Tinned_Tuna

GitHub is responsible for load-testing their systems to find their breaking point, they are responsible for setting appropriate quotas and rate limits, they are responsible for forecasting growth, they are responsible for sourcing capacity to match that growth, and they are responsible for pricing access to that capacity.

If this is some sort of AI-boom related load problem, they are also partly responsible for fanning those flames. I'm skeptical of the AI-boom narrative because other forges are not falling over so frequently; it seems unlikely that all competitors are massively over-provisioned or are not getting hammered by the same claimed boom.

Something doesn't add up and I am not inclined to give GitHub management the benefit of the doubt.

> The majority of the US is not inside a city.

I think this isn't true for the US any more, maybe it hasn't been true for decades?

WorldBank seems to have the ubranisation rate at around 80% for the US: https://data.worldbank.org/indicator/SP.URB.TOTL.IN.ZS?locat...

There is a bit of a definitional problem, with people living in suburbs identifying as rural, as do folks in exurbs. I don't think they're considered rural, and they're concentrated enough that well-designed public transit could serve them quite well. A decent public transit system means that families in sub/exurbs can go from 2 cars to 1 car without a major drop in quality of life, but they'd save $5k - $10k per year.

One thing I'd like to see modeled is how many excess deaths they cause in, for example, London.

Driving in London is already very safe because the street design prevents people going very fast. American roads are, by comparison, unsafe. That probably means AVs in those countries had a lot of low-hanging fruit, so they could have a significant impact by staying within the speed limit, for example. Without such low hanging fruit, will there be so much benefit in London?

London has excellent and very safe public transit, far safer than even professional drivers. If AVs are cheap and convenient enough to pull people off transit, that might expose enough people to higher risk that makes them overall kill more people than if they'd stayed on the tube.

Likewise, more driving (even EVs) generates more asphalt and brake pad dust, which cause respiratory illnesses. If they cause a drop in transit ridership compared to no AVs, how does that affect the excess deaths in the city?

My gut says that, in London and other cities with safer streets, they're going to have more difficulty getting such headline-grabbing numbers. Combine that with the potential to take people off safe transit and put them on the road and the balance might slightly tip against them.

This is presented as a fact, but lacks documented real-world instances, direct measurements, or even any proxy measures that suggest it's actually happening.

One thing that's potentially different, at least for Facebook, is the network effect. It only takes a few friends to start using Facebook for event planning for people to start missing events or worrying about missing out. That extra pressure cuts against individual choice.

Instagram is different, but you can see something similar happen on platforms with a chat feature. If people start to gravitate towards a singular app for talking, coordinating, etc. then there's the potential for resisters to be socially excluded. For most people, feeling socially excluded is a strong motivator. So far, this has mostly resulted in everyone having a fairly broad set of apps with chat features, so I'm not sure the centralizing power is as strong.

I don't think the author read even the Wikipedia page on Napoleon's invasion of Russia? Napoleon _did_ have reasons for attacking Russia, he _did_ prepare logistics. His motives, rationale, and actions are well-documented and widely studied.

> watching an unchecked megalomaniac march 685,000 soldiers into a Russian winter without a fur coat in sight

Napoleon famously crossed the Neman River in *June*.

I've seen this happen to a friend. Back in the noughties they built a home NAS similar to the one in the article, using fewer (smaller) drives. It was in RAID5 configuration. It lasted until one drive died and a second followed it during the rebuild. Granted, it wasn't using ZFS, there was no regular scrubbing, 00s drive failure rates were probably different, and they didn't power it down when not using it. The point is the correlated failure, not the precise cause.

Usual disclaimers, n=1, rando on the internet, etc.

p.14:

"Because 99.999% availability provides for less than 5 minutes of downtime per year, every operation performed to the system in production will need to be automated and tested with the same level of care. With a 5 minute per year budget, human judgement and action is completely off the table for failure recovery"

"Start viewing willpower as a resource that can be depleted, and make sure you aren’t wasting it on trivial things."

The concept of ego depletion is not as certain as it once was.

http://www.slate.com/articles/health_and_science/cover_story...

Hey!

What's the layman's 2-minute definition of a time crystal?

The name makes it sound very sci-fi, like it might have the ability to travel through time (!)

I am equally suspicious of creating a government agency for tracking all citizens. However, I worry that your proposed solution has three significant caveats.

Firstly, reliability tends to change slowly. Banks might not be tracking this, so it would take a long time for this problem to surface. The article indicates that they're already unreliable, and banks continue to rely on them.

Secondly, there's too little competition. There's no realistic alternative; especially when all three seem to be roughly equivalent in terms of reliability.

Finally, any single bank dropping a credit agency will cause that credit agency problems, but will likely cause themselves more problems. Individual banks have little incentive to act on their own. Some form of banking cartel would probably be needed to put sufficient pressure on the credit reporting agencies to effect change.

This. Make your _business_ case, not a technical case. This applies to software engineering, security engineering, etc.

The above comment does not absolve you from doing cool things, it's just that the cool things should align with business interests. No yak shaving. Sometimes writing a one-off script will take 30 minutes, and doing it by hand will take 10. Do it by hand.

I know it's really asking a huge amount, but my 2FA wish-list for 2017 is:

  1. U2F in all browsers.
  2. U2F on all the services I consider important (Google, GitHub, Facebook, etc.)
  3. U2F setup on the above services without a phone number -- just force acceptance of the backup codes.
  4. U2F integration in SSH.

I'm currently using TOTP through Google Authenticator. Not great, but definitely a step up.

I think with the above in place I'd move to LastPass (from KeePassX), as the security of my passwords becomes much less important. Still not a huge fan of putting my vault in the cloud though.

Oh, and a fire-proof "safe" for my backup codes.

The best thing I can suggest is regular, invisible backups. Ensure that it's very difficult for them to avoid doing the backups, and make sure that what ever holds the backups is a battle-hardened.

Social engineering is a broad problem right now, and all you can really do is be prepared to pick up the pieces after the fact.

fail2ban and similar tools are standard, widely used, quick to configure, and very effective at removing noise. You won't need to hassle to configuration of any new or existing clients, vulnerability scanners, etc.

This is an interesting read, but it's worth digging down into the particulars. In particular:

> Is adding obscurity the best use of my resources given the controls I have in place, or would I be better off adding a different (non-obscurity-based) control?

Is a really important question to ask. In this case, I'd argue that port-knocking, SPA, and changing the port are not cost-effective.

Obscurity is not free. There are additional costs and risks to consider:

  * Has the port-knocking or SPA software been well tested or audited?
  * What if my pentester mistakenly believes that there is no OpenSSH service, and so doesn't check it?
  * Is it worth re-configuring all of my SSH clients? What if I have to go through change control?
  * Is it worth re-configuring any vuln. scanners I deploy?
  * Do my clients support port-knocking or SPA?

I could spend an hour setting up port-knocking, SPA, or rolling out a port change. Could I do something more useful with my time? Perhaps better testing my application? Finishing that pressing code review? Buying and using a vulnerability scanner? Reaching out to a pentest company? Setting up an IDS?

All of the above will probably have a better cost-benefit ratio than port-knocking, SPA, or changing the default port.

It is almost always more cost-effective to just use Mozilla's OpenSSH guide[1], keep up with security patches, and direct your attention to the weaker components of your stack.

References:

[1] : https://wiki.mozilla.org/Security/Guidelines/OpenSSH Security/Guidelines/OpenSSH, Mozilla

I'm not sure your point about Java 7 is correct. The docs (http://docs.oracle.com/javase/7/docs/technotes/guides/securi...) state that it is a SHA1PRNG, seeded with "true random". So the first call may block if it goes to /dev/random on Linux, but it should be good-to-go after that. I think this is the same behaviour as Java 6, but I don't know about previous versions.

Java 8 does define more sources for SecureRandom, including NativePRNGNonBlocking, which specifically refers to /dev/urandom (http://docs.oracle.com/javase/8/docs/technotes/guides/securi...).

I can finally recover my account!

I actually really like the language, but there are several key points which stop me from using it in any production systems:

First and foremost, the build system. Oh god, the build system. Cabal is wonderful in some respects, but I have often found myself in a situation where the answer is "delete the ~/.cabal and ~/.ghc-pkg". This should not happen.

Laziness. You get concise programs, but then the memory performance is unknown until you read it and/or learn to read GHC's IR. You know, I'd really enjoy being able to know roughly how much memory I need to buy up for the systems I'm deploying.

Experimental or non-standard extensions. Just no. I'm not going to rely on non-standard or experimental "stuff" that tie me to a single compiler. This is made all the worse in that they're all hard-bound to various GHC versions and you're expected to use them in production (I'm looking at you, web frameworks). We have standards, stick to them.

It is for these reasons that I can't recommend Haskell to people as anything more than an interesting language to learn. Until the above is fixed (many of which are cultural) I will not use Haskell in production.

The link's not working for me, nor is any reference to SLOTH given on http://www.mitls.org/wsgi/tls-attacks.

I'm surprised that we're still using this as a bit of a hack in the future. In the project I'm working on, when we substantially optimise a section of code, we move the un-optimised, believed-good, version. It becomes an oracle against which the optimised version is tested on both manually and randomly generated test cases.

I'm not saying that the above solution should have been deployed at the time, but perhaps it could be moved in that direction now that we have these techniques and tools to hand.

Could such a solution work well here? Perhaps, it would be even more useful, as tests would be likely to fail if the optimisation was bad, rather than just assisting with debugging after the fact.

It depends on your needs, and what you want to do. If you're a big Pythonista, perhaps Jython is worth a look in. Lisper? Look more towards Clojure. Need to be able to hire developers? Plain Java will help you on that front.

Often, choosing a JVM language does not lock you into that language, as there's good interoperability. Be prepared that the first choice of language for a project might not be the best choice.

In response to the question, Java, Spring, Hibernate, and Postgres have served me well on a variety of projects. However, you need to take it with a grain of salt -- my needs will likely be different to your needs, and my skill set is almost certainly different.

A minor nit-pick, most GPS chips will happily give out a position as a best-effort.

The actual accuracy of the measurement is given by the dilution of position (DOP), which does not appear to be in the data shown in the blog post.

This would undermine their ability to pin-point their location to within a meter, as the DOP could be very high; especially in areas with lots of tall buildings or other problematic environments.

From the comparisons, it looks like the author's GPS is getting a very low DOP (i.e. a good, clean signal from a constellation of >= 5 GPS satellites).

Either way -- still glad I don't use FaceBook, and an interesting find!

Yea... this has been around for years.

JSP and ASP.NET have allowed for this kind of shennanigans in their "view state" (albeit, security is a configuration option away...) mechanism. It's not hard to extend it out to things flying back and forth to the user.

As for usability, these sort of things should be wrapped up in a nice container class; HMAC taken care of, and (probably) a key-value API presented. No fuss, no muss.

If there's no such library, creating one could definitely pose a security risk to any project without sufficient expertise, as this post appears to be endorsing.

Find an existing, tested, reviewed implementation that provides the API you need, and stick with it.

This is quite bogus.

Competition is a very real, and very lucrative phenomenon.

A famous & classic counter-example of how being more competitive than your peers wins out is Toyota.

Toyota won out in the 80s and 90s because their cars were priced more competitively, and were of a higher quality. They didn't make fundamentally different products, they just did it better.

One company practically euthanised both the US and the UK's car manufacturing industry, by producing the same product better.

Similarly, Google did web search, just like Ask Jeeves, AltaVista, Yahoo! They became dominant by doing it better -- by offering better results, faster, and therefore out-competing their peers.

For yet another example, take Apple's return to fame. They did it by taking the portable music player, something ostensibly already done by Sony and Creative, and making it significantly better than their competitors. They also sold an image to go with it, but competing on terms of marketing could be considered a valid competition strategy.

Consider Tesla; although the story isn't played out yet, Tesla is looking strong. Not because they provide electric cars (though that helps), but because the cars they provide are more economical, comfortable, safe, and so on.

Ironically, one of Theil's own businesses is a counter-example to his own claim: PayPal. We could already get money from one person to another, or from ourselves to merchants. PayPal just did it better, and therefore out-competed the banks for consumer and SME money transfers.

Time and again, businesses win, not by being the first in the field; but by looking at an existing field critically, and considering how to improve it. They then enter the field and out-compete the incumbents, beating them at their own game.

Books, especially the kind with exercises at the _end_ of each chapter/section.

I would highly recommend reading:

  - A Course of Pure Mathematics (G. H. Hardy). I read this before I started my undergrad in CS/Maths. Free Online.
  - University Calculus (Hass, et. al.). This was reading for my first year, and continued to be useful throughout. Expensive.
  - A Book of Abstract Algebra (Charles C. Pinter). I read this after my degree, but boy, do I wish I'd had it _during_ my degree. Fairly cheap.
  - Linear Algebra Done Right (Sheldon Axler). Moderately priced.

I can't remember which of the texts I had on Number Theory were good at this point, but I do remember that it was quite hard to locate one which was tractable. There's a whole heap of fields which I chose to avoid (woo for joint degree!) but now I kinda regret it -- although I wouldn't have easily given up any of the comp. sci. modules I did...

I would always recommend working through Hardy first, regardless of what else you do.

I don't know of any good websites for this stuff. You may be able to find reading lists on public-facing university module/course web pages, which will help bolster this list.

It may be cheaper to buy access to your local uni's library than try to buy all of the above books. The uni I attended is around £70 a year for a non-student.

Your best bet is to get a notebook and the book that interests you most and work through that book, then the next, and so on. If you get stuck, as someone with a maths degree what the heck's going on :-p

If you can't find a product below that suits you below, MIT OCW has a course on advanced data structures which covers this, they're know as persistent data structures, and the lectures on them are very informative.

Edit: The lectures: http://ocw.mit.edu/courses/electrical-engineering-and-comput...

I agree that the UK Student tech scene is quite disconnected.

There are quite a few computer science oriented student societies. For instance, at York (where I did my undergrad) there's HackSoc. There's an IRC channel somewhere on freenode with computer science societies from the uk. We're not completely disconnected, but we're slowly growing to the point that we can start collaborating and having friendly competitions.