skysight-inc/HackerNews huggingface dataset:
Makes sense. Reddit moderators are even more deluded about where the site's value is than they portray its owners to be. It is certainly not in the moderation work, which many do to satisfy their need for power over others, and for each moderator there are 100 sycophants and narcissists lined up to take their place.

The value is in the users, the people who create content. And to that end the freest, fairest, and most democratic choice is the individual's private decision to participate. Closing subs to protest takes that choice out of the hands of the user. Make organic posts to the site to raise awareness of any particular issue or cause you like, and let those get viewed and voted as they will. But using moderator powers to make these statements is an abuse of power and abuse of the user base, and it's exactly what I would expect from the archetype reddit moderator. I wouldn't be too upset to see a few get their comeuppance for it.

I say this as someone who dislikes the reddit organization, the CEO, their lies and underhandedness, has been proudly perma banned from there, and would get some petty satisfaction from reading about them crashing and burning. But if people like it and want to use it and continue to participate in their communities they are a part of there, they should be permitted to.
and by the time someone gets acces

This sort of thinking, is why places get hacked. You don't know what the access vector is. Stop making excuses. Secure your shit.

I would be so happy if a law was passed, and such actions were criminal.
I miss CDE. But what I want even more is for the remains of SGI to open-source the Indigo Magic Desktop.
The point of an E2E cryptographic design is that you don’t ever need to trust the server — the server can be as malicious as it pleases, so long as you can affirmatively demonstrate that the client never communicates anything that isn’t encrypted with a key the server has no access to.
Qt has uncanney valley... do you think people using HTML care to make things look native then?
Most (successful) paths lead to balkanization. Just one acquisition can do it, much less 2 or N more. And the pace of these changes can outpace your ability to respond to it, which makes fighting it a losing battle.
Phil Zimmerman also has very little to do with the design of modern PGP, and the influence he did have was malign (if not deliberately so). Signal is so well studied it won the Levchin Prize at RWC.

I don't understand why you believe cryptography engineers generally participate in standards bodies. A comparable percentage of cryptography engineers do that as do software engineers with software standards bodies.
The Terraform provider[1] unfortunately is 3rd party and as such doesn't bring and guarantees of correctness other than that of the maintainer. It would be nice to see Keycloak provide an official solution for configuration management other than the K8s operator which is missing a lot of features.

[1] https://github.com/mrparkers/terraform-provider-keycloak
How about something like NoNoise?

Or Beacon.

Or Flare.

Or FOSSE2EEMsgApp.
I created a proposal for Map type but didn’t make it through.

https://github.com/graphql/graphql-spec/pull/888

The issue with GraphQL is it tries to appease too many masters.

Similar to jsx. The language isn’t evolving.

The good thing is the spec is (almost) frozen, so there’s many implementations, the bad is it can’t encompass the flexibility of json schema can do.

Going with GraphQL means you have to have good control over both client and server. And like any tool, there are new ways to shoot yourself.
They also don't have any publicly defined approach to combat criminal activity on their network, like they can't give the IP address of personal information, but they can still delete the groups and related accounts[1] - just create an account from these free temporary phone numbers from the internet, you will be able to see the past groups accessed (and non exited) by the account. To give a contrast, Matrix has a clear approach to moderation[2].

* they have a forum[3] that is not even indexed by search engines[4], which is not community friendly at all.

[1] https://community.signalusers.org/t/could-signal-become-the-...

[2] https://matrix.org/docs/communities/moderation/

[3] https://community.signalusers.org

[4] https://community.signalusers.org/t/google-site-search-doesn...
I've worked in a datacenter that had a few different networks that must not touch each other. One of the precautions we took was color coded ethernet cables. A blue cable plugged into a red server will cause an incident if someone sees it; even if the other end is another red server 1U down.
What you're seeing here is Apple's EDR implementation [1], which, on non-local dimming displays (every Mac display except the M1/M2 14" and 16" MacBook Pros and the Pro Display XDR), works by bumping up the whole display brightness (and adjusting brightness of all non-HDR content downwards) to display colors brighter than standard SRGB white.

So, yeah, both QR codes probably are brighter on your old Pro, if its display brightness is set higher. And, if you adjust display brightness on the Air, you'll see them converge to the same brightness there, too (on my M2 Air, it seems that Apple leaves a little headroom for the HDR "white" to appear a bit brighter than UI white at full brightness; not sure if the M1 Air behaves the same or not as it has an older display).

Displays with local dimming (and OLEDs) can display, in small areas, colors that are brighter than the maximum full-screen brightness. That's where HDR content gets really compelling-- if all you can do is dim the whole screen, you're unlikely to see much of anything that you couldn't do just by bumping up the brightness with SDR content.

[1] https://prolost.com/blog/edr
Fun, thanks.
Wish they had SimpleFOC based control instead of servo motors
Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments.

The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).
Because to make a significant difference to that person's life you'd have to give them an astounding amount of money (and probably other forms of support), and personally speaking I'm still desperately saving just for a chance at having a place of my own myself. Nobody claimed to be 'virtuous', but caring is a good first step. I donate some of my time and a small amount per month to a local multicultural group. Small things help. Caring helps. Why is this suddenly about whether you're happy to give away half your savings to a person you don't know? Society as a whole could make things better by sharing wealth just a little more equitably. But some people seem to think that billionaires are just fine and not at all a symptom of a sick society.

Sorry but I get really frustrated by this lazy kind of 'well why don't you do it?' response. It just feels like you're trying to convince yourself that you're right not to care (to be clear, I have no idea whether you do or not), and implying that anyone who does, and hopes for something better, is just a hypocrite.
The lack of Signal’s use within the NSA is not positive evidence of its compromise. The NSA has operational constraints that don’t even remotely map onto a phone-number-identified messaging scheme.
I have to imagine using Signal with a high level clearance might itself arouse suspicion, for one thing. People inside the intelligence community really can’t expect much privacy for themselves.
Right, but what prevents them from doing a similar whole-platform "update" to totally screw up privacy/security? The point of software freedom is the freedom to run variations on the software that's reasonably easy to do, because you have the source. If it's supposedly "you can connect to any Signal server you want, as long as it's our Signal server" and "you can use any Signal client you want as long as it's our signal client", there's not much freedom left there.
It was your bog-standard disk crash as I understand it. Pros were (eventually) brought in for data recovery. But I also understand the backup for the wikis on that server (like mine, one of the dead ones) was on the same server, which doesn't sound like a very good plan. If a backup was stored elsewhere, the dead wikis would have been restored in a very short time. Lesson learned, I hope.

I got most all of my data restored, but there was a temporary problem of deleting and replacing files that the server programming thought still existed. That was fixed quickly.
Not once have I seen a graphql blog/usage since like 2018 onwards, just die already
Race conditions in places like this are exceedingly hard to write reliable tests for. It may take one, two boots; dozens, or thousands, or you may just get insanely lucky and whatever arbitrary # boots you do to try and reproduce it was still simply not enough. It's hard to have any level of confidence, in many cases.
this was in response to the claim that if you're not paying you're the product. of course there is still the question of trust
I think the unstated part of the parent comment is that the zoom meetings aren't being scheduled in one block of time like in person meetings would be, but spread out over multiple days.

For some people, it's easier to take 1 day off work to go do a series of interviews than to fit 5 different one-hour interviews at different times over the course of a week.

If the company scheduled the zoom calls all in one block, then ya, zoom would still be more convenient than in person.
Don't trust Signal for what? For communicating about illegal dealings, that intelligence agencies are interested in cracking down? Ok, sure, but then don't "trust" anything digital over the wire.

What about having E2EE traffic for your day-to-day communications? Why not, it seems reasonably protected and no government agency or third party would reasonably put the effort into looking into that.
That was the original argument. But Signal has now rolled out functionality (sharing of contact lists and other details with the server through Intel SGX) that does force one to trust the server.
> It's probably been like this for centuries

This is mentioned on the article linked
> This throws into question what (Signal) consider “open source”, they are clearly deploying non-public software. [1]

Even if Signal did deploy the publicly available code, there's no way they nor a user can prove it.

We should never assume an open source version of anything is what's actually running on a server - edits could have been made to the code; in fact it could be entirely different software designed to appear similar.

[1] Minor edits for brevity's sake
Ask them! They're in the middle of one right now. The answer is simple: they don't control all the software, but rather have to convince other vendors to make changes.

(I like Matrix and will always sound like I'm dunking on them because of the implications of Nebuchadnezzar, and, before that, of opt-in E2EE; they're doing mostly the best they can with a tough hand to play.)
Hide Substack Popup Banner
This is an excellent post, but I want to point out that what really matters here is your threat model.

If you are trying to hide from the NSA or other nation states, you have a LOT of work cut out for you. There are basically two sub threat models: are you trying to hide from the dragnet (in which case, just using any obscure and relatively obfuscated communications mechanism will work) or the scenario in which you’re being actively targeted (in which case you need rock solid security from end to end). Keep in mind that the Security version of https://en.m.wikipedia.org/wiki/Analog_hole means the security of your networked device is just as important as your messaging protocol, and… good luck with that on mobile.

If you are just a small fish trying to avoid something with a court-admissible record (and don’t care about parallel construction) you’re probably fine with Signal, provided you understand that your counterparty can just give you up.

I hate to bring out the “nothing to hide” argument because I disagree with its premise from a moral standpoint, but from a practical standpoint, I recommend avoiding having “directly targeted by the NSA and needing to avoid it” as your threat model to begin with.
I get a yearly letter from county Treasurer demanding I pay them to avoid having my private, not commercial, house stolen. Government asset seizure is widespread.
Ctrl+f "Reflection" -> 0 results

Maybe next year ..
> so I am dumb

To be fair, as I read it, the criticism was directed at your work and not you. We all make mistakes.
If you can’t tell a story about it, it isn’t real
I feel like your “teach the controversy” response just reinforces my point.
BTW there are, or at least were, wide gamut only displays.

I have one Dell made a few years ago. It supports the additional colors of P3 but isn’t any brighter than any other quality normal display of the time.
The world was more humane when it was slower. Everything took longer, it gave you some breathing room and time to think.
No. https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...
Usernames is a pending feature[1], something discussed in their "secret" non-indexed forum.

[1] https://community.signalusers.org/t/usernames-in-signal/9157
Please stop taking it out of context.

"We should forget about small efficiencies, say about 97% of the time: premature optimization is the root of all evil. Yet we should not pass up our opportunities in that critical 3%."
It was a combination of the material factors and a mindset shift towards higher-level programming as the default.

The appeal of CISC instruction sets when marketing to programmers lies in their batteries-included stance: they handle more of the binary encoding stuff for you, more of the math operations. With a RISC approach they have to write library code to do the same tasks, which adds some implementation complexity as well as potentially being most of the size of a short program. And that makes sense - if you expect direct instruction encoding to be the whole programming environment, which, for the first computers, it had to be.

By the time you get to the microcomputer era the balance had shifted pretty resoundingly towards working at a higher level - that's why nearly every machine of that generation had a BASIC, and if you have a BASIC it's more important for the instruction set to be efficient, because efficiency becomes the only reason to drop down from a high level environment.
Winning the Levchin Prize is good. That helps build trust.
WSL 1.3.10 Brings Experimental Memory Reclaim, Updated DXCore and Linux Kernel
These have nose pads: Cooyee CY02 https://amzn.com/dp/B0BS5KRC5X $100

Source: https://www.headphonesty.com/2023/02/bone-conduction-sunglas...
It's also a reference to a Seinfeld episode: https://youtu.be/sYTIGXvc88Y?t=7
> This is a strange example because for a remote worker every other worker is "remote" so why would they ever exclude other workers from a group email?

It's possible if all team members in the office went out for lunch and didn't see the messages and emails in time. The remote members wouldn't exclude them, but the in person team members wouldn't be able to provide their input in a timely manner.
> Yet all clients running on people’s phones in the meantime were based on source that was published, with verifiable builds.

"Based on" meaning they're built from that source but have changes to it? Because given that the published source had known bugs and was not updated for months, either they're not fixing known bugs for months, or they're publishing builds based on unpublished source. (And the article does address the verifiable builds point, pointing out that it doesn't and can't really work).
I personally made a quake 2 bot using neural networks in 1999, I think it had several hundred neurons and several thousand 'synapses' (parameters).
At the time that felt like a lot of parameters. Computation wasn't much of a limit though, I could run several NNs faster than realtime.
It's easy to predict that this will drive privatization in Russia. Things that can't be done efficiently under the byzantine government rulebook will be farmed out to private entities. Americans should be well familiar with the dynamic.

By the way, we see the same security paranoia cropping up in the West about the use of software of Russian origin. Some of the mockery here seems un-self-aware.
That is already happening.
Meanwhile, just last year people living a couple of blocks from me were removing sludge a metre high from the floors of their homes due to river flooding levels we've never seen before. Very comfortable indeed.
I never trusted Signal due to https://github.com/net4people/bbs/issues/60
The last new information I had on this was that direct threading stopped being a distinct perf advantage when branch predictors got more sophisticated (able to predict indirect branches).

Do you have benchmarks on current gen hardware that suggest that the code complexity results in a measurable difference in outcomes?
> Every fucking app gotta have their own different styling

Have you considered that the average user never cared and never will?

Having ultra consistent styling across all apps ruins the ability to... you know... sell the software. It gives far too much power to some group of annoying elitist nerds in denial of their opinions preaching UI/UX pseudoscience.

> But hey, we can write same code to work on windows, mac and mobile ! It will work shit in all of them and be slow but we don't care!

Ain't nobody got time for reading even shittier documentation for badly written OS APIs.
> Fedora cron used eth0's first IP address and a urandom number to stagger cron jobs starting times.

What?

> Google addressed this issue by having a single enterprise wide cron service.

What???

What does any of that even mean my guy? Neither of these were a cron CI shell script services. What does any of that even mean? Did you just read the word “cron” and get excited?
On the user (and actionable) end, getting a cheap SIM from a country where they are sold OTC. Then, registering with that. You only need to confirm your number once, I think.
I think you're reading too much into this. I only mean that the cohort of cryptography engineers I meet are the ones in IETF. I have no intent to imply they are a majority, or even significant against the number of mathematicians who work at NSA, GCHQ, DSD &c.

If the ratios are similar then sure, there's hundreds (thousands) who don't. The point of substance is, these people can be asked what they think about software and systems. I haven't asked for a while.
For anyone wondering, their terms say:

"Direct discrimination means, for example, that a Job Listing, requirement, or question specifically makes clear that only Job Seekers matching a certain criteria are wanted, thereby excluding others because of, for example, their gender, race, age or disability. Indirect discrimination means, for example, that a Job Listing, requirement, or question implicitly excludes certain classes of Job Seekers by making it impossible for them to qualify for the job requirements. You understand and agree that it is your responsibility to refrain from posting any Job Listing, requirement, or question that directly or indirectly discriminates against Job Seekers or otherwise violates applicable law."

https://uk.indeed.com/legal
> Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments.

I mean, the points at the bottom of the article are exactly the same. I would consider your temperement and not indulge flights of fancy that I am attacking you or your institutions.

I am speaking as a citizen, from an outside perspective, on what concerns me; because ultimately I see Signal pushed very hard and only lip service paid to any issues.

> The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).

I thought it might provide some context, given that I am agreeing that the stated mission of OTF aligns somewhat and does not directly contradict the stated goals of Signal.
"day to day" and "illegal dealings" are not mutually exclusive for an ever growing proportion of the population.
I don't know if there is a good solution. Mostly it's a trade-off against these problematic options:

1. your contacts to be stored server-side instead of device-side, where they might end up in the hands of an adversary

2. your contacts to be stored in some other, less-ubuquitous-and-less-likely-to-be-complete format on your device.

Maybe signal could have write access to your contacts so that it could store its own identifiers in the address book, but I could see a lot of wtf moments coming up when privacy-minded folk see that permission request.
Not one but several “close the tab” level dumb claims:

-that you cannot be open source if you do not instantly share every change

-that the nsa funded signal

-that you can bribe the New Yorker magazine to write a profile about you

-that Facebook Messenger is as secure as Signal

I don’t trust dijit.
I think I can play both sides, GIMP vs Photoshop, Photoshop Vs GIMP.
Both have great engineers but sales and marketing is subject to opinion based on how you see them.
Thanks for sharing. You did everything the right way. 100 isn't bad for a first conference with a seed of 80-100 regulars from a meetup who know your style. The percent of each group would be insightful. Some thoughts.

The people going to the weekly free meetings might not be the audience for the conference. Group meets months (weekly?) for free those friendships get renewed often and don't require an expensive meetup.

The FB ads are not working, it might be the ad content. You mentioned a/b testing but it sounds like a low % of signups. It might be the wrong medium. It's probably targeting poorly. A sponsorship deal with popular twitter/ig/podcasts personalities would have been more targeted and introduce you better.

The other thought is perhaps people don't want your type of local conference for the price you are offering. I might pay $500 to go to a conference in Europe (plus airfare+hotel) because it's an experience but I would never pay 500 to go to a conference in my city because it lacks that global experience that justifies the cost. The price drop to 150 makes it seem less valuable.
Soybean oil decreases oxytocin levels in hypothalamus in mice (2020)
The worst thing is the many-monoliths/mini-monoliths problem that you get when each team thinks it has ultra special needs and absolutely must build everything from scratch, even if it’s a near duplicate of something someone else built 2 months ago.
German Man Needs to Drink 20 Liters of Water per Day to Stay Alive
Answer: Between 250,000 and 3 million.
Interesting as related to tailscale? Please tell me your insight. Legitimately interested.
There is a reason that many organizations have a leveling guidelines that you have to perform at the next level before getting promoted to it.