HNHacker News
TopNewBestAskShowJobs

anaphor

2,594 karma · joined August 15, 2013

You can email me at wes /AT/ wesk.tech
submissionscomments
anaphor··on JWT should not be your default for sessions
The most promising things I know of are Google Fuchsia (which is a mobile OS), and Goblins, which is a Scheme library for doing distributed programming. There is something called Realms which is being worked on for JS, but I haven't dug into it too deeply yet. It might provide a good foundation for building ocaps into the browser, though.

https://github.com/tc39/proposal-realms

https://en.wikipedia.org/wiki/Google_Fuchsia

https://docs.racket-lang.org/goblins/index.html

anaphor··on JWT should not be your default for sessions
I guess it depends on how you use it yeah, like the token can be used to refer to a specific resource, which is then granted to whoever has the token. But obviously you can just treat them as a way of doing traditional identity based access control if you want, which isn't the most effective way of using them. JWTs don't let you easily revoke them, or narrow access to specific resources. That's something you have to do yourself, or rely on a library to do, but that would be built into an ocap based system.
anaphor··on JWT should not be your default for sessions
No, you're not wrong. But I would go further and say JWTs should be obsoleted by using an object-capability model (see: http://habitatchronicles.com/2017/05/what-are-capabilities/ ) which is a more fleshed out way of using unique unforgeable "tokens" to access things. The ocap model is tailor made to solve the problem that CSRF is an instance of (confused deputy attacks).
anaphor··on Kaspersky believes it found new CIA malware
There's a difference between them telling what they think is the truth, and them actually knowing something and telling it. The whole "Havana Syndrome" thing might actually be them telling what they think is the truth (Russian/Cuban conspiracy to use secret weapons to give headaches to people), even though it's complete nonsense.
anaphor··on SPAs Are Dead?
You seem to be unaware of the existence of capability based security. https://en.wikipedia.org/wiki/Capability-based_security
anaphor··on SPAs Are Dead?
I think some people don't realize that CSRF tokens are basically the same thing as bearer tokens (which JWT also does), but it's just that they get re-generated every time you open a new page usually. So it's a bit ironic when everyone screams that tokens are bad, but they're all using them to protect against confused deputy attacks.
anaphor··on Et Tu, Signal?
There is already a fork, it's called Session, but it's decentralized, so there's no requirement for servers to be stood up other than introducer nodes AFAIK. https://getsession.org/
anaphor··on Douglas Adams' note to self reveals author found writing torture
The headline of this article is a garden path for me too, because at first I thought they discovered a book he wrote on torture or something.
anaphor··on Goldman Sachs Working Conditions Survey
That's around the same number of hours that the average medical resident works apparently (source: https://www.cmaj.ca/content/191/39/E1086)
anaphor··on HTTPWTF
You're not making a mistake, they just don't give an interesting response to this type of request. The only server I know of that actually uses it for something is Icecast (a music streaming server).
anaphor··on HTTPWTF
Another one is that it's technically valid to have a request target of '*' for the HTTP OPTIONS request type. It's supposed to return general information about the whole server. You can try it out with e.g. `curl -XOPTIONS http://google.com --request-target '*'`

Nginx gives you a 400 Bad Request response, Apache does nothing, and other servers vary in whether they return a non-error code.

https://curl.se/mail/lib-2016-08/0167.html

https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

anaphor··on Myths about how the brain works
And it's also the case that even though certain brain functions are linked with specific locations, the brain can still use plasticity to re-organize things and adapt to damage. And when you're doing any language related task, there are always going to be other more domain-general brain functions involved too, which aren't as localized.
anaphor··on Myths about how the brain works
Usually the right hemisphere is linked with comprehending speech/writing, rather than producing it, so it's interesting that you lose the ability to write. Is your speech affected at all? It could be because writing involves a bunch of other more domain-general brain functions too I guess.
anaphor··on Myths about how the brain works
Obviously you know this, but the brain does localize some functions to either hemisphere, just not in the way most people think it does. My vague memory from having taken a class in psycholinguistics is that people with aphasia who've had some part of their brain damaged are good evidence of this localization.

https://en.wikipedia.org/wiki/Wernicke%27s_area https://en.wikipedia.org/wiki/Broca%27s_area

anaphor··on ClickHouse as an alternative to Elasticsearch for log storage and analysis
You might be able to just put whatever you want into an Elasticsearch index, but I wouldn't recommend doing that. It could severely limit how you can query your data later, see: https://www.elastic.co/guide/en/elasticsearch/reference/curr...

Also it can cause performance problems if you have really heterogeneous data with lots of different fields https://www.elastic.co/guide/en/elasticsearch/reference/curr...

anaphor··on Are You Trading or Gambling?
Why has the S&P 500, Russell 2k, etc all gone up over the past 20 years on average then?
anaphor··on Mypyc: Compile type-annotated Python to C
We can have a compiler that does everything. It's just a matter of whether you have to stick the python interpreter in the compiled binary or not, or how much of it you have to use and whether you can only use the parts required. This is how a lot of Scheme compilers work, even though you still have `eval` and similar things.
anaphor··on How Antidepressants Work, at Last?
I linked to a paper published and written by several psychiatrists and psychologists that explains the history of the monoamine hypothesis, and why it's not a good theory. Why would they spend so much time debunking a theory nobody believes?

Quoting directly from the article

> Despite decades of research, the role serotonin plays in depressive phenotypes has not been conclusively determined. The original clue that monoamines (serotonin, norepinephrine, and dopamine) were involved in depression came from two serendipitous discoveries (Baumeister et al., 2003; Valenstein, 1998). First, during the investigations of iproniazid as a treatment for tuberculosis and imipramine as a treatment for schizophrenia, clinicians reported that these drugs could reduce depressive symptoms. An effort was then made to find a common pharmacological property that could explain their antidepressant effect. Eventually, researchers found that iproniazid inhibits the enzymes that break down the monoamines, while imipramine blocks the serotonin transporter (SERT) and the norepinephrine transporter (NET). Second, clinical observations suggested that reserpine, a drug known to deplete monoamines, increased depressive symptoms. These findings appeared to solve the puzzle. By preventing the breakdown of norepinephrine and serotonin, or preventing their clearance from the synapse, iproniazid and imipramine appeared to increase forebrain monoamine levels.

> The monoamine-enhancing effect of antidepressant medications (ADMs), coupled with the depression-inducing effects of reserpine, suggested that depression was caused by reduced monoamine neurotransmission (Everett and Toman, 1959; Jacobsen, 1964; Schildkraut, 1965)

https://sci-hub.st/https://www.sciencedirect.com/science/art...

Additionaly, this is something that lots of undergraduate psychology textbooks still mention as a potential explanation (one of mine did ~6 or 7 years ago, although at least they said that it was an implausible theory).

anaphor··on How Antidepressants Work, at Last?
There's a quotation from Abraham Maslow that I really like, which I think is similar to your point.

> I am deliberately rejecting our present easy distinction between sickness and health, at least as far as surface symptoms are concerned. Does sickness mean having symptoms? I maintain now that sickness might consist of not having symptoms when you should. Does health mean being symptom-free? I deny it. Which of the Nazis at Auschwitz or Dachau were healthy? Those with a stricken conscience or those with a nice, clear, happy conscience? Was it possible for a profoundly human person not to feel conflict, suffering, depression, rage, etc.? In a word if you tell me you have a personality problem, I am not certain until I know you better whether to say "Good" or "I'm sorry". It depends on the reasons. And these, it seems, may be bad reasons, or they may be good reasons.

https://en.wikiquote.org/wiki/Abraham_Maslow

anaphor··on How Antidepressants Work, at Last?
I'm not saying there isn't a biochemical component to depression (or any other mood disorders). The specific theory that I'm talking about is "low serotonin causes depression" (as in the proximate cause, not the ultimate cause). When SSRIs were first discovered to be useful for treating depression, one of the theories about why they worked was that they boosted levels of serotonin, but we know now that's not true. It doesn't mean it can't be explained in other ways (like the one this article discusses).

Also, if there is a behavioral component to depression as well, then it doesn't necessarily mean someone is to blame for their disorder. You don't control the environment you grow up in, which has an enormous impact even on traits that are highly heritable (the whole subject of heritability is very misunderstood anyway).

So basically if I were going to describe depression's cause, I'd say it's a mixture of biochemical reactions, behavioural traits, and environmental stresses that cause it.

anaphor··on How Antidepressants Work, at Last?
It's been a persistent myth perpetuated in the media/journalism/society/etc for a few decades, but there is a lot of scientific evidence showing that it doesn't really explain how depression works, and the fact that SSRIs boost serotonin doesn't explain why they work as a treatment. See https://sci-hub.st/https://www.sciencedirect.com/science/art... for example.
anaphor··on How Antidepressants Work, at Last?
It used to be the case that the theory for why people have depression was "people who are depressed don't have enough serotonin" (in very simple terms), and the reason why SSRIs work was supposed to be that they increase levels of serotonin, but scientists have found that boosting levels of serotonin alone does not help with depression.

Here's a good journal article on the subject https://sci-hub.st/https://www.sciencedirect.com/science/art...

anaphor··on How Antidepressants Work, at Last?
Will this make the "chemical imbalance" (i.e. low-serotonin) theory of depression obsolete once and for all?
anaphor··on Write a Shell in C
FWIW, instead of `*buffer = malloc(n * sizeof(*buffer))` you can omit the extra parens and write `*buffer = malloc(n * sizeof *buffer)`

also, calloc is a nice idea too

anaphor··on The largest study to date on the genetic basis of sexuality (2019)
Not disagreeing with your original point, just adding that if you were controlling for environmental factors (everyone has equivalent environment), then you'd see more contribution to variance in phenotypes from genetics than environment. So for homosexuality, I'd bet the reason genetics don't contribute as much is because of the heterogeneous environmental conditions (just think about where you grow up and what religion you are for example).

Edit: a good example of this in action is handedness, because different societies historically have different advantages to using different hands

> Second, the samples used to estimate the handedness heritability were from different places, different years or different centuries and were not always representative of the general population. Heritability is not an intrinsic property of a trait: it varies with phenotypic and additive genetic variances and thus can vary across populations and across generations

https://www.nature.com/articles/s41437-019-0274-3

anaphor··on The largest study to date on the genetic basis of sexuality (2019)
No, it just means that within the population they studied, the variation in whether individuals identified as gay could be explained more with environmental factors than genetic ones. It doesn't say that being gay is 25% genetic and 75% environmental, that's a huge misconception. If parents all treated their kids the same way, and they all had the same treatment in schools, etc, then you'd probably see more influence of genetics than environment. That's how heritability works, it's relative to the population and how homogeneous it is.
anaphor··on The largest study to date on the genetic basis of sexuality (2019)
Remember that heritability is a measure of a population, not an individual. So you're measuring the amount that genes vs environment contributes to a trait within that population. It's not an absolute number.
anaphor··on Naked shorting: The curious incident of the shares that didn't exist (2005)
The numbers you're looking at are aggregate data, so that includes past days I think, not just the given day. I think you have to subtract each number from the previous one.

> The figure is not a daily amount of fails, but a combined figure that includes both new fails on the reporting day as well as existing fails

anaphor··on Naked shorting: The curious incident of the shares that didn't exist (2005)
If you look at the SEC data on FTDs, there have been a huge number of them for GME in the past year https://www.sec.gov/data/foiadocsfailsdatahtm

So that kind of points towards a possibility of naked shorts, if I understand correctly (although by itself it doesn't prove it's happening).

anaphor··on Naked shorting: The curious incident of the shares that didn't exist (2005)
Thanks, maybe a mod can edit the url in the original post?
← PreviousPage 2 of 26Next →