone owes to this or any corporation?
Can't agree more with his recommendation of The Age of Surveillance Capitalism. I hope every Google/FANG employee picks this up and gives it a fair read.
A tidal wave of death – 1918 flu
Thanks for the nice explanation, and the Witten ref.

So it seems that in QFT we must have at least one negative energy state (should we consider such a state “below” the vacuum? Maybe the message is that we should give up on a strict ordering once we have many local degrees of freedom).

It’s interesting to interpret the Casimir effect in this language — is it that the location of negative energy density is specified by spontaneously broken translational symmetry (negative between plates and zero/positive outside).

What property decides whether the system is sitting in the “vacuum” or the “Casimir” state? (If we’ve given up on “lowest energy”)
> Somehow between WW2 and here, we completely lost the idea of Duty as a personal responsibility.

We stopped demanding and respecting it as a society. Started to look at those adhering to such things as stupid and old fashioned, while seeing those who gamed the system as smart and clever.

I've been trying to describe this for quite some time now. I watched the below scenario with my own two eyes happen to two "friends" in about 2001.

Just look at two defendants arrested and in court for a misdemeanor bar fight. One defendant lowers his head, apologizes, pleads guilty, gets time served, anger management, and a permanent violent assault record. The other defendant lawyers up, refuses to take any responsibility, and gets away with community service with no admission of guilt.

The first guy just had his (professional) life ended before it even really began. The second guy got a slap on the wrist. The second guy will be seen as smart and savvy, and the first guy will get made fun of for being a stupid idealist.

Society has taught me that owning up to one's mistakes - and by extension sacrificing to do one's duty - isn't even respected these days, it's actively derided.
It has been a while, but I do understand Σ, e^x, ln, matrices, vectors, etc.

However, like you mentioned, you don't need to work through the proofs to understand logistic regression, lasso, ridge regression, and bootstrapping, for example.
Remember all the intelligence people, like former CIA director Brennan that became MSNBC pundits? Remember the time they made a big deal of Trump offending the CIA in front of the wall of fallen heroes?

For the record, I despise Trump. I am not defending him, but I don't like people thinking highly of the longstanding dark institutions that have been at the heart of American politics since WW2. Trump = Bad does not mean any other part of the American state is good.
I am currently reading "The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power" & I think a lot of people on HN might find it illuminating.

https://profilebooks.com/work/the-age-of-surveillance-capita...
Adhoc Polymorphism, Implicts and Pimping in Scala
Covid-19: Canadian politician faked Twitter posts to conceal Caribbean holiday
James Comey and Robert Mueller were popular among the left (of which I consider myself a part) because of their resistance to Trump
So it sounds like there's Elm the framework and Elm the language then. The language is the language and the framework gives inversion of control. So this is a bit unique in that usually frameworks are built in a language that has other uses, but how is it qualitatively different from programming in any other framework?
I think everyone with valid criticisms of this should file an Github issue, I'm definitely planning to, because of these things:

- Lots of discussion on X11 security issues without any mention of wayland

- Not on the Linux page, but they recommend iOS as a secure OS, which is total bullshit given how many failures we've seen with serious bugs/vulns put into production. I can't even remember how many times I've read about bugs in Safari, Whatsapp or some other app that can be chained to get kernel-level privileges. Remember the Jeff Bezos hack?

- No discussion of threat models

- Focusing on academic/technical arguments and not looking at real-world malware ecosystems/exploits (or: why there is orders of magnitude more malware for Windows than Linux)

- Memory safe languages - Linux is totally exploring a way to use rust for parts of the kernel, and Windows is still probably 99% C/C++

I'm all the more confused by this guy since he's a whonix developer, this almost sounds like a Microsoft employee based on how little scrutiny he applies to Windows...

https://github.com/madaidans-insecurities/madaidans-insecuri...
I didn't see the FAQ. OK. I guess. Still kind of weird. I've never seen software marketed with where it was programmed.

I know this is a tongue in cheek thing, but I find it pretty repulsive to mark a piece of software "Made in X" when it is clearly an international cooperation - CSS, Browsers, TCP protocol, etc is many countries getting together and building stuff. Let's keep nationalism out of software yall.
That's not a "crackpot theory" but what the data currently show. This doesn't mean that there's a biological cause for this (although it's possible). But with IQ data, there's abundant evidence that the averages are similar, but men have greater variability:

https://pubmed.ncbi.nlm.nih.gov/26158978/

https://www.independent.co.uk/news/education/higher/dr-paul-...
Good thing people in authority never use their power for evil.
So maybe if you add constraints and force rotation you can eventually get a secure-enough system with passwords. You'll still be using a symmetric key rather than asymmetric, which means that compromises can be made worse (I get root on one server -> I get user passwords as they log in -> I have access to everything that they have access to now), and you've invested a lot of effort to secure it rather than just `PasswordAuthentication no`, `ChallengeResponseAuthentication no`, done.
Well, I'll be someone's friend if they're going through a really rough patch. I'll provide emotional support from a distance. But I've been down this road before, and trying to date someone who's not in a stable living situation is never going to end well.
They do that podcast because they know he's right about most everything ... and it angers them and their patrons.
Intel Sapphire Rapids Enterprise CPUs Confirmed W On-Package HBM Memory Support
Also interesting on the spacecraft angle:
Apparently spirulina will grow in dilute urine as a growth medium:
"Attempts were made to culture Spirulina platensis in human urine directly to achieve biomass production and O2 evolution, for potential application to nutrient regeneration and air revitalization in life support system. The culture results showed that Spirulina platensis grows successfully in diluted human urine, and yields maximal biomass at urine dilution ratios of 140~240"
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1361757/
This is not the first time theinforation has had a "timely" article with respect to Apple.

I would not be surprised if this is another submarine article [1].

The usage of PR with Tim Cook's Apple is so calculated that I am getting a little uneasy with it. Especially true during the Qualcomm / Intel Modem era. You could literally tell they were intentionally leaked. And after that they somehow felt it was good the media help them sell their narrative ( quite successfully ) they have dialled it up even more.

I am guessing that is partly because their head of PR left last year ( 2019 ). And VP of Marketing Phil Schiller took the PR responsibility as well which later passed the whole Marketing alone with PR to Greg Joswiak. This left a management gap in PR, and what normally happens is the department continue to do what they were doing at a rate without realising the side effect. When all you have was a hammer, everything looks like a nail. And this situation looks remarkably similar to Apple Retail head transition from John Browett ( Dixon CEO )to Angela Ahrendts ( Burberry ).

Just some observation from someone who has been watching Apple very closely for 20+ years.

[1] http://www.paulgraham.com/submarine.html
It's not valuable because then later a manager will still assign the work to another developer, who will spend almost the same amount of time trying to reproduce the bug and finding it fixed. This leads to several back-and-forth slack group slacks to figure out that it was already fixed, and decreases morale. It wastes as much time as if it weren't done at all.
Back in March we were told masks didn't work because there was a shortage and it was "the right thing to do" to say they didn't work. We were also told by high scientific institutions that closing borders was a bad idea.

Probably many people wonder now if the vaccine really is safe, or if it's just "the right thing to do" at the population level to get a lot of people vaccinated even if it's not safe. Hard to regain trust after dropping the ball so hard too many times.
Direct access seems improbable and even undesirable. Libraries can be written and shared to expose what you want to the wasm you need to run.
I plan on working on the tickets assigned to me on that day, yesterday, and the next day. If I have blockers I'll type up a slack message. It's not that hard.
> the contractor doesn’t immediately fire the underaged worker but instead keeps them on the payroll, how is that an “honest” mistake?

I couldn't read the full article, does it say they kept the same underaged workers employed?
Isn't that the Kerckhoffs's principle? https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
This can apply to more than just crimes. Careers for instance.
Duty is not necessarily to the state; it can be to society as well. In fact, there's a large fraction of neoliberals who would argue that individuals following their duty to society should displace the state in many areas.
Microsoft Says Russian Hackers Viewed Some of Its Source Code
Quantum computing will start making inroads to the mainstream. Large corporations will start using quantum computers and run quantum suitable algorithms such as quantum optimization ones.

More software libraries develop that use quantum algorithms in the backend.

One of the major company among IBM, Nvidia, Intel, Apple and AMD will release a prototype minimal viable Quantum Processing Unit (QPU) alongside CPU similar to GPUs.
It'd still have been either first or second in browser share, there was a reason AOL was still willing to buy it for so much money. Technologically already dead, but just starting the plummet.
The wall of fallen spooks.
Yes. If we use a null_resource that has the hashes of the source code files as a trigger, then in the `local-exec` provisioner of the null_resource, we can run the build. The build can also be run remotely (we use google cloud build) to be independent of the developer's machine architecture and operating system, which is important for native dependencies. Terraform will not re-run the null resource provisioner so long as the source code does not change, there is no need for a reproducible build.
Small scale: You generate a keypair and give the public key to whoever is setting up your account on the server.

Large scale: You generate a keypair and give the public key to Vault or whatever, which signs it with the CA that all servers know to trust.
I learned about freemium from this (and other) Acquired podcast episodes.

Tencent December 16, 2018

https://www.acquired.fm/episodes/season-3-episode-10-tencent

Caveat: Not an endorsement of freemium; it's pure evil. And I mostly don't share the host's enthusiasm for a lot of the companies they study. But I always learn a lot, esp wrt to how the various players think about these things.
Another astrophotographer, Thierry Legault, has done many spectacular shots, including the space shuttle docking with the Hubble telescope when it was being repaired.

http://www.astrophoto.fr
I disagree back, but at a different place. "who have to report progress and who are responsible for budgets." is the real problem. It's crazy that progress on engineering is measured in the number of tasks completed. This was one of the points of agile in the first place (to deliver user-stories, rather than engineering tasks) but it has mostly been lost since then, because people who are managing engineers don't know how to think about that at all.

A big engineering endeavor is more like an artistic endeavor that takes multiple people, like a giant sculpture or mural or something, than it is like a construction project. The right way to do it, imo, is to put your faith in a tech lead and a trusted team to deliver it in a timely fashion, and then step back and let them work. They don't need to be delivering tasks on any specific cadence; they need to deliver the overall effort.

More importantly, a tech team needs to be free to do a good job of owning the work they're doing. Properly owning and being invested in something feels basically impossible when someone is demanding you complete little one-off tasks for them -- good technical ownership means having the time and space to zoom out and fix systemic problems, rather than always chasing the next sprint's deliverables.

Of course then the manager comes along and says: well, why don't you just track the systemic problems that you want to fix in Jira? And it seems like a good idea but it ruins it. Having to document and schedule everything you do is completely in opposition to doing the kind of passionate, obsessive engineering that produces the good results.
> I do not have any idea what you consider to be journalism

Not being part of an information warfare campaign of an autocratic country's intelligence service, as we have definitive proof Wikileaks was. The fact that you keep saying this is fine and totally par for the course (also weirdly repeating that the DNC's personal correspondence about ordering pizza and shit-talking each other is 'politically relevant') makes me think you are either far too partisan in your admiration of Assange to discuss this objectively or you just don't understand what the journalism industry is. I don't really care which is true at this point.

You are also misrepresenting what Zaid has said, repeatedly. Being a whistleblower is not an easy thing and not without consequences, but Snowden didn't even attempt to become one. Which is why referring to him as such is misleading at best, and cynically misrepresenting what happened for ideological reasons at worst.
I lose points a lot & I don't mind that.

But I do think there are, often, some very biased negative idealogues who vote down interesting & valuable opinions, regularly, & mercilessly, because they don't jive with the image of the world as the downvoter wants to believe it.

I think it's very frustrating. And unfortunate. And I think that usually it's the ungenerous zero-sum view of the world people that tend to be mass downvoters. There are other generally unpopular or unsupportable opinions that get down voted too, which I think is more in the cards, more regular, & especially in the contested/hot threads up top. My main concern is not this, not people getting blown out of the water in hot spots, but a lot of interesting voices getting chilled & sent down.

My ask is: more data. Show upvoted & downvoted separately when one hovers over the net points of a post. I also like the opinion that downvotes ought include a reason, a cause: off topic, bad content, bad whatever, slashdot style.
It's not just private property. It's the bottleneck for ending suffering for billions of people.

I'm in constant constant stress about getting the virus because I breathe harder than most people.

Young people are in stress because they are jobless.

Old people are scared of both dieing and being alone.
It got cold out is the more obvious explanation. There's a reason they are called "hot summers" in the history books.

However, there is an element of truth in the fact that the Biden campaign succeeded in coopting liberal civil rights people after the election. IMO they should continue to fight hard against state oppression, which will continue regardless of the face of power.
Do we regularly feature Nazi philosophers on HN? If not, why not?
Downvoters, consider reading first:
https://madaidans-insecurities.github.io/linux.html
Questions [by Julia Evans]
If it were up to me, I'd pass a law saying anybody hired by such agencies must take an oath to America, to report their bosses within the agency who violate morality, democracy, or legality, to an oversight court.

Consider just for one moment how likely you would be to ask somebody to do something illegal if they have taken an oath to report you to an oversight body.
There was at least one SAML bug found in Office 365 federation some years back that would allow anyone to log into anyone else's account.
Reading this reminds me of the phrase from game of thrones "the night is dark and full of terrors". There are lots of threats out there right now, mutating, replicating. One day one of them is certain to find another deadly recipe for destruction against the human race.
Ask HN: Will fake news become so bad that newspapers will make a comeback?
With fake news ever more prevalent, will people turn back to old school newspapers as source of truth?
Is the source code buildable, or is it mainly for documentation purposes? I’m guessing the build system and tool chains required for building windows are massively complex. Are these distributed with the windows source code as well?

Also I’m guessing that there are a lot of other proprietary vendor-supplied pieces that get built with Windows. What happens if these are not available?