HNHacker News
TopNewBestAskShowJobs

SolarNet

1,813 karma · joined June 14, 2011

submissionscomments
SolarNet··on A case against security nihilism
> This discipline doesn't exist in C++.

And this is where the argument breaks down for me. The C++ vector class can be just as safe if people are disciplined. And as you even described, people in rust can write "unsafe" and do whatever they want anyway to introduce bugs.

The language doesn't really seem to matter at the end of the day from what you are telling me (and that's my main argument).

With the right template libraries (including many parts of the modern C++ STL) you can get the same warnings you can from Rust. One just makes you chant "unsafe" to get around it. But a code review should tell off any developer doing something unsafe in either language. C++ with only "safe" templates is just as "actually safe" as rust is (except for with a better recovery solution than panics!).

SolarNet··on 0x7FDE623822FC16E6: A magic constant for double float reciprocal (2011)
> As mentioned in the article
SolarNet··on A case against security nihilism
The modern standard library, plus some helpers is the big part of it. Compiler warnings as errors are very good at capturing bad situations if you follow the rules (e.g. don't allow people to just make raw pointers, follow a rule of 5). I never said it was as easy to do as in rust.

As for tooling, things like valgrind provide an excellent mechanism for ensuring that the program was memory safe, even in it's "unsafe" areas or when calling into external libraries (something that rust can't provide without similar tools anyway).

My broader point is that safety is more than just a compiler saying "ok you did it", though that certainly helps. I would trust well written safety focused C++ over Rust. On the other hand, I would trust randomly written Rust over C++. Rust is good for raising the lower end of the bar, but not really the top of it unless paired with a culture and ecosystem of safety focus around the language.

SolarNet··on size_t-to-int vulnerability in Linux’s filesystem layer
They do use them, but only in a narrow fashion. A lot of people have tried to make default kernel wide static analyzers but they are mostly not useful.

And it's because the kernel does a lot of non-standard things, mostly because it has to. It is not a normal program.

SolarNet··on A case against security nihilism
> If ten years from now people are writing unsafe C and C++ like it's still somehow OK, that would be crazy.

I mean to be clear, modern C++ can be effectively as safe as rust is. It requires some discipline and code review, but I can construct a tool-chain and libraries that will tell me about memory violations just as well as rust will. Better even in some ways.

I think people don't realize just how much modern C++ has changed.

SolarNet··on An RFC that adds support for Rust to the Linux kernel
Except of course, the GPL is why linux remains so popular. A linux killer cannot be a linux killer unless it is GPL or similar. Or else BSD would have over taken linux a long time ago.
SolarNet··on A “deepfake” is at the center of a harassment case, but what if it’s not faked?
I mean it's pretty classic trick to mix in real stuff with fake stuff. This video was probably really, but one of the videos in question is apparently fake.
SolarNet··on Stop Calling Everything AI, Machine-Learning Pioneer Says
This so much.

To say nothing of the fact there is a risk of another AI winter when NN/ML continues to not produce (the promised) results.

SolarNet··on Amazon loses effort to install camera to watch counting of ballots in union vote
Because it will cost the taxpayer more?
SolarNet··on Technical interview methods pale in comparison to playing Factorio with someone
Independent of the thesis of the article, which is obviously terrible, it does get much better very quickly.

The "gather resources yourself" stage is like the first 5 minutes of the game, more so to force people to automate; I actually think it's an intentional stylistic choice to demonstrate how they are different. Like the first technologies one gets automates all of the resource collection in the game (and later tier resources can't be collected by hand). It becomes a pretty good point and click strategy game very quickly. In fact after the first couple hours you can basically play the game from the map screen if you want, using blue prints to put down large buildings and spidertrons as units to move around, without moving your main character ever again.

Like this is how the mid game looks (user designed blue prints, bots build it automatically, etc): https://www.youtube.com/watch?v=M0k1YeMm-6o

SolarNet··on How a Bad Random Number Generator Froze Sway (2020)
The only usage is here:

https://github.com/json-c/json-c/blob/df27756491abf9ecce648c...

Which appears to be part of the hashtable implementation for the json objects.

SolarNet··on HN was down
Spaceplan is a pretty fun and slightly comedic play through one as well http://spaceplan.click/
SolarNet··on Facial recognition can predict person’s political orientation with 72% accuracy
> I think the key line is how much better this system is than humans attempting the same task:

My key issue is: why does that matter, humans should not be doing it in the first place, why do we need a machine that's even better at it?

SolarNet··on How I cut GTA Online loading times by 70%
Part of this is that game companies are notorious for re-implementing standard libraries for "performance". I suspect both shitty implementations of sscanf and the not-a-hashmap stem from this.
SolarNet··on Reddit bans subreddit group “r/DonaldTrump”
I mean net neutrality prevents the ISP one from being an issue, which means making the hosting provider should be the end of that.

The payment infrastructure doesn't really have a good solution. Visa/MasterCard are famously quite puritan, most sex workers (e.g. OnlyFans, porn actors) get paid in direct deposit (form the websites) and are paid (by clients) using bank details (not cards, nor in most cases paypal like processors, it's one reason Patreon toned down the sex work they allowed). So yes, one would have to do that, create your own bank and stuff. But banks, like Tier 1 networks, seem to generally "peer" with anyone, but I am not clear if that's a requirement of legislation or not.

SolarNet··on A physical breach is a nightmare scenario for Capitol IT
My understanding is that each legislator is like an independent client and is able to run basically whatever IT they want as far as the unclassified (yet still sensitive of course) stuff goes. Given that, I'm betting the shared IT group is basically just recommending best practices and hoping people are listening.
SolarNet··on Stealing private documents through a bug in Google Docs
I mean point 3 is a big part of this value wise. By getting certified bounty-paid vulnerabilities in a big name product like google, they can then go on and get lucrative security contracts ("we hired a guy that has found bugs in google's products").

Also left unsaid is that these are products that people's grandparents use. So there is some very white-hat "help the public good" here. Even if it's also to the for-profit benefit of a mega corp. That's an issue for anti-trust courts, not people trying to make the world better (people use these products right now, that's the status quo; either it can be fixed now, or it can be part of a likely ineffectual protest that only harms others).

SolarNet··on The Internet Is for Porn
> This guy seems to be operating on the assumption that MEN are to blame for pornography's status as a social pariah

It's called the patriarchy for a reason. I don't know about you, but the priests I see ranting about pornography, the politicians I see talking about regulating it, the police who harass sex workers, people running groups like nofap, so on and so on, are men.

Yes of course women also contribute to it. But when I read the article, I didn't so much see it as blaming men, as explaining how the current social system is organized, and how that relates to gender. This is the point of the critical study of gender (AKA Women's Studies), not laying blame, but describing the system and how to confront it.

Not understanding that, treating it like someone is trying to blame an entire gender, rather than simply explaining how we got here, is why people make jokes about fragile masculinity and snowflakes on the right.

SolarNet··on States bring action against Google under federal and state antitrust laws [pdf]
> that's just capitalism.

Sure, it's a consequence of (unrestrained) capitalism, but it's not a requirement for capitalism. One can send people to jail for financial crimes, like monopolies, and still have capitalism.

> it's the people who were supposed to regulate these companies to stop them from getting to this point

Well that would be the politicians (and their weakening of regulation). Which is kind of out of the scope of "ideally X", because any such change would by necessity require changing politicians.

Also they are, in a (poor) way, being regulated by this suit. Being caught for a crime and regulation are sorta two different things though. Sort of like health care, regulation is preventative, often healthier and cheaper in the long run. Prosecution is emergency care, an expensive last resort.

> The world has missed out on 10 years of potential competition and innovation because of that.

Or, you know, the actions google took to exploit the capitalist system. If anything this is just a demonstration of the need for more socialist economic solutions.

SolarNet··on States bring action against Google under federal and state antitrust laws [pdf]
But this mitigation would still fail. They might test for different content, but they probably don't include a periodic test like this in their timing tests, and if they did, it would just be an outlier.
SolarNet··on Menu simulation, Spidertron, Ghost building, Confirm button
The Witness also does this for me. At least as far as like the scientific method and problem solving are concerned.
SolarNet··on Woman allegedly impersonated prosecutor, dropped charges against herself
They do actually do this. County sherrif mass emails the county employees if they have any teenage children who wanna ride in a police car for a week once a year as the pitch.
SolarNet··on AWS forked my project and launched it as its own service
I mean this point exactly (though I come at from the other side). If one wishes a big business to respect their commons then bite the bullet and use the "restrictive" (they are in fact freedom guaranteeing) commons protecting licenses (like AGPL) be radical. If one takes issue with the business practices of big business don't gently shove back with social expectations and a sound bite here and there, draw the hard line in the sand.
SolarNet··on What if we had Local-First Software?
> Neighbor trust

You misunderstood this. My trust of neighbors is more social and less technical. I am less likely to run into bots (and predators) on social media because local administration means those people must be within the jurisdiction of local law enforcement.

> The locality is a worst of both worlds, arbitrarily limiting discovery if they want to see and be seen and not providing any security as anyone could bridge access within or likely spoof an identity.

Part of the point would be to disallow this bridging. If you wanna be seen on both the internet and locally, that would be easy to do. But bridging outsiders into the local network means taking responsibility for them and their actions. And no one would want to do that unless it's people they know.

SolarNet··on What if we had Local-First Software?
This is a big one for me. But I think there is a missing level here. Local as in area, not just local to the machine.

Municipal and Neighborhood level networks would solve a lot of problems inherent in the broader internet, as well as making solving problems as discussed by the OP easier.

For example, it's a lot easier to trust your neighbor than someone on the internet (and better too). For one you can look them in the eyes and shake their hand, for another you are both governed by the same court (though this does make privacy more locally relevant). On the flip-side this means local people don't necessarily have to be great at the internet themselves to use these complex hosted programs. It's just another website rather than setting up a google docs server or using a git repo.

Continuing, another problem it solves is local discoverability. There are a thousand products out there that do local services, from craigslist, on down to "local wikis". But these services don't often care about your community, and it can be hard to know what other people are using (separating local efforts across a global network). Putting them all on a local network, with a local index (and search engines) allows better discoverability nearby (especially if portals into neighboring communities can be connected, eventually perhaps into a federation of sorts), but also services that are oriented to local needs (and issues and regulation).

I'm not saying this would replace the internet. Obviously not. But it would provide a better, safer, and more useful "local layer" of the internet to go to first (to say nothing of the social media security and child safety aspects). That also happened to be faster and more resilient (doesn't go down when the internet does). The problem of course is shit ISPs, though this is why the MeshNet people do what they do. And having applications and a community ready for it. The technology (and culture) would also be useful for communities that can't participate in the global network, from isolated communities (either due to poverty, authoritarinism, or remoteness) to future ones (spaceships, remote colonies).

Just a thought.

SolarNet··on Google is giving data to police based on search keywords, court docs show
I mean it is core to google's service. Targeted ads and all that. It will always have this data, it can't not have it.
SolarNet··on A follow up to Coinbase being a mission focused company
Absolutely, which is why their apolitical stance is absurd.
SolarNet··on A follow up to Coinbase being a mission focused company
HTTPS is political (see attorney general of united states). Do you use HTTPS on your websites? (a step against the U.S. government position) Have you turned HTTPS off in your browser? (a step towards the U.S. government position) Do you implement forward perfect secrecy for HTTPS connections? (more against U.S. government position) How do you weigh it's threat to national security against it's protection from criminals for individuals and companies?

All of these actions can be viewed as political statements. Everything is political.

SolarNet··on A ritual for your product increases satisfaction and spending
I think a lot of games already do this. Minigames that are glorified button presses for example. The fortnite pinata lootbox as a notable example. But lockpicking minigames in skyrim could be seen as the same. Even quicktime events to an extent.
SolarNet··on Research questions that could have a big social impact, organised by discipline
It's frustrating that "Computer Science" is prefixed with "Machine Learning, Artificial Intelligence, and". Ignoring many of the notable research questions that have nothing to do with intelligence. Ditto the "Statistics and" prefix to mathematics. Both of which ignore the 90% of the field that isn't the prefix.
← PreviousPage 3 of 34Next →