skysight-inc/HackerNews huggingface dataset:
The article correctly refutes the silly binary argument that many people fall back on that since perfection is impossible, we must accept an imperfect solution. And since the current solutions are clearly imperfect, the status quo must be acceptable since imperfect solutions are acceptable.

However, the article falls right into the next failed model of considering everything in terms of relative security. We should make things “better”, we should make things “harder”, but those terms mean very little. 1% better is “better”. Making a broken hashing function take 2x as long to break makes things “harder”, but it does not make things more secure since it is already hopelessly inadequate. The problem with considering things only in relative terms to existing solutions is that it ignores defining the problem, and more importantly, it does not tell you if you solved your problem.

The correct model is the one used by engineering disciplines, specifying objective, quantifiable standards for what is adequate and then verifying the solution passes those standards. Because if you do not define what is adequate, how do you know if you have even achieved the bare minimum of what you need and how far your solution may be from that.

For instance, consider the same NSO case as the article. Did Apple do an adequate job, what is an adequate job, and how far away are they?

Well, let us assume that the average duration of surveillance for the 50,000 phones was 1 year per phone. Now what is a good level of protection against that kind of surveillance? I think a reasonable standard is making it so the phone is not the easiest way to surveil a person for that length of time, it is cheaper to do it the old fashioned way, so the phone does not make you more vulnerable on average. So, how much does it cost to surveil a person and listen in on their conversations for a year the old fashioned way? 1k, 10k, 100k? If we assume 10k, then the level of security needed to protect against NSO type threats and to adequately protect against surveillance is $500M.

So, how far away is Apple from that? Well, Zerodium pays $1.5M per iMessage zero click [1]. If we assume they burned 10 of them, infecting a mere 5k per with a trivially wormable complete compromise, that would amount to ~15M at market price. Adding in the rest of the work, it would maybe cost $20M all together worst case. So, if you agree with this analysis (if you do not feel free to plug in your own estimates), then Apple has achieved ~4% of the necessary level and would need to improve processes by 2,500% to achieve adequate security against this type of attack. I think that should make it clear why things are so bad. “Best in class” security needs to improve by over 10x to become adequate. It should be no wonder these systems are so defenseless.

[1] http://zerodium.com/program.html
> I'm glad that I'm working in a time where I can build all of my parsers and attack surface in Rust and just think way, way less about this.

I'm beginning to worry that every time Rust is mentioned as a solution for every memory-unsafe operation we're moving towards an irrational exuberance about how much value that safety really has over time. Maybe let's not jump too enthusiastically onto that bandwagon.
Habits, UI changes, and OS stagnation
No. The only way you can actually observe entanglement is in an isolated entangled system (this is the reason quantum computers are hard to build). It is true that at a philosophical level there is no difference, but from the point of view of physics, which is to say, what is observable, isolation is crucial. Non-isolated systems behave classically, notwithstanding that they are actually quantum systems.
It's difficult for one restaurant paying living wage to compete with those relying on people working poverty wages. The businesses paying good wages will not be able to compete on costs and that benefit might not be passed to the customer. Certain businesses, for whatever reason, are more effective at hiring and retaining workers at low wages. Instead of forcing businesses to do the right thing and try and compete with lower prices due to horrible wages, we need to mandate living wage so all the competition has to move together.
I'm not really sure your comment was criticizing anything though, just stating fact. Whether this is good or bad is a matter of opinion. Personally I'm more than happy to see cash disappear since I think it's mostly useful for laundering money and tax avoidance.
I'm a polyglot and founder and I've also done enterprise work for several large companies, so I'll weigh-in.

I think it's because i18n is expensive and difficult. In starting a new project, internationalization means you must include that feature from the beginning. Every word in a dialog box, every button, etc. must be coded so that it can be handled dynamically. This adds a tremendous amount of scaffolding to the program as well as creating a lot of work for the team. Many teams just aren't funded for this kind of work and so they focus on getting the project working in one language only. Often, the decision not to include i18n at the beginning means it will be difficult or impossible to add later, resulting in products that never grow beyond their home language.
Okay, yes, it's more like burning the card catalog, not the actual books. The books are still there, but the links that tell you where to find the book you want don't work.
Wait for them for what?
Yeah, I found myself in the exact same position. Tried tapping and typing almost everything I could think of, got frustrated and quit. Not sure if its a bug, or just lack of useful tutorial information.
would you also support banning words?

it's apparent, that money launderers, drug buyers, criminals communicate using words
was that a guess? wtf... btw. it would probably be hard to make the same mistake in rust. unless you write your own code for strings or use strdupa, too via libc.

I also do never understand why some libraries use "faster" methods everywhere, unless safer ones. it's not like all interfaces to systemd would need to be fast. but they should be secure.
There are very few threat models that a memory unsafe parser does not break.

Even the "unskilled attacker trying other people's vulns" threat basically depends on the existence of memory-safety related vulnerabilities.
>I just don't see many use cases for FTP anymore

I'm seeing this a lot today. It's almost like people have forgotten what FTP stands for.

The use case is transferring files.

>Why would you choose FTP at this point over HTTP(S), SFTP, BitTorrent, etc.?

Because I don't have a client for any of the others installed
I’m not sure I buy that there are that many links encoded as FTP that you’d hit during normal browsing. Chrome dropped support a year or so ago, so any website depended on FTP already has required a separate FTP client for 85% of users.

It also doesn't really do a good job of transferring files - the protocol is slow and is incompatible with lots of firewall setups.
Well, in my case, I don't believe our universe is a simulation, but I'm open to discussing the idea for fun and it does seem like a possibility. Whereas, most people that believe in creationism, believe it 100% to be the case and if you don't believe the same you are going to hell. I grew up in an evangelical Christian community and you can't really compare the two groups. Evangelicals are ready to die for this belief.
> I'd argue the messy tooling they've been producing has probably been net negative value add to their community.

I feel the same way. It has definitely hurt the ecosystem.

Every Clojure IDE, for example, has to support a new deps/build system that is still a WIP and doesn't come with batteries.
Word vomit
OPs explanation is that entanglement is when there is a red ball and a blue ball and when you know which ball is red, you determine that the other ball must be blue.

My explanation is that entanglement is when there is no red ball or blue ball, there are simply two balls and the color of both balls is both red and blue simultaneously. It's not simply that one ball is red, the other is blue, but we don't know which one is which until we measure them. It's that fundamentally there is no red ball and blue ball, there are just two balls whose colors are in a superposition of red and blue.

I will try to come up with an observable difference but it's hard to do so with colors because the typical examples used for entanglement involve properties that can cancel one another out, so that two entangled particles exhibiting a superposition of two properties will, after many trials, end up forming some kind of destructive or constructive interference that would not be possible if those two particles were in a definite state.
>There are also plenty of restaurant workers who just don’t get jobs right now because of “free” money from the government.

What are we going to do about it? End the program? How about in september?
> Of the 3 assertions in the abstract, the obviously false one is #2: "Any posthuman civilization is extremely unlikely to run a significant number of simulations of their evolutionary history". When you realize that running a simulation of the universe requires more processing power than is available in the universe, this is very obviously false.

I think you've expressed a number of confusions.

First, I think you contradicted yourself. The line you quote says that posthuman civilizations are unlikely to create simulations, but you say this is false because a universe simulation requires more power than available in the universe. So you're agreeing with the outcome while saying you're disagreeing.

Second, I suggest reading the the paper fully, because Bostrom explains that we don't need full universe simulations, we need only consciousness simulations (kind of like the Matrix). The very premise of a post-human civilization is that they have knowledge sufficiently advanced that they have algorithms to simulate human minds.

Much like how video games only render the part of the world that is visible to the players, so a consciousness simulation only needs to simulate minds and their perceptions of a macroscopic, classical world, they do not have to simulate a full quantum universe. Our brains are great at filling in information that we expect to be there, so even the parts that we directly perceivedon't need to be simulated with complete fidelity.

Frankly, I don't think you've given the argument sufficient thought, but by a happy accident you picked exactly the outcome that I think is most likely, and I elaborate on why here:

https://higherlogics.blogspot.com/2021/02/why-we-are-likely-...
If a simulation exists, and there is evidence of it, then sure we could surmise that someone created the simulator - and would have some evidence of such?

I think the parent poster was noting that it is a pretty fundamentally different argument than say, positing the existence of a creator, because we exist at all - and that said creator has certain specific requirements of us regarding what we do on Sundays, for instance, or with whom and when we have kids.
There are indications psychopathy is substantially more common in CEOs than the general population. https://en.wikipedia.org/wiki/Psychopathy_in_the_workplace

I'm inclined to consider the Neil Armstrongs of the world more service-oriented than subjugation-oriented, as a general impression of their careers as astronauts.
Art is not a formalism only. Knowing that Guernica was the location of one (maybe the) first bombing of civilians, or how it was protected, insured during the covil war, or why (as there were before) there are 2 guys with rifles guarding it, all adds to understand the artwork. Some of these things cannot be learned from staring at the artwork.
I'm not sure what you mean by bloat. Adding methods doesn't really affect individual object size, just class size. However, actual code weight (rarely) really impacts anything.

In the case of Java/C#, hashcode and equals are optional anyways. So if you don't override them, there's no extra space consumed.
> Basically, he was meditating at monk-like levels, and if he were actually in a monastery, he would probably have gotten help at some point beforehand.

This is spot on. It seems to me like the author took meditation and removed it from it's cultural, historical and spiritual context. In Buddhism, the community of other practicioners is extremely important, as well as the teacher, and it seemed like the author didn't have those. Meditating for 10 minutes a day on your own is fine, but meditating for hours a day and going on week long retreats without a proper teacher or community does seem like opening up the door for things to go wrong or get too intense or for one to become confused or lost. The red flags should have been when the author began convulsing or disassociating or feeling bad. I think the warning is not about the ill effects of meditation, but rather the ill effects of practicing meditation deeply without the proper grounding in tradition, spirituality and community.

To be fair, it's not really the author's fault that he removed meditation from it's proper context. All of the workshops he was going to did that as well. You go, do 1-2 weeks of really intense meditation, and then leave. You might never see those teachers again, or at least not for a while. It's on you to integrate your experience, which can be very difficult.

I hate to invalidate this author's experience, but I really think it was that the author was not doing it right. It's okay to say this. If you start deadlifting every day for 30 days, and then blow your back out, and then try to say there are negative effects of deadlifting, the proper response would be "you're not doing it right." Because that would be the truth. Again, it's not totally his fault for not doing it right, as all these retreats seemed to enable not doing it right. I think he should spread the word about what happened, but it shouldn't be "meditation has some bad side effects" but rather "meditation can have some bad side effects when not done correctly. This is how to do it correctly." The article doesn't really present much of any framework for understanding how and when the bad side effects occur, and a solution for avoiding them. Which is why it's getting a lot of pushback I think.

The article also has a really bad title: "When Buddhism Goes Bad". The article hardly talks about Buddhism. Things like the four noble truths, the eightfold path and other important Buddhist concepts are not mentioned at all. Meditation is not the same as Buddhism. In fact, it seems like his mediation practice was actually missing true Buddhism, and that might be how this whole thing occurred. Regardless, the only thing that went wrong here was meditation practice, not Buddhism.

Props to the author for sharing, and I hope everything goes well for him, but I have to push back on the way he's trying to communicate this warning.
I really don't get this line of argument that regulation is useless. For example if you made it illegal for ex US gov workers to work at companies like these I would expect the vast majority to comply with this, so at the very minimum you would be limiting the available talent pool. The post several parents up talked about regulation for biological, nuclear, etc industries being effective, and although 'cyber' would never be treated in the same way, they're right, after all you don't see organized criminals running around with biological or radiological weapons now do you?
Yes, seems it was just for hash tables. From the JDK 1.0 doc:

"""

Returns a hash code value for the object. This method is
supported for the benefit of hashtables such as those provided by
<code>java.util.Hashtable</code>.

The general contract of <code>hashCode</code> is:

Whenever it is invoked on the same object more than once during
an execution of a Java application, the <code>hashCode</code> method
must consistently return the same integer. This integer need not
remain consistent from one execution of an application to another
execution of the same application.

If two objects are equal according to the <code>equals</code>
method, then calling the <code>hashCode</code> method on each of the
two objects must produce the same integer result.

"""

hashCode is also related to object comparison (see the last line) and this was 2 Java releases before `Comparable` existed.
Hyper: Product Hunt launches early stage venture firm
This is not a shameless plug, it's unrelated advertisement.
if you want to continue in that vein of complete scepticism, you could just claim that all those people are experiencing a placebo effect.
I believe that the moment you hold valuable assets (i.e. any value of crypto currency) in any wallet, then you should report that (even now).

I have no idea how these new rules will play out, but I can image how exchanges might be forced allow only transactions with "sanctioned" wallets (i.e. traceable to person), and international exchanges not playing complying being blocked from to the EU market.
https://thesolutionsproject.org/bezos-earth-fund/
In practice, Bitcoin's privacy model was never even tried though. BTC fees are so prohibitively expensive that no wallet or user would generate more UTXOs or transactions than they have to, making it trivial to trace, yes. But if BTC had been allowed to scale like it was originally designed, then wallets would not fear inputting and outputting potentially hundreds of UTXOs in every transaction of varying amounts so that it becomes practically impossible to trace.

On Bitcoin SV, basically a high-scale version of Bitcoin, there are today several wallets taking smarter approaches to privacy. HandCash's Output Bills [1] for example splits outputs into fixed denominations like cash, and Paymail [2] is a email-like addressing scheme to avoid sharing addresses publicly. I'm sure more approaches will be tried too now that wallets have some freedom to experiment.

[1] https://handcash.medium.com/introducing-output-bills-a-coin-...

[2] https://bsvalias.org/
Yes, they certainly will. I'm not naive, or colonial, about that. But what more can we do than live out the standards that we want to see upheld in the world?
Always consider why you should trust them or what their ulterior motive is (selling papers, stoking outrage, etc.).

Talk with some folks from the new generation and build a connection beyond what someone else wants you to feel / think about them, you might be surprised what you have in common.
How many people are we talking about here? How many restaurant workers literally have no other job or other option available to them whatsoever? Have you ever actually looked into that, or are you just hypothesizing based purely on feeling-inducing narratives? Or is it just a trolley-problem style hypothetical, not meant to represent real world conditions?
Yeah, this but unironically.

The Windows filesystem has dismal performance. The Windows graphics stack is arguably better than Linux’s. And it’s not just the drivers, so you can’t just blame it on GPU vendors, though poor support from a certain popular GPU vendor definitely doesn’t help.

Some of it is just the little things, like doing mouse movement at very high priority in kernel space [1] [2]. Other parts are bigger and more impressive, like allowing the graphics driver to crash/upgrade/restart without you also losing all of your open windows.

[1]: https://reactos.org/wiki/Techwiki:Win32k/desktops#win32k.21P...

[2]: https://devblogs.microsoft.com/oldnewthing/20061117-03/?p=28...
There's a lot of historic detail in the book that is left out of this snippet, but his point was that mathematicians barely understood the convergence of infinite series and considered an infinite sum of trig functions to sort of be unfathomable. A big part of Cauchy's work made rigorous fourier series.
The link that I spent specifically mentions hospital admin costs per capita and per GDP:

>"Hospital administration costs ranged from 1.43 percent of gross domestic product (GDP) in the United States ($667 per capita) to 0.41 percent of GDP ($158 per capita) in Canada."

> Reducing U.S. spending on a per capita basis to Canada’s level would have saved $158 billion in 2011

They are a significant expense. They're certainly not the only expense in healthcare and there is no single area that is driving up costs. There is substantial waste throughout the system.

> Keep in mind that the "in-patient and outpatient costs" and prescription drug costs do NOT include provider office costs either.

How are you so sure of that? I see no indication in the study that provider administration wouldn't be lumped under the provider costs.
The largest ground based mirrors are pushing 30m now while the largest space mirror we've built (but not launched) is the JWST at 6.5 which requires a complicated folding mechanism to achieve because it has to fit in a faring. So to make one 30m telescope in space we'd need around 20 JWST sized telescopes plus the cost of launching and assembling them in space which currently means using people. That's far from a small tax.
Bashing on the US healthcare industry has been fashionable for a long time... and the industry already faces a lot more regulation, and ongoing calls for even more, than tech does.
I traced the definitions a bit and it applies to:

" (8)‘crypto-asset service provider’ means any person whose occupation or business is the provision of one or more crypto-asset services to third parties on a professional basis; "

"‘crypto-asset service’ means any of the services and activities listed below relating to any crypto-asset:

(a)the custody and administration of crypto-assets on behalf of third parties;
(b)the operation of a trading platform for crypto-assets;
(c)the exchange of crypto-assets for fiat currency that is legal tender;
(d)the exchange of crypto-assets for other crypto-assets;
(e)the execution of orders for crypto-assets on behalf of third parties;
(f)placing of crypto-assets;
(g)the reception and transmission of orders for crypto-assets on behalf of third parties
(h)providing advice on crypto-assets; "

which is extremely broad. In particular

'" (14)‘the execution of orders for crypto-assets on behalf of third parties’ means concluding agreements to buy or to sell one or more crypto-assets or to subscribe for one or more crypto-assets on behalf of third parties; "

is the most worrying - it appears to make block generation itself illegal (because of the kyc requirements) on any blockchain that can do anything more than simple transfers (which includes even bitcoin), because every transaction could be a dex swap of some type, knowingly or unknowingly to the block generator.

On the other hand, the additional point is

"Crypto-asset service providers that are authorised to execute orders for crypto-assets on behalf of third parties shall take all necessary steps to obtain, when executing orders, the best possible result for their clients taking into account the best execution factors of price, costs, speed, likelihood of execution and settlement, size, nature or any other consideration relevant to the execution of the order, unless the crypto-asset service provider concerned executes orders for crypto-assets following specific instructions given by its clients."

so clearly the intention was to regulate cexes, but the definition language is dangerously broad. If interpreted in the most strict way, it would basically make all blockchains that can't run on anonymous home nodes force every user to kyc - while anonymous home nodes would break the law, it would be unenforceable without China-style network filtering at least.

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
> dissatisfied California yuppies

What do you think the primary demographic of HN is?
the banks are already reporting every transaction, including your personal info

see Common Reporting Standard: https://en.wikipedia.org/wiki/Common_Reporting_Standard
Welp, that's definitely a bug! Flee is supposed to move you to an adjacent room on completion, which is, of course, exactly what it did until some time today. Working on a fix now!