skysight-inc/HackerNews huggingface dataset:
"You can verify that the apk in the app store corresponds to a specific point in git history"

Is there an easy way to get a direct HTTPS download link from the Play Store? The app itself certainly doesn't let you get the direct APK, or if it does then this must be a very obscure or new feature because I've been using Android for years and never seen it. My understanding is that the Play Store protocol is quite complicated.

Even if you can get such a link:

• It's not the case for iOS.

• It's not the case for WhatsApp.

• You have to repeat the process for every update, of which there are many.

• You don't know what version other people are running, which also matters. Consider group chats!

This is really something possible only in theory, not something normal users can actually do, hence the threshold signing/auditing proposal.

The claim that "Signal encryption doesn’t actually work" just seems inaccurate

I see a bunch of people getting hung up on this point. It's missing the forest for the trees.

Encryption in which you rely on your adversary to encrypt messages for you is conceptually broken. It doesn't matter if the encryption scheme works in theory in another context, in that context it's a failed setup. The example of WhatsApp (which uses the Signal encryption scheme) makes this clear: the Signal protocol in the abstract prevents the adversary learning when the same message is sent twice. In the most important concrete instantiation it actually doesn't: Facebook simply changed the client to expose that information unencrypted, and there's nothing anyone can do about it. Signal could do the same for their own network tomorrow, and given the ideological trends in the Bay Area perhaps they will. Or maybe they already did for some people? We have no way to know, only faith.

"If you do wish to continue communicating with people who are using Signal, you're still able to reappraise what you feel comfortable saying now you know that the behaviour has changed."

I think you're agreeing with me. The point of encryption is to turn the infrastructure provider into a "dumb pipe" that doesn't have opinions on what you think. If one day Signal or WhatsApp change the deal - as indeed Facebook did in 2019 - and you suddenly have to care what random Facebook employees think - then we can no longer really claim the service is end-to-end encrypted.
Yeah the title is a bit unfortunate, but I think this is interesting news. As an aisde, it seems really wasteful to attach a semiconductor to a disposable/consumable item in the first place...
> Yes but the fact that the user will do what's convenient does not mean it is better.

This is irrelevant if it doesn't gain traction.
That is amazing! Have you considered creating a notebook for TypeScript?
I saw Microsoft created an extension but never cared to publish it: https://github.com/microsoft/vscode-nodebook
For my own site, paranoid as I am, for logins I used to just return an empty login page whatever. Best security for maximum user frustration I'm sorry to say!
That's good news, Saudi Arabia needs to feel some pressure to back off so that they can stop the catastrophe that is the war in Yemen.
Sure. The difference is it's harder to manage in crypto (by design).
> What I'm saying is that for the Internet to exist you need people prepared to get their hands dirty (sometimes quite literally) and build low level infrastructure.

I think no one is contesting this.

> That problem is well solved with Web2.

Maybe this is the major disagreement? Many are dissatisfied with Web 2 because it has concentrated the web, for the vast majority of people, in the hands of 2-5 platforms owned by major corporations (Facebook and all its apps, Google and YouTube, Microsoft's Office 365).

The promise of web 3 is a decentralized Web - same capabilities, but provided by distributed apps run and financed by blockchain techs. This is the promise that Moxie likes, but that hasn't matched his actual experience with the actual technologies being implemented - which seem to resemble Web 1 / Web 2 much more than the promise of Web 3.
> By people who are not at all involved in any kind of Unix, Linux, open source, web, scripting, etc.

Common Lisp on UNIX appeared in the mid 80s, long before the ANSI CL standard.

Scott Fahlman was one of the five designers of the early Common Lisp. He headed the CMU CL project, which was a) on UNIX since around 1984 and b) public domain. Code from CMU CL was used in a dozen other implementations.

Other well known CL implementations for UNIX which were developed before 1994, when the ANSI CL standard was published: Allegro CL, GNU CLISP (free), (A)KCL (no cost, free, later renamed to GNU Common Lisp), LispWorks, Lucid CL, ...

Three large commercial implementations of CL were developed initially exclusively for UNIX and were available end 80s: Allegro CL, Lucid CL and LispWorks.

Generally the language came out of well funded research labs and companies and was designed to be portable across a large variety of operating systems (like UNIX variants, VMS, LISPMs, DOS/Windows, Mac OS, ...).
MySQL and SQLite, but the former is not a real transactional database, it's quite a joke compared to Postgres. The latter is a file based database. We use MySQL at work and I am exasperated by it. It's possible that even Firebird is better.
> Read up on mass psychosis and mass psychology in general.

The entire anti-vaxxer movement makes perfect sense if you look at it like a mass psychosis of denial and a trauma response.

Questioning the mainstream media is a bit of a meme these days and unfortunately most people that bring up this point have a bit of an agenda to say the least, but: One thing that’s bothered me about the MSM from the start of the pandemic is the market fueled necessity to keep pumping out “news” when nothing important has happened.

Our desire to keep ourselves more informed has perhaps created this MSM monster that now through overexposure of fear and all other negative emotions that “sell” themselves are responsible for the trauma response that is conspiracy theories, flat out denial and a lack of consideration of expertise, not only for the pandemic but for climate change and much more.
I am not sure, but it seems I am downvoted by zealots who want women back in the dark ages??
Is that what the kids are calling it these days?
I don't get the association between reading and literature. Math books can be read, are there Math book reading clubs? now take away all the context and just leave the equations, that would be code. I don't known about others but I need to actually do the math to understand a math book and those always include the context.
Climate researchers don’t just make up models and then assume they are right. They actually compare them against the reach world.

For example, we have fairly detailed climate related data sets going back many thousands of years, coming from many different kinds of sources. You input these as starting conditions to a model, run the model forward, and then see how accurate its predictions are against later historical data.

Despite your feelings about is or is not possible, there is very strong research that shows that climate modeling works.
Ah, widely supported standards like the various USB charging standards that Apple so famously adopted
Literate programming is certainly a great idea. The problem starts when it is implemented badly in a project, and instead of code that is easier to read, the devs are faced with files stuffed with "comment-noise".

Should we try to write code that is primarily meant to be read? YES! Oh god yes! Code is read 1000x more than it is written. But that doesn't mean "stuff the code with comments".

Primarily, it means write code that is clear, concise, conveys the meaning, is logically structured, is not "optimized" into obscurity before even the first performance measurement has been done, and doesn't implement something just to fulfill some dogmatic paradigm.

Once that's in the bank, we can start using comments where they are needed: Explain Functions that are part of the interface, explain functions that have complex logic, explain imports that aren't part of the stdlib or well known 3rd party libraries. I don't need a comment telling me what `import requests´ is needed for. I certainly do need a comment telling me what the hell `from apputil.tools import tvectorization` does.
The thread has plenty of replies as of now so I don't feel too bad for playing devils advocate here. Can't you either "download from" or "upload to"? "Download to" just sounds strange. Anyway
There are lots of reasons why people don't do it today, I didn't list all of them because it's easy to come up with them as indeed you've done here.

But again, note there's nothing fundamental about this problem. People routinely download and run arbitrary code on their desktops, laptops and smartphones, and most servers don't ever do that. If servers are less secure than web browsers it's a matter of effort put into the implementations, not something fundamental about human nature or computers.
>This is… not true? Signal builds are reproducible. You can verify that the apk in the app store corresponds to a specific point in git history, and if you don't trust Google you can sideload that.

A better way to verify this is latest Signal build in F-Droid? Last time I checked it is behind quit few version. If Signal can satisfy the F-Droid build check to be open and free, then it is legit. Most people don't have time to go through the git commit to verify the build.
In 2020 more than twice the amount of people below 50 committed suicide than died from COVID in Spain.

https://www.elmundo.es/ciencia-y-salud/salud/2022/01/07/61bc... (source in Spanish)
> Got bored. Needed a little more stimulus.

If you are getting bored while trying to relax, do you really need to relax in the first place? Is it even possible to get bored if you are physically and mentally exhausted?

I take boredom to mean my body is trying to get me to stop laying about, not that it craves entertainment. Go to the gym or tidy up or something. Then when you are tired, relaxing comes a lot more naturally.

I also think a lot of people have a really low tolerance for boredom. It may be useful to just sort of linger in the experience for a while, explore what it feels like to be bored. It's a bit uncomfortable, but hardly the worst situation a person has ever been in.
Not to mention that the rest of the world uses "red" for various sorts of socialist / social democrat / center-left parties (e.g. "traffic light coalition", "watermelon coalition"), whereas the US uses it for the right - in the map context only.

Red/black makes me think of the card suits.
Does it really matter who is to blame? What difference does it make?
A guide to installing Lutris on WSL
I know WhatsApp does not, it heavily compressed images and video.
Sonos sues for infringing on their patent for controlling the volume of multiple speakers at the same time, Match group sues for infringing on their patent for swiping left/right... I'm starting to notice a pattern here.

I understand why the patent system exists and its pitfalls aren't easy to solve but god does it suck so much when it gets abused by corporations.
> You still have to verify that what you're buying is legitimate

That it is challenging to evaluate the legitimacy of a seller with a potentially obfuscated identity living who-knows-where is the reason middlemen are inevitable. Even with blockchains.
But note, this still requires trusting the client. If the provider is going to change a key on you to spy on your messages, they will start by pushing a routine update to take out the warning and - assuming some cooperation from the app stores - that update could be sent only to you or your contacts.
A cryptographic hash function H can be used for encryption though, by mimicking a one-time pad: Pick a random integer k, concatenate it with a secret s, hash the result obtaining H(s•k), XOR this with the plaintext yielding the ciphertext C and send the pair (k,C). Pick another integer if you need to encrypt more data.

Decryption proceeds in the same way, mutatis mutandis. This is the basic idea behind one of the best currently used ciphers, ChaCha20: It builds on a hash function.

From a regulatory and legal perspective, this means that if you want to ban strong encryption, you must ban cryptographic hash functions.
You might not trust them, but the quote is taken out of context by the media and whenever it gets regurgitated on the internet. It's used as some kind of a "See, I knew I was correct in disliking them!" idea.
Usually the problem with dependencies it not that they are hard to install but that you have something additional to install on a machine where you want to use it. Sometimes you might not even have the permission to do so.
<shameless plug>
I mention some basic ones in my old talk on "functional thinking" - http://sriku.org/blog/2015/08/11/talk-functional-thinking-fo... .

I find the Haskell(/ML) notation for types and functions quite a leap in thinking about systems.
"anarchist culture relentlessly dismantling everything and enjoying the unknowable"

A guy by the name of Max Stirner clearly articulated what this new culture would be and would look like. It's too bad that's he's been sort of side-lined by history...
Like eproxus mentioned, it's still been shared through normal process messaging but improvements will be made regarding this.
That would only work if it's line separated JSON though. If you cut off the first 1000 lines of a big JSON file it will be invalid.
Still a fun read. Previous HN comments (from a submission a few years back): https://news.ycombinator.com/item?id=15733381
In case anyone is still reading this thread, I think four is now proven optimal. Short explanation: https://mobile.twitter.com/zwegner/status/148011092775217561...

...and my code: https://gist.github.com/zwegner/508cc183ab94dd27686a40384783...
> Is there an easy way to get a direct HTTPS download link from the Play Store?

Have you tried search engine? I've got a lot of good answers by typing your exact question into duckduckgo.com
Agree. I even gave up on keeping the christmas light IoT device on the other network, because the whole point was to be able to control the lights with the phone, and having to switch my phone between networks was just too much.

What needs to happen here is that my master devices (my phone, my laptop) need to be able to stay connected to many networks at the same time, and then I have to be able to assign different apps to different networks.
Student photographs people with hidden spy cam in the 1890s (2018)
> I'm really not sure what you mean by saying that stats from two separate years add up to 70%. Especially when those number do not.

Successive percentage increases multiply:

1.223 * 1.391 = 1.701193
> You can verify that the apk in the app store corresponds to a specific point in git history

Heya thanks for your comment.

Would you mind expanding on what the above means?

For the App Store newbies here - myself included :-)
The point is that not everybody needs to check.

- It take one person to notice that builds don't match or that something fishy is happening for the trust on Signal to be lost forever.

- Someone for whom the integrity is critical can do the check / compile themself

- I don't know if this has happened yet, but the way Signal is built and distributed allows a community of "checkers" to exist.

What can Signal do to improve this aspect?
Unsurprisingly, even in medicine doctors who do better at patient communication get better reviews. And there's an entire industry of alternative medicine which is bad at proving efficacy but good at selling it to the patient ...
Perhaps most importantly/obviously in ease of measuring effectiveness, patient outcomes have a lot of other factors of course, but it seems like a better metric than 'number of closed tickets' or 'lines of code' or whatever.
I don't think that is the point at all. The idea is: the only solution [given current/last gen web technologies like HTTP, email, IRC etc.] to have a decentralized web where most content is not in the hands of a small handful of mega corporations is for everyone to run their own web servers (literally everyone - each and every FB user would have to run their own HTTP server to achieve the same functionality; each and every gmail user would have to run their own email server). This is a major limitation of the internet protocols, and has lead to the current highly centralized web.

The promise of web 3 is to come up with new distributed protocols that allow people to have the same kind of functionality as today, but without having to cede control to FB/Google/MS etc. The reality of web 3 is probably closer to Moxie's article: these distributed protocols are actually closer to email infrastructure than to that promise, and the result will likely be similar to web 2: one or two major platforms will grow and offer a nice interface with the complex distributed network, and the vast majority of people will actually interact with the proprietary platform, not the underlying distributed protocol.
I don't know if you've actually been to their blog recently, but Percona's community includes NoSQL as they maintain their own distro of MongoDB--similar in spirit to their MySQL and PostgreSQL offerings.

https://www.percona.com/blog/category/mongodb

https://www.percona.com/software/mongodb
The neurobiological effects of physical exercise
I'm a PhD student in Europe and I get paid more than a junior graphic designer or marketing person and I get paid about the same as senior DevOps engineers.

It would definitely be cheaper for my research group to outsource this work onto non-research staff.
Yeah, the definitions and analogies in the linked article are correct, but I doubt they’d be entirely clear to the uninitiated since they explain the processes but not applications for all three concepts. We get the “how”s but not all of the “why”s.

I suspect it’s partly for the reason you’ve mentioned: the line between uses can sometimes get blurry. It’s a decent article that could do with some additional clarifications.
I think you are misunderstanding something above.

I'm not the one providing HN membership. That would be YC but I as a third party can verify whether someone has a valid HN membership and provide them perks based on their membership. That is the problem a distributed ledger solves. The data is public and usable by any service provider.

To verify you have a HN account (membership) today, a service provider need to build something like keybase. That is complicated and will be different for each service.

That is the problem unlock-protocol "solves". It defines the protocol for managing these memberships. To create, verify, deploy, etc.

You need some way to pay for membership without a middleman. This is solved by cryptocurrency part of the blockchain these nfts are stored on.

Memberships are also more complicated than a list of email addresses. They can be transferred, expired, and change depending on the action of the user. For example, some provider want their memberships to be reduced to half when transferred.

This is the part smart contracts solve.
> When they deplatform you, all they can do is remove their copy.

> They cant remove your nfts from the blockchain, they can delist you from the blockain and for the purposes of listing/curation, you can still see your nfts on other platforms.

The original article acknowledges this but also complaints that there is no easy way to access your NFTs once they are gone from OpenSea. All the major wallets are using OpenSea as a single source of truth and not pulling data directly from the chain. Defeats the point
Ah yes, boolean blindness.
Is this based on experience? Not saying you're wrong, but I've been bit before by putting emphasis on the language when what I really needed was tooling and a healthy ecosystem.
I've cared sharing your comment with two farmers, they appear to be able to read so their response may not be representative of the audience you had in mind: Be a farmer just one day and you will change your mind.
I think it's wise advice as it wouldn't take long rethoric for some truth to reveal itself, and surely would be a valuable experience.
Calling it as an alternative might be an exaggeration. Both are used in security or as a protection like you mentioned. Yet, encryption is a way of storing data for a future[0] use in a secure manner while using the hash, you destroy the data and keep only the footprint.

[0] Future can be nanoseconds later in any data-in-transit unlike data-at-rest, so I picked future to address the ambiguity of time measurement in different contexta.
Reproducible builds refers to the process where a binary/package can be verified that it been built from a specific commit (for example). If the build process is reproducible, it means that every time you build the project, the output is always the same (idempotent). So Signal can publish a binary + a hash + which commit it been built from, and you should be able to checkout that commit, build the project, and once built, both binaries should be exactly the same (the hash for both should be the same).

Not only helpful in being able to verify that the binaries people publish are without 3rd part modifications, but also helpful in debugging and some other scenarios. More info here: https://reproducible-builds.org/

Although, on iOS I think reproducible builds are mostly useless (for the use case of verifying the binaries) as you can't download the binary straight from the App Store nor can you inspect installed binaries on your iPhone (AFAIK).
It's just as unscientific to quote a blog with no citations. That article doesn't even make any arguments. It's just an attack on Sepah and "the modern wellness industry".
"Market Stalinism" is a great phrase. I've been referring to https://en.wikipedia.org/wiki/Stakhanovite_movement whenever I see excessive metric-driven workplaces.
For what it's worth, I do agree with Moxie that encryption is under-used and can make many kinds of semi-centralized infrastructure private. But that's irrelevant in this case. The focus is on WhatsApp because Moxie likes to use the speed with which it rolled out e2e encryption as the canonical example of why centralized services are better for privacy (this isn't the only place he's made this claim). But it's meaningless: something switched on quickly on a whim can also be switched off quickly on a whim. And, note, we found out that WhatsApp was newly encrypted because of a blog post and some messages in the UI. It could be switched off again silently and who would notice? We know the answer to this because hardly anyone realizes there are forwarding limits, even though it's in their FAQ. Apparently there aren't any groups reverse engineering every WhatsApp update to figure out if it's still encrypting everything.

With respect to the latter part, there might be a terminology issue here. I'm using "desktop" to mean any non-mobile/tablet/server device, including laptops or
stick PCs. A whole lot of people have such devices and in particular the sort of people who create content do. The idea that people only have mobile phones is false. There certainly are plenty of people who only have mobile phones and they matter, but there is also a huge population of people who have more powerful computers as well. And even for those who don't, a big part of why is not inability to have one but because they don't see any reason to buy one. That's not exactly fundamental.

Finally I would be very careful with predictions about technology trends. The computing industry has oscillated between big centralized computers and smaller more personal devices several times already. Even today the picture is quite ambiguous: as I argue in the article, a fully-bought-in Apple user is very much still a child of the PC revolution. Modern iPhones are as powerful hardware-wise as many PCs, just the form factor and usage model is different. The ecosystem there is very far from the canonical cloud-über-alles vision promoted by Google via the ChromeBooks.