HNHacker News
TopNewBestAskShowJobs

LukaAl

391 karma · joined March 10, 2014

submissionscomments
LukaAl··on Images and video showing extent of Oroville dam damage
Don't know the details of the projects but from the pictures posted (here and elsewhere) it seems that only topsoil was eroded.

Yes, bedrock is not indestructible, it could get eroded from water, but it takes times. Plus it get eroded slowly over time. The main concerns was the use amount of water released by the failure of the spillway. For sure the water keep flowing over the collapse spillway would erode the bedrock lowering it, but at a slower pace...

LukaAl··on Cross-Site Request Forgery is dead
Well, from a user perspective it breaks links meaning that they work in an unexpected way. For sure it is a much-needed improvement, but it is not a fix it all feature.
LukaAl··on Cross-Site Request Forgery is dead
Help me understand: Strict means I break the basic way in which the web works, links? It seems to me a useful feature (Ironic!)

I could get that in certain case it is a good idea to be strict (e.g: banking, e-commerce), but it is a relatively small percentage of the web. And the Lax policy doesn't solve the issue because, well, someone could always screw and forgot they don't accept submission on Post.

Don't get me wrong, it is a useful and powerful tool. What I'm simply saying is that CSRF is paraphrasing Mark Twain right now: "The reports of my death are greatly exaggerated".

P.s: also the other comments are right...

LukaAl··on Security Risks of TSA PreCheck
I don't see why the Koran (quran, cough cough) should tell you something about terrorism. It is the Muslim's holy book, not the terrorist's holy book.

For my discussion, I simply used the Merriam-Webster dictionary[0]. It says "the systematic use of terror especially as a means of coercion". You are correct, their final objective is not to just scare people but to get something else. But I believe the immediate objective of the terror action is to scare people so to get to their final objective.

[0] https://www.merriam-webster.com/dictionary/terrorism

LukaAl··on Security Risks of TSA PreCheck
I thought about that. But if finding a terrorist is like trying to find a needle in the haystack, Schneier suggestion (as well as any other expert in security will tell you), the best solution is truly random search. If it is truly random, the terrorists have no way to predict if they will be checked and if it is frequent enough, it will be sufficient to change their behavior.

As for the point of sense of safety vs. real safety (impossible) is a well taken one. But this false safety could be dispensed with much lower costs for the citizens (both in terms of money and inconvenience).

LukaAl··on Security Risks of TSA PreCheck
No actually when the department of Homeland security conducted an undercover test, TSA detected the whopping number of 3 undercover agents...

They failed to detect the other 67 who were able to embark planes with weapons end explosives[0]. But that's just a detail... You know, these agents were instructed to avoid TSA screening. Who trains to do that in the real world, right? [sarcasm]

[0] http://abcnews.go.com/US/exclusive-undercover-dhs-tests-find...

LukaAl··on Security Risks of TSA PreCheck
The problem with this article is that it fails to recognize the real threat model. The objective of a terrorist is not to blow up a plane, it is to scary people and do this by killing and injuring the highest number of people while minimizing the risk of being detected.

If this is the threat model, why a rational terrorist should try to put the bomb on a plane? The Brussel Terror Attack has shown exactly this[0]. Terrorist killing themselves at the check-in counter (but they could have chosen the security lanes).

Obviously, we need airport security because the threat model is not only terrorists but also hijackers and smugglers (and non-rational terrorists?). Obviously, the risk of using the hijacked plane as a bomb, like in 11/9 is still a risk, but other measures like reinforced cabin doors are more effective for that.

So, basically, the TSA is a failure in making people safer and but a huge success in making traveler life miserable. TSA Pre-Check is nothing but them keeping on with their "good work".

[0] https://en.wikipedia.org/wiki/2016_Brussels_bombings#Brussel...

LukaAl··on A new analysis of how the world’s wealth is distributed
I think you don't understand how money works. Probably in the short term, you are right even though empirical evidence suggests that in hyperinflation scenarios luxury good price increases less than other normal and necessity goods.

In the medium term, you have to ask yourself who is able to capture this money. Not for sure the homeless that has no means to start with. Probably will be captured by the people that control directly or indirectly the manufacturing means. So the rich will be the one capturing most of the helicopter money.

The reason is that money is not capital. Money by itself does not produce value. One of the most effective ways to increase social mobility is by investing in education because allows people to acquire social capital that they could invest to generate real capital and then money.

LukaAl··on A new analysis of how the world’s wealth is distributed
We could give everyone a million making everyone a millionaire. But the value of that million will be pretty low or, put in another way, this will generate a lot of inflation basically returning at the starting point.

The thing is that the dollar as no value by itself, its value derives from what it could buy. If the economic activity increases generating more value, the value of the dollar will increase. And that's not just theory, that's what happened in the last 20 years were a large number of population in developing countries were raised out of poverty. Check the Milanovic chart for seeing it [1].

The second problem is that it is not necessary that a society that has an unequal wealth distribution is also unjust. Suppose to have a society where everybody between 20 and 60 years old works for 1K a month. Before 20 years old the could use debt to leave, after 60 years old to their death (let's say 80 years old) they live with the savings. You would agree that this society is just, everybody makes the same amount of money. And yet there is inequality in wealth distribution. Youngs just before turning 20 will have a huge debt, people turning 60 will be, conversely, in the top 1%.

This example could sound naïve, replace it with student loan and pension funds and you will see that is pretty much the status of US economy.

[1] http://blogs.ft.com/off-message/files/2013/10/Change-in-real...

LukaAl··on 12-Foot Traffic Lanes Are Bad for Safety and Should Be Replaced (2014)
Whoa whoa whoa. You are getting it wrong. The size reported by your Amherst document is the maximum width, not the body width.

I have an idea of the importance of this distinction, and I could go at great length explaining it. But the linked document reference the AASHTO's Green book as a reference. And if that manual says that 10-foot road are ok in one chapter, and acknowledge the vehicles dimension in another, chance are that is ok. Obviously, if you think it is not, you have to demonstrate they are wrong.

Full disclosure, I know nothing about traffic engineering and I'm an average driver. This is the reason why I check expert sources and not the first document found on the internet...

LukaAl··on 12-Foot Traffic Lanes Are Bad for Safety and Should Be Replaced (2014)
Done that without problems, also because I know how to drive.

Out of curiosity, where you found 9' wide ambulance when the US GSA (General Service Administration) standard says that they should be 96 inches or less?

LukaAl··on 12-Foot Traffic Lanes Are Bad for Safety and Should Be Replaced (2014)
I'm reading a lot of comment from people complaining that this article is wrong and we shouldn't make roads less safe.

Question: what are you talking about? A 10-foot road is wide enough for a car or truck to drive safely at urban speed limits. The maximum vehicle width under Federal law is 102 inches, or 8 feet and a half. And this is for trucks. Cars are around 80 inches. This means over a foot per side for cars and more than half a foot for trucks. If it is not enough for you at city speeds, please give up your driver license, you are not good, and you shouldn't drive.

Yes, I agree, I don't want to drive 50 miles an hour next to a truck on a 10-foot wide lane, but that's not a city or a suburban speed, that's highway speed. On the opposite, no problem at driving at 15 or even 25 MPH on a 10 feet lane. Yes, probably I need to give up texting and driving, and I need to be focused on the road. Guess what: I need to do it anyway.

Honestly speaking, I have enough of our politicians of disregarding scientific studies and expert analysis, but this is somewhat accepted. But a community like Hacker News should have the smartest people, not the dumbest ones that fail to understand reality.

LukaAl··on Concorde
The concord didn't have an auxiliary power unit to provide energy with the engine off. So it needs to rely on energy from the gate or a special external unit. This unit was also necessary to provide the energy to start the engine.

Obviously, it could start the engine but don't use them for taxiing, except that the 4 engines were so powerful that at idle produced enough thrust to move the plane (and they were burning a lot of gas). So better to taxi on it's on power than been towed.

P.s: the 2 tons figure was the higher estimation, not the regular consumption...

LukaAl··on Mass Hacks of Private Email Aren’t Whistleblowing, They Are at Odds with It
I'm not sure I want to ever work with you. There are a lot of situations when with my coworker I discuss things in a way that could be misunderstood. This because my coworker have access to a lot of context (we work together) and they are well intentioned and able to extrapolate from the context my real meaning and belief. The general public doesn't have the same context. Plus, a third party could have a vested interest in representing my ideas under the worst light for me. So this is why I want to make some statement publicly, knowing the impact of my phrase, and use a different tone in private with people that know me.

And that's without touching the problem of public policies. Honestly speaking, some issues are generally too complex to be analyzed in a debate or in public speeches. So complex articulated analysis needs to be reduced and simplified. On some topic, it is possible to have a point of view that, when expressed, is a very valid one, but requires a lot of education to get buy-in from the general public. So if you are a politician what do you do? You could choose to use part of your consensus to push for a dividing policy and educate the public on why you are right. Are you could decide to wait, flow with the public, until you are ready to make your position public.

LukaAl··on Mass Hacks of Private Email Aren’t Whistleblowing, They Are at Odds with It
I have two problems with your reasoning:

- Who decides that hacking the Mafia is Ok and someone else it is not? And if Mafia is ok, what about lesser criminals? What about someone you suspect is criminal but you are not sure?

- It is in theory laudable to ask full transparency from our politicians. And, yes, the on/off record distinction is sometimes problematic. But this is not what we are talking about. The article discusses private conversation between two public persons. They should think on how they express themselves in these conversations? This couldn't have the effect of freezing their ability to communicate? I have no idea, but I think it will be problematic. I'm not saying that one of the two involved parties could not breach the privacy assumption. That is own personal choice with the consequences to his reputation, so he could decide to do that according to his ethical consideration if he thinks what he has seen is wrong...

LukaAl··on Google keeps ex-Googlers close by investing in their startups
It seems a really smart move to me. At the stage they are investing, the quality of the people and their reputation is more important than the idea itself as a success predictor. Ex-Googlers have on average a good reputation and they know how they were performing. So it makes a lot of sense to put a small amount in convertible notes early on that could easily result in a lot of money down the road.

And if the idea doesn't work out, well, they are closer to them than any other company, much more easy to hire them with all the economical advantages of re-hiring someone you like and trust. I think that, from an economical point of view, there are few downsides and a lot of upsides...

LukaAl··on I'm Peter Roberts, immigration attorney who does work for YC and startups. AMA
How does O1 and EB1 visa relate? Being on an O1 Visa make the EB1 visa process any easier? E.g: the qualification for the outstanding need to be reassessed (basically redo everything) or they just accept their previous decision?

Thanks

LukaAl··on Learning to learn by gradient descent by gradient descent
Next article: "Learning to learn to learn by gradient descent by gradient descent by gradient descent".

Then "Learning to learn to learn to learn by gradient descent by gradient descent by gradient descent by gradient descent" and keep going. Turtles all the way down!

P.s: I understand the beauty of this article, but I was surprised none get this irony :-)

LukaAl··on Cayley – An open-source graph database
I've loaded the full Freebase dump into Cayley one year and something ago (Freebase is probably already big-sized). It took around one week on a pretty beefy machine, the problem being mainly the way the data was structured in the dump.

But after the import, it worked pretty well without issues and with decent performances. With decent meaning: not good for a Front End, good enough for running analysis in a back-end using a little bit of caching.

LukaAl··on Cayley – An open-source graph database
I've used it in the past (and also contributed some patches), it has some roughness around the edges, but it works far better than Neo4J.

It handles far bigger dataset than Neo4J (even if performances are not great) and it is easier to use and maintain.

LukaAl··on How to Pass the Product Manager Interview
As a PM I almost totally agree with you. There's a caveat, though. I know what I want, and in general, I want everything well done and polished.

But the right question is not "What do I want?" but "What need to be done?". That means having different priorities than my wishes and understanding the work on some non-sexy features that will make the product stronger in the long run.

One thing I noticed, though, is that what needs to be done could change, in a startup environment pretty quickly, and having been on the other side, it is pretty difficult to understand. So you need to communicate clearly why priorities are shifting, and you need to be able to take the blame if they are shifting due to a mistake you have done.

Anyway, my suggestion to any wannabe PM: Thinks of what is important for the product, not what you (or the stakeholders) want in the product. Second, be clear in your communication.

LukaAl··on Bay Area attracts the most startups – but NYC, Boston, and LA are catching up
"I'd be able to afford a nice apartment in SF" is the new "I would be rich"
LukaAl··on H-1B Willful Violator List of Employers
I could contend that the shortage of engineers qualified for that job is due to scarcity created by the US immigration policies. And then I'll ask you if you can't have your super high salary without exploiting the current system, your salary shouldn't exist.

Again, I'm not saying what they are doing is right or ethical or desirable. Just challenging the different point of views.

LukaAl··on H-1B Willful Violator List of Employers
No, the Visa you are referring to is the O-1 Visa, it is much more difficult and expensive to obtain, but it is not subject to Visa CAP (I know it well, I'm on O-1). H-1B is for specialty worker, and they are not defined by exceptionality but by the fact that they possess a qualification for a specific job, there's a shortage of US Citizen for that job, and they receive market rate salary.

We could agree that the behavior of consulting companies like Tata or Infosys seems like cheating (basically, send thousands of application hoping that a good percentage succeed). But they are hiring for positions that require a degree people qualified; it is difficult to hire for that kind of position (primarily because you could make more money with the same qualification in different companies); and they are paying market rate salaries (or at least, that's what it is certified!).

I could agree that the current H-1B Visa system is broken, but I'm not sure that fixing it just for the perspective of highly paid Silicon Valley Bro is the best solution for the US as a whole. What I'm saying is: are we sure that this kind of cheap specialty labor is not useful for the US society as a whole? E.g.: are we sure that, if System Integration companies have to pay engineers a much higher salary, they will be able to provide prices low enough for other company to pay it? And if few companies could pay for their services, this wouldn't impact their efficiency on one side and the B2B software market on the other side?

I'm not defending the violators nor supporting the "cheap H1B" practices. Just saying that the world is a little bit more complex than that.

LukaAl··on Fantasy Math Is Helping Companies Spin Losses into Profits
Matt Levine is a smart guy but often tends to oversimplify. It is not just one of the three, is all three at the same time.

The number 1 is more or less true for a good number of companies. Number 2 and 3 applies to the rest of the companies depending on the investor you are looking at. The number of gullible investors is non-zero. Throws in that many companies are in option 1, and distinguishing between 1 and 2/3 became a complex problem.

So, we have a subset of companies whose price is determined by the ratio between good and bad investors. Obviously, good investors will fly away from these companies. But these companies could make you a lot of money if you leave soon enough. And then in finance classes, they use to say: "the market could stay irrational longer than you could stay solvent."

The results? Inflated Pro-forma statements stay around for enough time to do damage.

LukaAl··on Why “Uber for X” companies are struggling even as Uber thrives
A little bit more complex, I guess I wasn't clear enough. But I agree with you.
LukaAl··on Why “Uber for X” companies are struggling even as Uber thrives
Even if agree with you, centralized vs. decentralized makes a lot of difference, this is not the main point of the article. Centralized vs. decentralized influence your go-to-market strategy and probably your probability to succeed, but not directly your business model.

The point made in the article is that the biz model of the "Uber for X" businesses is not very strong unless X is a heavily regulated market and you are able to skip part of the regulatory burden to provide a far better service.

What's missing in the article, is the effect on the market size. Uber and Lyft changed the market size. I've taken probably a cab five times in my life before Uber existed, probably I'll use Uber five times before this week ends. And the same goes for many people. What about SpoonRocket, for example? Well, I ordered food delivery before it existed. Probably having an app and many more restaurants to order from increased my consumption of food delivery service, but just a 10 - 15% more. Not enough to sustain new players and make enough people switch fast enough to build a sustainable barrier to entry.

Not sure I'm clear: Uber provided a service so much better that increased greatly increased the market size and captured a lot of new users (and old users were fast to switch). Other services failed to increase the market size and didn't provide existing users enough benefit to switching, so no barrier to entry for competitors, a lot of competition, a lot of startups that fails.

I have a doubt, though. We are seeing a lot of Uber for X failing, but that's because a lot of them were competing for the same (in the US car-hailing market there was just Uber, Lyft, and Sidecar). That doesn't mean that one or two company will survive in the end.

LukaAl··on Native Mac Notifications Comes to Chrome Stable
No, as they explain, the feature in stable is behind the status in Canary: https://bugs.chromium.org/p/chromium/issues/detail?id=326539...
LukaAl··on 1Password sends your password in clear text across the loopback interface
Yeah, you should stop the turtle sequence. Maybe don't make it so easy that a script kid could exploit it, though...
LukaAl··on 1Password sends your password in clear text across the loopback interface
Fair enough... or not!

First of all, when assessing security of a solution you have to define the perimeter of attack. You could imagine a privilege escalation that gives you access to the loopback interface but not enough to install a key-logger.

In other words, you are making an assumption that could be wrong!

Second, I could agree that perfect safety against every attack is impossible unless you assume your machine is switched off. But reasonable safety measure is achievable at low cost. Diffie and Hellman won the Turing price yesterday and their work is almost 40 years old...

← PreviousPage 2 of 4Next →