skysight-inc/HackerNews huggingface dataset:
> I stand firm that the latter day Beethoven would have had no trouble with it (technically; obviously not being able to hear is torture for any musician).

If "it" means "transcribing from one's head" the evidence-- fascinating, fun to read and analyze evidence-- points in the other direction. Composition didn't come easy to composers like Beethoven and Brahms, and they spent years working on it.

For Bach and Mozart, there is a variety of evidence that all points not only to their ability to "transcribe in their heads," but also to somehow imagining fully-formed phrases, sections, and even full pieces, all while incorporating new musical sounds, in their heads. Their music seems to be more or less sophisticated based on context and requirements, and not so much (or at all) on time allotted to write. There's really no other way to explain things like the triple dance (in 3 different meters!) in Don Giovanni being written in about a day, again with no pre-compositional scribbles. There are many more examples in the manuscripts.

In fact, for a long time scholars assumed a "compositional evolution" with Bach to arrive at a chronology for the cantatas that expressed that evolution. Scholars in the 1950's used forensic evidence to show that long-standing chronology was wrong. Apparently, this caused an enormous controversy because it left Bach scholars with no way to explain Bach's compositional development.

Finally, among other things, this distinction is a reason Beethoven's music dominated in the latter half of the 19th century. As a composer would you rather follow a path of using small, self-contained groups of notes to divide and conquer complex forms, developing slowly and surely toward mastery as you practice? Or would you rather try holding all the music you've ever heard in your head, attempting to re-organize and write variations in your memory, then then transcribe the most fitting parts you came up with for the task and hand and blindly hope what you came up with is at all coherent?
Too true. Apples extra tax on storage is horrible.
Baseline model with 256 GB drive of which half is required for the OS to function normally if you use is as something other than an iPad is crazy to release in 2020.

The price difference between 8GB/256GB and 16GB/1TB is insane.
In photos: D.C. and U.S. states on alert for pre-inauguration violence
Do it and let us know when you're finished ;)
PBRT in Rust
It made even Gandhi a hero, so why not?
This article is a good archetype of a strain of strange, counterproductive political thought I've seen a lot of recently.

Proposition 22 was very popular, passing with a 17% margin. Any useful analysis would have to reckon with that fact: look at the law, identify what it was that Californians found so appealing, and suggest ways to deliver those appealing parts while still improving the lives of workers. Doubling down on the idea that it's a transparently bad law written by VCs to oppress people might be emotionally satisfying, but it seems very unlikely to either accomplish the author's goals or help us understand the situation.
Yeah, its long, but really a good informative read with some good links as well...!
Being limited to a phone app and requiring phone numbers is severely limiting as well. Matrix is probably the current best-positioned e2e chat app that should be able to encompass more use cases, but it's difficult to convince users to use anything encrypted when alternatives have more network effects and usability.

Network effects always seem to be particularly egregious gatekeepers for social apps, often keeping users on inferior alternatives for years or decades, as coordinating a mass-switch is too difficult (Signal got particularly lucky with a few recent events or it wouldn't have nearly as many users switching to it right now).
Being nice doesn’t mean putting their well being over yours. You can still set boundaries around what you’re willing to do for someone without being an ass about it.
My kids(all under 11yo) figured out how to buffer overflow the lock screen on our linux family games machine.

It took a few times of trying to figure out if I had forgotten to lock it to figure out how they did it.

They were bored and upset it was locked, and just kept typing characters into the dialog box for 5 minutes.

After they were gently scolded for breaking the spirit of the rules, I praised them for being clever hackers, and explained what exactly they had done.
For unit costs, sure. Some HFT funds are relentless in shaving fractions of cents off of their costs. I’m not sure I would call them frugal though. When I hear frugality I think more in terms of buying used furniture or decreasing travel budgets. Might be wise, but probably shouldn’t be the focus over increasing revenue for most companies.
"Keeping it simple" is how we got here. People are unhappy because ports were removed. I want my microSD port back, and I don't think it will hurt you if you don't use it. Even if you pour coffee in it, it will just fuse itself off as long as there's a properly engineered rubber gasket in it.

You do bring good points about usb-c/magsafe. I hope they can make magsafe work with the usb-c port.
Lots of FUD in the opening paragraphs ("no changes to server code since April!!1!"). I stopped reading after that
Can anyone closer to development of Signal (or who works on it) comment on why the server code was last updated in April (7 months ago https://github.com/signalapp/Signal-Server)?

Has _all_ development been client side?
Yeah, this is very language dependent. Trying Emacs with Java is pure pain, even if you love Emacs.

Like most open source things, the quality of support maps closely to the density of users who are trying to accomplish something similar. This is why Emacs has fantastic support for languages like JS and Ruby, and massively subpar support for Java and C#.
I'm confused about this piece. If there's true E2E encryption (verified by open source client code and review of released binaries) then why does it matter if the server code is backdoored or not? The whole point of E2E is that you don't need to care about the server being able to ever see the text of your messages because it never can.
I used to work for one of the gig companies, and familiar with the numbers. All those angers of people struggling to make survivable wage are valid, but this is barking down the wrong tree.

1, people are not stupid, they chose to be exploited by gig companies because other minimum wage jobs pay even less.

2, those companies already pay majority of their revenue to drivers, paying more means charging more, which leads to lower market share, which leads to bankruptcy in a winner-takes-all market.

I think the only way to pull gig workers out of their precarious position today is to lift the minimum across the board. So there are better alternatives than slaving away at gig jobs, gig companies will naturally provide better wage/benefits in order to retain those workers.

This can be achieved with basic income or higher minimum wage, but both have holes that require more nuanced design to ensure effectiveness and minimize unexpected side effects. This is sadly very hard, and I'm not sure if we have the legislators capable enough to do the right thing.
Or some ML crob job algo going haywire and closing your account - with no human to contact to get it resolved.
Not much to add. This simply isn't the case. You usually get the patent so that you can build it without wasting your time. Alternatively, you get the patent to stop a competitor.
Hacker News sentiment towards Big Tech companies
great example, been cheap and been frugal are 2 different things
I work for a huge international bank. We've had some of our non-production infra on GCP and it's been a very bad experience for us; mainly reliability-wise. We're moving away from it entirely.
Tech scrambles to derail inauguration threats
So one of the things that feels the most damning to me about Signal-like protocols is that you have to inherently trust their server.

Consider this paragraph from the Signal protocol

> ...For example, they may compare public key fingerprints manually, or by scanning a QR code. Methods for doing this are outside the scope of this document.

> If authentication is not performed, the parties receive no cryptographic guarantee as to who they are communicating with.

I have not known anybody that actually does this. If an active attack does happen on somebody, I'm pretty sure they would not notice.

As far as I understand, a decentralized model solves this problem. Don't trust the server? Run your own instance or have some other way of validating clients (via your own PKI infra or similar).
> Shortcuts in VS Code are a setting. Just load which shortcut-setup you prefer.

There are quite a few shortcuts that cannot be implemented due to missing capabilities in VS Code. For example -- this list from an author of a VS Code plugin that emulates Sublime[1].

[1] https://github.com/Microsoft/vscode/issues/3776
Are we? I'm severely skeptical of this. Tech people tend to be financially secure so we can afford to pay more for stuff we care about, but I doubt we're significantly more opinionated and value-driven that the average population on average.
Immediately? She had over 20 minutes of knocking and a few phone calls in that period. People should watch the video and think about how long of a time 20 minutes is. They’ll most likely even find it boring and start skipping ahead to more knocking without a response.
Pycharm is fantastic for code navigation. Jumping into a new codebase can be intimidating but I use Pycharm for the preview windows for function definitions, the option+f7 find all usages of a variable, and a few other features. IdeaVim is also the best vim emulator that I've tried in any IDE. But I'm also too deep into neovim to stop using every feature + plugin while writing and editing code, so I usually have Neovim running in the Pycharm terminal and jump back and forth between the Pycharm editor and terminal based on my context (writing or reading)
I'm a bit annoyed at "we can do better than X" when, you know what? Maybe we can't.

Yes, it's nice that you and I can install Element and deal with the finicky crypto handshake that for some reason always shows red for me because a friend opened the web UI and closed it before he completed the handshake and now we can never actually make that check go green, and it's nice that Mastodon is distributed but mastodon.host went down one day with all my toots without a word from the administrator, and yeah I know I should have picked a better host (though if you could predict that mastodon.host will die why didn't you tell me?), but my mom can't.

Users value their convenience, and security and privacy are inconvenient. Hell, we started decentralized and over email and newsgroups and personal websites and blogs and it's all Facebook Facebook Facebook now that the Eternal September came around.

If we could do better, we would have done better by now.
It’s great to see some balance about the Signal discussion here at HN. All I could see in the frontpage for several days is how great Signal is but nothing about what’s not so bright. This article brings up the same concerns I always had and I hope we all start being more conscious about it.
There is a difference: a constellation is an area of the sky where some stars appear to belong together to form an image. Their actual distance may be vast.

A cluster on the other hand actually is a group of stars that formed from the same material and are thus very close to each other.

So there is a difference, but it's only a problem to interchange the terms the other way round.
> A common defense in favor of Signal is, “But it’s all open source!”. Sure is, but on what basis do I trust them? ...

The open source aspect for me means 2 things.

- I can verify the e2e encryption claim.

- I can reproduce the client builds ensuring that what I run matches the source [1]

Is there a detail relating to the server that would invalidate this?

[1] https://github.com/signalapp/Signal-Android/tree/master/repr...
As a lay-person who reads scientific papers sometimes because they’re referenced on HN, how do I validate the credibility of a journal? Does a directory of journals exist with scoring, or is there a strategy I can use when evaluating a paper or journal to determine credibility?
>My current favorites are Jupyter Notebooks and the combination of gedit with fish shell.

Do you mind elaborating on what you're doing with notebooks?
Does this news makes you nervous about moving to Florida?
As I wrote in https://news.ycombinator.com/item?id=25795575

- WhatsApp: Oh wait, SMS etc. is completely insecure

- Signal: Oh wait, WhatsApp is structurally unable to be a force for privacy

- Matrix: Oh wait, even benevolent centralization is an unnecessary risk

It's not that worse is better, but the general public's imagination can only grow so fast. We need to coax people along. As such, I do think all 3 serve a purpose in certain times and places.

I took advantage of the Signal downtime to get a few people onto Matrix. There will be more opportunities.
Anecdotal from SoCal, 2 years ago I saw on my doctor’s chart that my BMI placed me in the obese category. She said nothing to me about it. I wish she had bc it was a shock to me. I had become so accustomed to that weight, and everyone I was around was a similar weight so I just didn’t know. If I hadn’t seen it on her chart I would not have made any changes.

With my new doctor, I was looking at my last 2 yrs of blood tests and my LDL cholesterol has been at 105. Losing more weight will help with that, so will changing my diet - but my doctor didn’t point my LDL out as a problem even though it is.
Show HN: Mv together with vim undo files
Wasn't emacs forked several times in the past? Would be curious to see an exploration of the difference and why they converged back to mainly one offering. (Or are there others still thriving?)
OpenSSH >= 8.something natively supports U2F. No need for extra functionality.
VSCode is Slow to me. Emacs is great for lisp programming and I like the TODO feature of org mode, there’s a lot of useful features, however it’s a bit too different from modern UI so I get a bit jarred using it from time to time —> my job is using many programs, of which an editor is one, so I can’t happily stay in emacs 90% of the time.

I really like Sublime - fast and clean. Currently I use both sublime and emacs depending on what I’m doing.

I wish I discovered emacs 20 years ago! How many years I wasted without it :(
I evaluated AWS and GCP for my startup and found GCP to be more expensive. The horror stories I've read about Google's lack of customer support put me off too.
You understand wrong. Nothing solves this problem except verifying fingerprints manually (in person!) or scanning the QR code (again in person!).
That's the single least useful thing you could've distilled from the article.
I just said swaylock, a wayland screenlocker, had the same architectural flaw as all X11 screenlockers: when it crashes the screen unlocks. Wayland was supposed to be better but it isn't, apparently.

Xscreensaver attempts to mitigate this by being as simple as possible to prevent crashes. swaylock doesn't do this either, apparently. Several crashes have been reported in the past year alone.

I was just expressing disappointment in the lack of interest in fixing #1.
People were unhappy about the loss of the physical headphone port too .... for a short while. Then most of us went over to Bluetooth and stopped complaining.

Sometimes removing ports is dumb, sometimes it’s a smart reflection of what trends are clearly already happening.
Thank you for the link & the warning!
I believe it would have alleviated some of the issues yes. In general I’m excited for the benefits “pauseless” GC can bring to soft real-time systems on the JVM. Unfortunately, for now we have to continue supporting G1 and friends.
Not quite. Please note that there are various things you pay for, let's take a look at several of those:

- provisioned resources (instances, including the ones under relational databases or other stuff like that)

- usage of on-demand resources like AWS Lambda and API Gateway

- infrastructure such as load balancers (kind of mix of provisioned and pay-per-use)

- persistent storage (which is all over the place in terms of payment methods)

While you could shut down the first three to save some money, would you like to remove your data permanently?

So far all mechanisms that are available are mostly reactive (billing alarms etc) rather than proactive (service quotas although they are meant to shield from poor design rather than a typo in terraform). There is clearly incentive for cloud providers for the former, but it's not an easy problem anyway (they might mark your accounts for "training" or something like that - I think this would be reasonable).
My main complaint about Signal is its reliance on SS7/PSTN and ordinary phone numbers to identify a user.

In an era of SS7 hijacks and social-engineering of mobile phone network customer service reps into SIM-hijacking a target's phone service, by no means should we ever rely upon a phone number as a guaranteed method of identifying an end point device's identity.

These are basically the same reasons why other services' "2FA" by SMS is questionable at best.
Depends on what you need. They offer a giant bag of services and abilities, so it really comes down to which subset of that you are looking for.
What's the business model? I don't see a payment form anywhere.

If this is going to be funded by "growth and engagement" then it will have the same issues as the current social media platforms, so why bother with this over, let's say, Facebook?
> If we could do better, we would have done better by now.

We should have given up on Linux UIs way back then. They're still garbage when it compares to the alternatives.
Every single peripheral I own is USB-A. I've never seen USB-C-only as the default option on any peripheral in a store or Amazon. Not having USB-A on a laptop is just absurd to me.
Severely limiting? Please... Signal Desktop can be improved but I use it daily and it works for me™. Also, in many other countries, many people don't even have a PC (outside of work) but they'll definitely have a smartphone. So prioritizing app development is smart imo.
The issues highlighted by the author, about Signal, and indeed nearly any messenger app or platform, are societal issues that we keep trying to fix with technology.

There are promising solutions to decentralizing and anonymizing but there remain to be any real tech solutions to the ultimate de-platforming issue. Signal is at risk of having their hosting or connection removed. What prevents the same thing from happening to decentralized services? ISPs have already shown willingness to censor. A decentralized service is at just as much risk of being blocked in a game of whackamole. Or having the apps needed for access removed from major mobile platforms. Apple already blocks magnet links on Safari for iOS. What stops them from blocking a webapp for one of these services?

We need strong laws and regulations protecting everyone’s right to telecommunication infrastructure and the right to install and run our own code on end user devices to prevent another Parler.
We're on the verge of breakdown: a data scientist's take on Trump and Biden
Do we have a way to verify that the App Store apps are actually running the open source (as published) code?
In that rare case you just check the URL. Contact the company if it is a high value login. You can also verify by searching for the site and clicking through to see what their webpage offers as ground truth.
The world will be a better place for sure
OK then, What's your "better" tldr?
Google's services are so perfect they don't even need to invest in customer service!

If you have a problem with anything, it's clearly your fault and you're doing it wrong. /s
You can leave them in, but you still have to tap/touch them for every authentication action (user interaction); the small YubiKey Nano included.
I can see that for most people. It is really something, though, to watch someone really good with Emacs or Vim fly though something like a complex refactoring.
> I'm not sure I can say the same about Kakoune, for example, which is a certainly a promising project but hasn't yet convinced me to jump the fence.

I've made that jump a couple of months ago, and so far I love it. There isn't as large of an ecosystem, but Kakoune just feels better integrated with the environment. Is your hesitancy based on some particular feature, or the ecosystem, or something else? Or is there some default that you dislike?

I feel like it doesn't need to have as many maintainers in order to be successful, because its philosophy is much more spartan. The maintainers pretty aggressively keep the project's scope in check.
The article calls out that the Signal server could be compromised. I always thought one design philosophy of Signal was to ensure the server doesn’t matter from the perspective of privacy.

Would having multiple servers help here, anyway? Once your data leaves your own server, you would then be in untrusted territory assuming the server needed to be trusted.
Why? I trust that my own server is not backdoored (thus reducing the need for off-channel fingerprint verification), I have no such guarantee about Signal's server.
It's certainly much better than the norm! But there's also metadata retention, which Signal frequently brags about being good at not doing, but which is unverifiable unless it's you serving the warrant and coming up disappointed.
The mobile world has trained users to think that they should only be able to run sanctioned software approved by the device maker -- so much for the personal computer era.

Now, people pay a higher price but they have less control over their devices than ever before. Why is Apple even involved here? If people want a nasty app on their phone, then they should be able to have it.

This idea of the vendor dictating terms (and taking profits) has now become normalized. I see no real fight against it, so far, which is sad. Personally, I install hardly any apps (literally only 3) for my phone.

Tim Cook is free to have his opinion, but his company should play no role in suppressing others' opinions. He should not have to host an app he hates, but he should not dictate that to all his customers. Who elected him?
I'd like to see some kind of metric to quantify, but I'd wager most people outside of the Apple ecosystem don't use USB-C at all.

Even within the Apple ecosystem, so many devices exist that use USB-A that I don't think that most people could accept the assertion that "most people don't use USB-A devices" without some kind of proof (like the sort of usability studies Jony Ive must've used for toilet paper at Apple)
I've used Neovim prior to trying vscode because it has a language server protocol client extension. Unfortunately, the extension didn't work too well (it had issues with `clangd`) at the time. So, just to compare I installed vscode and was amazed at how polished it was.

Still, I had it in my mind that I wanted to have and fast alternative to vscode so I kept trying to work with Neovim. That is 'till I noticed how much I dislike using vim. You see it has that learning curve that if you've stopped using it for awhile it's a struggle to do basic things. So I used a configuration that made it act more like normal editors. So problem solved? Unfortunately, most extensions are made for a normal vim settup not my easy mode settup. Plus, I started missing having simple things like scrollbars and tabs I could click on and move with the mouse. (I remember the graphical front end for Neovim not meeting these needs at the time.)

So ultimately, I just moved on and stayed with vscode. I would still like an alternative (kedit/k-develop looks promising). However, I'm sort of addicted to the plugins.
Or we should stop taking (everything) published by <take your publisher/site of choice> as gospel.