A fitness tracker is exactly the sort of software I would expect to pay once for. It doesn't need some compute-heavy backend. It shouldn't need any backend at all. The entire application is window dressing for a SQLite database.
5,930 karma · joined March 4, 2020
A fitness tracker is exactly the sort of software I would expect to pay once for. It doesn't need some compute-heavy backend. It shouldn't need any backend at all. The entire application is window dressing for a SQLite database.
The ATF in this instance (and frankly most instances) chose the most violent option available to them, because good people don't join the ATF. Violent thugs who get off on shooting dogs join the ATF. And when they get tired of shooting dogs, they decide to manufacture a scenario where they get to kill a more dangerous game.
Besides the legal protections, the primary leverage a union has is the fact that in manufacturing, agriculture, etc., companies start hemorrhaging money if work stops. So a relatively short strike (and thus more easily weathered by the members) can have a massive impact. This worked even before there were legal protections for unions, because the union can strike faster than the company can hire scabs. Of course, prior to the protections, companies could decide that taking the hit was acceptable, and then just hire a bunch of scabs to replace the workers. Or they could threaten the union leaders with violence. Which of course lead to the unions using threats of violence against management and the scabs.
After a couple decades of increasing hostilities, accelerated by the re-introduction of a bunch of combat trained WWI vets back into the workforce, the US established a robust set of worker protections to eliminate the necessity of violence.
Sure, an Angel descending from the heavens would shatter our existing scientific understanding of the world, but that wouldn't make it intrinsically supernatural. It just would reveal a whole branch of knowledge that we didn't previously have any lines of inquiry into.
In comparison, Carmack is grossly overhyped. He's like the Feynman of CS: A significant contributor to relatively young field, and a pretty influential communicator, but their contributions were moreso being the first to make a certain type of incremental progress than a paradigm shift.
They're being conservative with their rollout mostly because of civic issues. Most places do not have a legal framework for "what if your autonomous vehicle hits someone?" yet. Even if Waymos never were at fault for a collision with a person, you can always have cases like the one in Georgia back in October where a bicyclist wasn't looking where they were going and rammed into one. The shaky legal ground is a pretty big impediment right now, and that's in the US where we have much laxer laws about corporations killing people.
Meanwhile, the US is wildly more diverse at the local level than Europe is, which leads to its own significant cultural differences. Up in Northern California, about a quarter of people are of Asian descent, predominantly Indian and Chinese. Another quarter is Latino. Southern California is half Latino. Jump across the country to the Midwest, you've got a lot more people of German descent, in the South you've got Black people making up a significant portion of the population. What the US lacks in local history, it makes up for in cultural admixture: all those diverse backgrounds end up stewing together in unique ways across the country, producing all sorts of unique cultures. Leads to some fantastic fusion foods: Spam wasubi, breakfast burritos, American pizza, soul food, Chinese-American cuisine. Sure we don't our own thousand years of rich fucks inbreeding over funny hats, but the wide spectrum of cultures across across the US draw from the histories of everywhere on the globe.
Compare that with, say, Germany. Germany is 70% ethnically German. Most US states aren't even that 'White', never mind breaking that down by individual countries of origin.
Regardless, nowadays online, even in tech circles like this one, you have a much broader sample of the general population. In the case of HN, it's split more evenly than you'd expect from the general population between software developers, and tech entrepreneur types (or at least wannabes). The latter group is perfectly happy with oppressive power structures as long as they help them make money, and aspire to be the authority that says "no".
A and B now have each other's information, and are free to sue each other.
The problem with the status quo is that the platforms are taking full advantage of the slack given between receiving notice and taking action for counterclaims, but acting immediately on claims.
Now, there are far right people who want to dethrone the current powers that be. But distinguishing between "I think Mark Zuckerberg shouldn't be given unlimited power because no one should have that much power over others" (left) versus "I think Mark Zuckerberg shouldn't be given unlimited power because he's a Jew" (right) is a useful distinction. One wants to eliminate the power structure, the other just wants different people in it.
User shows up at your login flow. You assign them a big random number identifying their user session (this is your "state")
User indicates an identity provider they'd like to use. You probably have a short list you trust.
You ask that provider for the configuration data.
You generate a big random number, that identifies this log in attempt as unique. This is your "nonce".
You send the user, along with the state and nonce, to the trusted third party. (at their "authorization endpoint")
The user proves to the trusted third party they are who they say they are. This isn't your problem.
The user comes back to you with a claimed state and a code (a big random number assigned by the trusted third party).
You check that the user's claimed state matches the state that you assigned them. This ensures that you end up authenticating the same user session as the one that started the login.
You then reach out to the third party directly (to their token endpoint), with state and code in hand, and ask them "yo, a user session with this state just claimed you sent them to me with this code. Who are they?".
And then the trusted third party sends back a token attesting "They are so and so".
The one superfluous step is that, according the spec, you're supposed to then verify the signature of that token. It is unclear to me why this is in the spec, since I just made an https request to the trusted third party. The entire security model here has assumed that trusted third party is trusted.
But that alternative of dissenting unions not striking is exactly the loss of leverage that I was talking about.