HNHacker News
TopNewBestAskShowJobs

B-Con

3,386 karma · joined January 15, 2012

Geek who likes Go, Linux, cryptography, and tinkering.

More about me: http://bradconte.com/about

My reading list: * tptacek * sdevlin * NateLawson * sweis * cryptbe * moxie * pbsd * cperciva * daeken * tytso * andrewbinstock (editor of drdobbs) * FiloSottile * matttproud

submissionscomments
B-Con··on M.I.T. Plans College for Artificial Intelligence, Backed by $1B
I found the cross-discipline focus on the staff interesting:

> The goal of the college, said L. Rafael Reif, the president of M.I.T., is to “educate the bilinguals of the future.” He defines bilinguals as people in fields like biology, chemistry, politics, history and linguistics who are also skilled in the techniques of modern computing that can be applied to them.

> [...]

> Traditionally, departments hold sway in hiring and tenure decisions at universities. So, for example, a researcher who applied A.I.-based text analysis tools in a field like history might be regarded as too much a computer scientist by the humanities department and not sufficiently technical by the computer science department.

They're not just talking about streamlining "learn these statistical models" but also expanding humanities studies.

The obvious wins from this that I see are:

a) more applications of A.I. in areas that C.S. students are less interested in.

b) more people who are knowledgeable about A.I. outside of C.S.

B-Con··on Amazon raises minimum wage to $15 for all US employees
Where did you see that?

I doubt hourly warehouse workers are getting RSUs to begin with, that tends to be for salaried positions only.

B-Con··on Facebook Is Giving Advertisers Access To Your Shadow Contact Information
According to the article it was one of the conditions and they paid ~$100-200M (IIRC) in fines for breaching it.

Which furthers my point, that Facebook will jump on any carrot in front of it.

B-Con··on Facebook Is Giving Advertisers Access To Your Shadow Contact Information
Is this any surprise? Just a few hours ago the Acton article on the front page[0] talked about them doing this in WhatsApp:

> Later he learned that elsewhere in Facebook, there were “plans and technologies to blend data.” Specifically, Facebook could use the 128-bit string of numbers assigned to each phone as a kind of bridge between accounts. The other method was phone-number matching, or pinpointing Facebook accounts with phone numbers and matching them to WhatsApp accounts with the same phone number.

> Within 18 months, a new WhatsApp terms of service linked the accounts and made Acton look like a liar.

Companies like this, and Facebook in particular, are desperate to connect identities. Phone numbers are an incredibly useful way to do so. Most people only have a couple of them, their re-use rate is slow, they get entered into forms all over the place, and they're usually valid (because they were provided as a primary method of contact).

In this case advertisers have an identity (and phone number), Facebook wants to match on that value. They're going to do it any way they can.

It may not be ethical, but the carrot is right there and it's naive to think you can give them your identifying number and they're going to turn a blind eye to it.

[0] https://news.ycombinator.com/item?id=18074690

B-Con··on How to Tell Us a Secret
Obligatory "don't forget to authenticate the other party. Encryption can be meaningless without authentication if someone MITMs the initial setup.

Follow-through on WatsApp's initial verification step using some other channel before you assume the communication is secret.

B-Con··on Google activated battery saving mode on multiple phones, then rolled it back
Thus is the nature of updating settings. Easy mistakes to make include:

* Changing a field's default value (is that even a mistake? users might perceive it that way. Also, is there a difference between a field set to the default value and has never been changed vs a field explicitly set to the default value? Should you change it in the latter case? Did you even track the latter case?).

* Overwriting a field's non-default value and setting it back to default.

* Migrating a field and mapping the non-default value to the wrong non-default value.

* Migrating a tuple of fields to another tuple of fields and getting the map wrong for an edge case subset of the input values (bonus points if that subset was thought to be an impossible state to get into).

etc...

The best way to avoid settings updates it to throw it all on the user. eg, Arch Linux just takes the approach: if, you update a file in /etc, the new file is just created with a special file extension and merging the new and current file is left to the user. You don't get nearly as many surprise updates, but... you spend time merging config files, which few people are willing to do.

B-Con··on Google Fiber Is High-Speed Internet’s Most Successful Failure
> Yeah I don't understand at all why people think that Google wanted to be in this business.

People still think Google Glass was a failed product. Many just have no idea how businesses, particularly non-traditional ones like Google with an appetite for change and a pocketbook to buy what it wants, are run.

B-Con··on Twitter’s deletion of its FB app caused old cross-posts to temporarily disappear
> They probably just ought to have spoken to each other.

Twitter probably should have just done the dive to verify what deleting an app does. I would guess this is mentioned somewhere in the docs.

B-Con··on The Billionaires and The Guru: How an Indian Family Burned Through $2B
Now it's

> How an Indian family lost $2 Billion

I think we're on the 3rd title.

B-Con··on Musk mulls taking Tesla private, Saudi sovereign fund builds $2B stake
> to announce news of this magnitude.

Only if he's announcing news, which he likely is not. The method itself makes it feel more like a muse and less like an announcement.

[edit]

Well, everyone seems to be taking him seriously...

B-Con··on The People Who Grind Out Movie Trailers
> Trailers don't summarise the whole movie.

Some do. If they contain:

* the protagonist's set-up

* the antagonist's set-up

* an explanation of the protagonist's challenges

* the protagonist overcoming the challenges

* the nature of the twist

* (sometimes the twist itself is hinted at)

* any romantic relationship of significance is both shown and the direction it ultimately goes is implied

* half the big awesome SFX scenes

* half the funny scenes

* almost every character of significance to the plot

then there isn't much left, I know almost all the key checkpoints, who has to be where and do what and what action has to occur. It's pretty much sketched out. There's minimal suspense because I know who can't die and who has to be where at the end of the movie.

> And even if you feel they do, knowing the outline of a movie isn't going to ruin the actual movie experience itself.

It definitely can. Part of a story is experiencing it for the first time, watching it unfold and not knowing what will happen. Trailers take that away from you. "Oh yeah, I've seen this fight sequence and heard that joke before" just doesn't carry the same weight. And when I have a checklist of people with places to be and action scenes to happen, I can predict things. "Well, I know there's going to be a twist because X has to fight Y in the streets and it looks like they're getting along OK as we approach 1h 20m mark."

There's minimal surprise left, which really hampers my ability to empathize with the characters and engage in the story.

B-Con··on The People Who Grind Out Movie Trailers
I think people are watching movie trailers because they're almost self-contained movies. Very frequently the protagonist and antagonist are set-up, the protagonist's challenges are laid out, the protagonist is shown overcoming the challenges, the nature of the twist is shown (and sometimes the twist itself is hinted at), any romantic relationship of significance is both shown and shows the direction it will go in the movie, half the big awesome SFX scenes are included, half the funny one-liners are included, and every character of significance is revealed.

Sometimes you literally don't even need to watch the movie, you just got the tl;dw in the trailer.

I refuse to watch trailers for movies I might see, because they ruin the experience since I know everything that's coming.

B-Con··on The People Who Grind Out Movie Trailers
What about summarizing the entire movie? That's an instant NO from me. I've literally not watched movies because I've seen the trailers and feel there's really no wiggle room left plot-wise, I know it all.

I very actively avoid all trailers for movies that I'm going to see. Modern blockbuster trailers just ruin the movie.

B-Con··on Riot Games Approach to Anti-Cheat
These problems are inherent to nature of being in the real-time PvP genre.

And AFAIK LoL was designed from scratch, it's Dota that actually based on the code of the WoW mod. Not that it matters today, that code is long gone.

B-Con··on Riot Games Approach to Anti-Cheat
How is it different than today? The game is slightly cheatable (scripters exist) and they are counterating it and getting some publicity out of it.

Being so good at anti-cheat that there is nothing to talk about seems like something so far away it's not worth thinking about.

But that said, I doubt the gains from allow "controversy" around cheating would outweigh the benefit of not having any cheating in the game. Not having cheaters is it's own talking point. Withing the competitive gaming community, cheating is already a major talking point and having little to no cheating is already a major selling feature.

B-Con··on Riot Games Approach to Anti-Cheat
That's literally impossible. The entire point of the game is to have client-side input and for that input to be generated by a human and not a computer. There's no way to move that to a server.
B-Con··on Bitcoin is a Cult
In this type of scenario (be it bitcoin hashes, serial numbers elsewhere, etc), the real question is how many possible "vanity" hashes exist. The odds of this specific one are not interesting, it's the space of all of them that is.

It's pretty much always infeasible to enumerate that space, but generally speaking there are a looooot of things that could qualify as special-looking enough to be included. All forms of english, foreign languages, language abbreviations, leet-speak, slang, pop-culture-inspired references, etc.

The odds of randomly tripping across something "special" eventually are pretty good. And bonus points if eventually one of those special coincidences is vaguely time-correlated with a real-world version of itself (eg, the number happens to be in the news, the slang word was recently used by a celebrity, etc).

B-Con··on Google Engineers Refused to Build Security Tool to Win Military Contracts
> That isn't enough. Due to the frankly idiotic way corporate investors think 'any company that isn't growing must be dying'.

I despise it when I see large companies make business moves purely to "grow". The big ones are roughly the size of the first world, excuse them for not growing a full 20% like they did last year.

Investors are in a bubble of "bigger is better". Who cares if you have a monetization strategy or how good your product is, how big are you? Who cares about the quality of interaction, how much did you get?

You see the social media giants like Facebook, YouTube, Twitter, etc, make UX moves that their dedicated userbase displakes purely because they're trying to tap into the long tail of users. Sometimes it feels like they would prefer 3x the userbase at 1/5 the average interaction quality because moar unique active accounts/month!!111

I would bet this ridiculous obsession with QonQ growth is responsible for half the irritating garbage UX we experience. It tests better for engaging the long tail so it ships. It's why your timelines/feeds refuse to sort chronologically, the casual masses only do drive-bys and need to be hooked/engaged every micro-chance that presents itself. It's why they want to curate your feeds, because most people are turned off by a raw firehose and the best content needs to be front and center when they do glance past it.

It's why Twitter literally runs ads literally telling people how to choose a username[0], because if you have a phone then please create an account, like seriously omgplzcreateanaccountwehavetogrowlikethisquarter!!!

Sorry, sore spot for me.

[0]: https://www.campaignlive.co.uk/article/comedian-romesh-ranga...

B-Con··on Reddit just passed Facebook as #3 most popular website in US
> There are groups on Facebook, but it's so tied to you that it's hard to just be a part of a community.

It's also a lot less sreamlined. Dare I say it, reddit feels kind of like an RSS stream of popular content.

Facebook groups feel much more like "go check in and read this group" and the timeline has become increasingly useless.

B-Con··on The Importance of Deep Work and the 30-Hour Method for Learning a New Skill
> I think it's important that we don't overly focus on one isolated experience point like yours, because empirically this is highly disputed.

I'm not saying my experience generalizes, I doubt every environment would see the same benefit. My point is that even though I started exclusively preferring one side, I can see value on the other side.

> It's a very shallow notion of information sharing, which could happen asynchronously through code, documents, email, or with a scheduled video call, or a short scheduled meeting, etc.

Far from shallow. Technically anything can be communicated in any environment, that's not very interesting. What's interesting is how pragmatically an environment actually works and what it's real life pros/cons are.

B-Con··on The Importance of Deep Work and the 30-Hour Method for Learning a New Skill
I've worked in private offices, private cubes, and open office.

As much as I personally prefer isolated offices/cubes, the last 4 years in a mostly open office have definitely given me sympathy to the argument for them. I personally have noted a level of collaboration and information sharing that just didn't happen in the more isolated environments. There is something pragmatically useful about having people be able to jump in with their feedback or expertise.

The more isolated people are the more you have to go out of your way to ensure information dissemination and feedback channels are available and utilized. It certainly can work, but I haven't seen it work as well.

Open rooms promote teaching, spontaneous design discussions, etc, that just doesn't happen in the same way over e-mail, chat, stand-up meetings, etc.

There are arguments to go both ways. I used to hate open offices, now I'm sympathetic to them.

A key to making the open office tolerable is that it should not mean no isolation. There are ways to address their concerns. eg, headphones are essential. Obscuring line of site is very helpful. My current situation has me in an area of "open rooms", where rooms with ~11 desks are arraigned in an open office-esque fashion. It's pretty decent. Not super-open, but people can "share space" with the people relevant to them.

B-Con··on Bitcoin Gold Hit by Double Spend Attack, Exchanges Lose Millions
> Ordinarily, the blockchain would resolve this by including only the first transaction in the block, but the attacker was able to reverse transactions since they had majority control of the network.

Not a very precise explanation, just checking, what exactly does this mean?

I always thought the way a 51% double-spend attack worked was by broadcasting a transaction for human consumption (eg, I'll give you Y coins for Z dollars), then secretly mining your own blockchain for the N successive chains following it. After the humans have completed the human-level transactions after waiting the standard N successive blocks with no transaction conflicts, you release your own secret blockchain fork back into the public with data that contradicts the current popular one and instruct your network to ignore the competing publicly-acceptable chain. The new private one wins so long as it is equally as long as the public one which it should be because you have more compute power than the rest of the public.

Is that basically what happened here?

B-Con··on Malware Found in the Ubuntu Snap Store
You can't install unofficial packages via pacman. And AFAIK none of the unofficial/AUR package managers, like yaourt, are in the official repositories so the point where you cross the line is very clear and distinct and any wiki guide to installing from the AUR makes it clear you are going into unofficial territory.

I haven't used Manjaro but they seem to intentionally hide the distinction between the official and unofficial repos, which is a bad idea.

B-Con··on Could a Neuroscientist Understand a Microprocessor? (2017)
No offense, but it seems like you didn't click through.

From the abstract:

> here we take a classical microprocessor as a model organism, and use our ability to perform arbitrary experiments on it to see if popular data analysis methods from neuroscience can elucidate the way it processes information. Microprocessors are among those artificial information processing systems that are both complex and that we understand at all levels, from the overall logical flow, via logical gates, to the dynamics of transistors. We show that the approaches reveal interesting structure in the data but do not meaningfully describe the hierarchy of information processing in the microprocessor.

The idea is to apply the modern neuroscience approach to a microprocessor to see what level of understand of the microprocessor is extracted. tl;dr: The high-level "meaning" of the processor's design is not extracted.

The purpose seems to be to examine the inherent limitations of modern neuroscience by applying it to a design that we do understand quite well apart from neuroscience, something we ourselves designed.

B-Con··on Omaha man ‘liked’ a tweet, then lost his job
> If liking a tweet will infuriate the largest (by population) country in the world, maybe $14/hr support agents shouldn't be able to one-click like tweets.

I think this is the most pragmatic thing mentioned yet.

Social media accounts are a real-time, globally visible way to communicate with the world. Treat it with respect. If you care about subtle mess-ups then have a review system or something.

I'm guessing the ideal PR person running the account is:

* educated in how that platform works (aka, young and social media savvy)

* experienced in the plethora of ways PR can go wrong (or well for that matter). "I know this looks innocent, but it's best to remain quiet on issues of X", for example.

and I'd guess that's a sweet spot that's probably hard to fill with one person.

B-Con··on False memories, or why we’re so sure of things we’re wrong about
People like certainty. It's why someone who is 100% reliable is generally perceived as far more valuable than someone who is merely very reliable. People are far happier to follow a leader that has 95% chance of succeeding than someone who has a 75% chance.

Confidence is basically just a word for "projecting one's own certainty". People like certainty, so they favor the person who knows what they're talking about over the person who's not quite sure.

But unfortunately, confidence isn't a perfect signal. Some people actively exploit the general human bias to find certainty to their own advantage by falsely projecting confidence.

This is a topic I find interesting. And to be fair, not everyone who projects false confidence is doing so maliciously, some (it seems to me) simply have a hard time holding things that aren't absolutes in their head and they tend to round certainty on things to 100% or 0%.

B-Con··on The antidepressant effect of sleep deprivation
It sounds like the theory behind this is kicking the circadian rhythm to see if it improves.

> Depression is also associated with altered daily rhythms of hormone secretion and body temperature, and the more severe the illness, the greater the degree of disruption. Like the sleep signals, these rhythms are also driven by the body’s circadian system, which itself is driven by a set of interacting proteins, encoded by ‘clock genes’ that are expressed in a rhythmic pattern throughout the day.

A classic, almost cliche, way to address "common depression" is to normalize the person's sleep schedule. Many people keep erratic schedules and participate in activities (eg, playing video games) at end of day that make going to sleep hard. They get poorer quality sleep and have no consistency, which messes up the circadian rhythm and contributes to depression. Such people are advised to at least try keeping a consistent sleep schedule for a couple weeks to see if it helps them.

The technique in the article seems to be the figurative opposite, possibly because regular sleep cycles are either inadequate or infeasible to achieve. They force a short-term horrible sleep cycle to see if they can jolt the circadian rhythm into working better.

B-Con··on Dropbox S-1
In the traditional model, yes. But if you're willing to make sacrifices... see previous discussion on this topic when it came up with Mega, de-duplication, and client-side encryption: https://news.ycombinator.com/item?id=5084261
B-Con··on AMP for email is a terrible idea
> 1. Gmail is a channel that Google has under monetized for a decade. This is an opportunity for them to extract value from the said channel. If you're allergic to Google offering free services that use your data for advertising, go pay for email. Google isn't a charity and you aren't entitled to a Gmail of your choosing.

This is part of the reason for why I've always used a vanity domain for e-mail that uses Gmail as a backend. I've used Gmail since beta invites were scarse, but there are a variety of reasons for why I won't trust any given e-mail provider permanently. The fact that most of them are free is just one, albeit an important one.

B-Con··on “We Are Morons” – A quick look at the Win2k source (2004)
I bet someone at IBM found a bug, traced it back to some quirk in Windows that was hard/impossible to work around and the ticket got the attention of an engineer who figured out how to fix it in less than an hour. They decided the change was benign so they did it, commented it for posterity, and moved on.

Microsoft actually has a reasonably close relationship with large companies that develop on their platform. eg, their plug fests for devs to come put their stuff onto the same machine and see how they all inter operate on new versions of Windows. I used to work semi-closely with someone doing Windows driver work. He knew a lot of quirks in the platform and even could escalate to the point of getting help from kernel engineers.

← PreviousPage 10 of 22Next →