skysight-inc/HackerNews huggingface dataset:
> You do not seem to be aware of the practical constraints around an actual attack like ciphertext malleability in this context

Show me a peer reviewed paper demonstrating, or at least convincingly arguing, of the soundness of a particular technique you are trying to advocate, and I’ll believe you.

Otherwise it’s pretty simple: either your authentication method has been validated (as are HMAC and polynomial hashes), or there’s a good chance it’s broken even if you don’t know it yet.

> For block based, the best way is simple to use a validating filesystem like ZFS on top of whatever block based crypto is being used,

File system blocks are typically 4KiB or so. AES blocks are 16 bytes. I’m not sure what you mean by "block based crypto" here, the length of AES blocks has nothing to do with the file system blocks you’re trying to encrypt.

> In either case, including AES-GCM, the validation and authentication is not, itself, the symmetric encryption algorithm. They wrap approved block ciphers which do that.

I have implemented a cryptographic library, so I’m well aware. I insist on authenticated encryption as if it was a monolithic block because it makes much safer APIs. You really really don’t want to let your average time pressured programmer to implement their polynomial hash based authentication protocol by hand, there are too many footguns to watch out for. Believe me, I’ve walked that minefield, and blew my leg off once.

> I'm not against AES-GCM, not at all. It's awesome! I'm pointing out that it has implementation tradeoffs.

Compared to what? All the example you cite in your other comment (SSL to PGP/GPG, S/MIME), make the exact same trade-offs!! They all add an authentication tag to each message, effectively expanding it size.
The district has tax revenue that (to oversimplify) will now be replaced with the regular county taxes, which makes it more or less revenue neutral.

You say "handled by the county" as if it's a burden, but that's literally the purpose of government.

The real burden is now on Disney, who has to demonstrate to the governing body that any given desired improvement is worthwhile to be approved.

Part of that is usually the "developer" contributing to the project cost.

Everyone is focusing on the money, but this is really about the ability to bypass government control.

Which is why Disney was so insistent on bearing these costs in the first place.
The problem is that there's a literally a 3-trillion-dollar business depending on the difficulty of rejecting tracking.

The inability to easily reject tracking cookies is not a technical problem. It's a problem of lobbying and malicious compliance by megacorporations living off web surveillance. They will subvert (P3P), ignore (DNT), or replace (FLoC) every technology that makes it easy to reject tracking cookies. They will fight every law and smear every institution that tries to mandate use of any easy tracking-rejecting technology.
All your links don't show any "concrete" evidence of a16z failing to pull out and being at a huge loss from their "crypto" investments.

The web3 bullshit that they are spreading as mentioned in your article is evidence that they are pumping their own bags and continuing to hype the web3 narrative with their nonsense. But it isn't evidence that they are 'not securing the bag' and just only sitting there in the bubble, nor does it show that they are at a significant loss. They aren't that silly enough to just sit around, hold and not secure the bag in their investments.

They (a16z) made it so that in their own crypto investments, they can't lose unless in rare circumstances, even in the event of a hack.
>In March 2021, the 6th Circuit Court ruled in Meriwether’s favor, noting that if “professors lacked free speech protections when teaching, a university would wield alarming power to compel ideological conformity.

We're way past that point.
things like these

That the manager of a really big BBS tried to help her video game company president boyfriend with his controversy about being mean?

One can only imagine the horrors if we don’t learn every sordid detail.
Your post reminded me of one of my favorite Adam Savage videos where he touches upon this idea you're exploring. I encourage folks to see it, he articulates it so well.

I linked to the start of the video where he begins to build the idea. TLDR is he mentions Monet painting Impression Sunrise and how it was something that people have never seen before and it took a bit of time for it to blow people away--they needed to develop "new eyes" to see the genius. Adam then dives into this idea of "new eyes". I'm sure many of us have experienced this in our life and it was so nice to hear Adam unpack it.

https://www.youtube.com/watch?v=qE7dYhpI_bI&t=122s
On a pure human level, a large portion of DK discourse seems to be a fight over which people are the "Unskilled and Unaware." Or more bluntly, who gets to call who stupid.

The author says as much in this article:

> Why so angry? [...] [Frankly], for the last few years, the world seems to be accelerating the rate at which it’s going crazy, and it feels to me a lot of that is related to people’s distrust in science (and statistics in particular). Something about the way the author conveniently swapped “purely random” with “null hypothesis” (when it’s inappropriate!) and happily went on to call the authors “unskilled and unaware of it”, and about the ease with which people jumped on to the “lies, damned lies, statistics” wagon but were very stubborn about getting off, got to me. Deeply. I couldn’t let this go.

It's true, the previous article (https://economicsfromthetopdown.com/2022/04/08/the-dunning-k...) was pretty harsh on the authors of the original paper:

> In their seminal paper, Dunning and Kruger are the ones broadcasting their (statistical) incompetence by conflating autocorrelation for a psychological effect. In this light, the paper’s title may still be appropriate. It’s just that it was the authors (not the test subjects) who were ‘unskilled and unaware of it’.

But on some level, the original paper sounds just as condescending and dismissive. It presents a scholarly and statistical framework for looking down on "the incompetent" (a phrase used four times in the original paper). In practice, most of the times I see the DK effect cited, it functions as a highbrow and socially acceptable way of calling someone else stupid, in not so many words.

Cards on the table, I've never liked DK discourse for this reason. It's always easy to imagine others as the "Unskilled and Unaware", and for this reason bringing DK into any discussion rarely generates much insight.
They're not really the same thing: https://www.postgresql.org/message-id/CAM3SWZRP0c3g6+aJ=YYDG...
TE is a trademark of Tyco Electronics, a very popular connector and electrical device supplier (audio included), and could be a confusing acronym to use for Teenage Engineering.
This was years ago, but I once contacted Barracuda to inquire about buying one of their Spam Firewalls. I used "myname-barracuda@mydomain". Before I even got a response from the salesperson, I got a spam e-mail to that address.

Then I got a response from the salesperson. I asked if he knew that I had started getting spam to the e-mail address that only they had, and he said there was no way that was possible.

I figured that his machine had some malware on it, and that harvested my address and sent it to the spammers. But the cynic in me wondered if they wanted to make money from selling the spammers my e-mail address AND from selling me a spam firewall.
> I think the biggest complaint I see these days is the perception that the algorithm is being manually manipulated to promote/not promote certain topics and/or people.

The scary thing is, this isn't a conspiracy myth. Back in 2014 FB got caught at experimenting at how algorithm changes affected the mood of users [1].

[1] https://www.forbes.com/sites/kashmirhill/2014/06/28/facebook...
> As in you own the dollar longer thus it has more value?

No. As in, having $10 million cash in hand today has more value than having a guarantee that you will be paid $10 million 10 years from now. Think about it, would you rather have $10 million now, or in 10 years? Which is more valuable to you?
The Datacenter Of Babel
Sheryl Sandberg under fire for trying to kill story about ex, CEO of Activision
65 interviews and rejections in 10 years? If the potential employers know that or can see it on your résumé that's a red flag. But I wouldn't expect you to get past initial screening if they can see that history.

Interviewers are frequently advised not to give feedback or criticism because of the risk of lawsuits. Anything they tell you potentially can come back on them, so they say nothing. I have been through several classes on interviewing and hiring conducted by lawyers and they always advise to say nothing, to never give a reason for not hiring someone beyond the vague "We don't feel like you're a good fit" or "We found a more suitable candidate." At least in the US the legal risk probably explains why no one will tell you what's going wrong.

You're getting to the final interview, so it's probably not your résumé or any obvious red flags during the initial screening process. Failing so many final interviews indicates there's something you're doing (or not doing), not just an occasional glitch at a few companies.

If you think back on some of those interviews, was there a point where you knew, or at least sensed, that the interview had gone bad? A look you got that communicated discomfort, boredom, lack of interest? I know I have sensed that moment when I know the interviewers have decided to hire me or not -- they either relax a bit and the talk gets more casual, or they go silent and start going through the motions. If you can replay interviews in your head and think about what was asked and said just before that moment, what you might have said, how you responded, etc. And think about how you talk to people, what kind of impression you make, your body language. As objective and "technical" as companies try to make their process look it still comes down to "Did the interviewers imagine working with me?" People tend to make such decisions quickly (within just a few seconds of meeting someone) and based on superficial characteristics, then the rest of the interview is normal human rationalizing to confirm the decision they've already made.

When I've made this point before people have argued that interviewers don't make snap judgments, and the process they follow is more objective. But imagine if someone shows up for an interview late, or dirty, or drunk, or starts the conversation by slapping you on the back, or saying "This place was fucking hard to find." You and everyone else has already made up your minds regardless of how well the candidate aces the whiteboard problems or the panel interview. On the other hand, a neat, prompt, attentive, courteous, smiling, and attentive candidate has a lot of runway. I'm not saying you're showing up late or drunk or rude, but think about the impression you make in those crucial first few seconds. Maybe ask a friend you trust to tell you honestly what they think about your demeanor and presentation. A career or interview coach might help, or a good recruiter.
> "you don’t know the real types of variables at runtime", this is just flat wrong. One doesn't know the real type of a variable until runtime.

I read the sentence as

"you don't know the real types of variable at [the start of] runtime"

as opposed to

"you don't know the real types of variable *during* runtimes"

So I understood the author to mean what you said. Could have been clearer you're right.
I knew that there was zero chance of this being in Canada so that automatically left this being a US only operation. Very cool, I'm curious what sort of apps you could build on this, it seems that while you can get some programmatic access to banking, there's so many state specific regulations and law you have to abide by.

Money transfer license alone is quite expensive for each state.
The most important thing to do at a live sport event is watch some other sport event elsewhere apparently.
Not yet, but that might be coming. I have one personal project set up to run mypy as a pre-commit, but I'm not (quite) ready to force that on my coworkers.
If Elon takes Twitter private, I doubt that you can argue that the quickest practical solution is other than as I’ve suggested.

In the secretive context of the current non-profitable public Twitter model, yes, I agree, they cannot do anything useful.

Not sure why you got a downvote though, so have my upvote.
Maybe rotate through the services on a quarterly schedule? Cut your costs to a fifth of what they are now?
I'm not arguing for an open API, I'm arguing for more options in content algorithms. These would be under their sole control.

Aside from that, thanks for the link. That is a great post!
Apple's current line of ARM chips lack the memory and IO features that are essential for server application. Sure they could be added in a new design but I suspect that the value proposition of in house designs would not as good with the added baggage.

Overall Apple just isn't that interested to produce low margin commodity servers. If Apple had a sliver of intention of returning to the market they would have kept both Xserve and the server OS going with minimal effort. Sony's smartphone business division have been losing money for a number of years but they have repeatedly stated that they will keep it going for the foreseeable future because it would be much harder to enter the market again later without one foot already inside the door.
Great landing page but I'm just going to point out that the code sample is curling a WIRE of $40,000 and the top entry in the "Transfers" is a WIRE for $4,000 and its driving me nuts :)
Which one of the two led her to select Kotick as a romantic partner?
What do you mean by "open sourcing" the Twitter algorithm?

What are the actual requirements that you're looking to satisfy by doing this?
Yes, exactly; the same for anything said about any (C20 at least) peacetime politician - blaming a person, after a decade or so, is just partisan clickbait.
Maybe- but that's a mess they'd rather avoid. And one that could backfire on them.

Which is why before cutting state political donations entirely, they contributed to pretty much all candidates.
I use a different email for everything so I have been waiting very patiently for this and guess what… so far no one.

Absolutely no one.

And I've been using this system for over 5 years now
Thanks for the info. Hadn't ever thought about it - makes sense.
Bias Smells
Exactly this. I’ll gladly pay you Tuesday for a hamburger today.
That he nuked someones car order because of things they said to me shows he doesn't exactly support freedom of expression.
> this feels like a theoretical concern as of yet.

This was Ajit Pai's argument. That we should regulate nothing until there's a problem. There are two problems with it,

(1) It's already a problem. There have been documented examples of ISPs throttling, favoring their own partnered content. Also they are actively expanding or seeking to expand zero rating which is anti-competitive.

(2) At the point you actually have a barren landscape in which competitors cannot grow, you've already sucked in a slew of investors on the idea that these monopolies' business models are sound. If the government steps in at that point, they risk being seen as the bad guy for destroying all that investment, which can have political consequences.

We can avoid all that by acknowledging the existing problems, and encouraging competition among ISPs. There should be very few people advocating for monopolies, and we outnumber them.

> Prioritizing non-streaming-service (e.g. throttling Netflix at prime time) packets could, for example, help a regional ISP stay competitive.

That only helps Netflix and that ISP maintain their grip. It's only competitive if by competitive you mean stomping out any new ISP or content provider that is unable to make such agreements.
If you had never listened to a professional play piano before then you'd have no idea what level of performance is possible. Similarly, if you had never seen skilled skaters perform on TV.

But we have done these things, so it's obvious that they're doing something that's very difficult.

Sometimes the things we find most impressive, in a demonstration of a skill we don't have, aren't the most difficult things.

I remember being absolutely blown away by some aerial circus tricks and stunts I saw at shows. Later, I started studying and eventually performing myself, and it's often the case that the most crowd-pleasing stunts are some of the easiest to perform.

As a performer, you could always tell which members of the audience knew their stuff, because they'd be the only ones applauding the tricks that might not have looked so spectacular, but were actually the most difficult.
Was going to say the same for some implementations of Common Lisp, notably SBCL, which by default treats type declarations additionally as assertions. Subject to limitations it can use declared types and infer more types at compile time to produce more optimal assembly and give warnings if it detects type errors, or interestingly warnings if it has a chance to use e.g. a fast assembly add on a fixed sized int if you help narrow its inferred type with an explicit declaration one way or another. But unless it can prove a type always holds, it will also by default check declared types at runtime.
Generally speaking, tech like ClickHouse is considered a data warehouse tech. But we are using it as data lake tech: there are no schemas involved in Dassana. This means that you can send free form JSON objects to Dassana and query them using SQL.
You have no idea how much money he has, how much connections he has, how many VC's, bankers, nationstates are willing to put money behind him. you hve no idea how much Eth, BTC and DOGE he has. He's up at least %14,000 on Doge from when he started tweeting about it.

You have no idea how rich this man is, people need to stop acting like they do.
eInk displays aren't supposed to need backlights; LCDs need them because they just wash out if you light them from above, but eInk doesn't have that problem.

Playdate is some kind of "memory LCD" that's more like eInk, but I don't know how much like it.
Thanks for letting me know! The only concern is being able to see text clearly without having to move my head because that quickly got annoying. It does look like SimularVR's resolution + lenses may solve this issue though, so I'm keeping my hopes up.

> We're targeting (stripped down) review units to be available in May-June time frame.

That is very exciting. I'll keep my eyes peeled.
Elon Musk is big tech. That's why we don't trust him.

When he releases Tesla schematics, sells spare parts, and allows unaffiliated repair shops to reserialize them, then maybe we can talk about him being different or better than the current set of big tech oligarchs.
I believe there’s a second chance algorithm that runs or is manually triggered by dang.

https://news.ycombinator.com/pool May be involved.
It actually happens extremely rarely, perhaps less than once a year. Though that may just be an artifact of my already heightened discretion in who I give an email address to at all.

The most recent offender was my kid's tee-ball league.
Everyone talking about "free speech" is buying the spin hook line and sinker.

Anyone remember the Musk tweet about how his AI is so much better than anyone in the market realizes?

Did no one notice that this is all happening within a month or so after Twitter added a dislike button?

Would both positive and negative sentiment data for one of the largest under-monetized repositories of social data have any value to an eccentric billionaire with some major AI R&D focus?

He's not buying Twitter to defend the first amendment.

He wants the data for his AI stuff. That's just not nearly as popular a PR slant.
I think part of the problem is that many IT departments have a culture which focuses on the needs of less-technical users. They often don't have a good appreciation of the more demanding needs of technical teams. Non-technical users need a lot of handholding – an approach which can be irritating to the technically advanced. A locked-down UI which doesn't let you change any settings may be the right approach for non-technical users, developers can find it infuriating that you won't let them try to solve their problem themselves, and instead force them to talk to a helpdesk who don't understand it either and want to follow some script ("Have you tried rebooting?"), before they let you talk to someone who actually understands what is going on

Maybe software like Jamf isn't inherently a problem, but it can encourage IT departments with that kind of culture to do more things to irritate developers (like automatically run buggy scripts on developer laptops without any notice or easy visibility into what those scripts are and what they do), which without that kind of management software available to them, they would have been less likely to try to do. Developers are more likely to have configured their environment in custom ways which will cause IT's buggy script to play up and cause problems

I used to work for Oracle, and while I was there Oracle had a whole separate IT department just for the engineering/R&D org, while the main IT department serviced the rest of the business (sales/support/finance/legal/HR/etc). I don't know whether Oracle still uses that setup, but (if the company is large enough to sustain it) that could be an approach to avoid some of this
> My understanding is most of these policies have always been targeted at the large streaming services that are putting the most burden on the networks and who often already have special interconnect agreements.

"large streaming services that are putting the most burden on the networks"?

That is completely non-sensical. It is not streaming services that are creating a burden, it is the ISP's customers. The ISP's customers are asking for the bits. They are using their Internet service / connection to get what they want (video). Is HN 'causing' the traffic to flow over my ISP's pipes when I reply to comments, or is it me (the ISP customer) when I click on "reply"?

The streaming services are not dumping bits on to the network like a chemical plant polluting a river. The streaming services are sending bits that the ISP's customers requested.

If the ISPs can't deliver the traffic that their customers want then they need to architect their network to handle it.

ISPs are selling access to the Internet, streaming service are on the Internet, and so ISPs need provide it or stop advertising that they're providing Internet access.

The streaming services are paying for their Internet connection, and ISP's customers are paying for their Internet connection, and it is the job of the ISP to connect the two.
This is only possible for content that is flagged in a binary way. Most of these systems will also have a score for content and up/down rank the content based on the score. Using a score is actually a way to reduce the harm done by the algorithm. A low score will reduce the number of people that see content but not remove it completely, preventing false positive censorship.
This looks nice, I've been wanting to make a whitelist-enabled card for ages now. It would ask me if I want to trust the merchant before every charge, so anything unrecognized would just be rejected. I could also set limits by month/day/year per merchant and anything above that wouldn't go through.

Maybe this is exactly what I need.
"for those of you who have seen those firsthand"

I feel old.