benmmurphy

Part of the problem with BEAM is it doesn't have great ways of dealing with concurrency beyond gen_server (effectively a mutex) and ETS tables (https://www.erlang.org/doc/apps/stdlib/ets). So I think usually the solution would be to use ETS if its possible which is kind of like a ConcurrentHashMap in other languages or to shard or replicate the shared state so it can be accessed in parallel. For read only data that does not change very often the BEAM also has persistent term (https://www.erlang.org/doc/apps/erts/persistent_term.html).

this can easily happen in a BEAM system. say you have some shared state you want to access. you create a gen_server to protect this shared state. a gen_server is basically a huge mutex. the gen_server is just a normal beam process that handles requests sent to its message queue and then sends a reply message back. lets say it can process a request normally in 20us. so a 15ms pause would stack up 750 messages in its message queue. now maybe this is not enough to generate a huge outage on its own but maybe as part of your handling you are using the message queue in an unsafe way. so when you check the message queue for a message the BEAM will just search the whole message queue for a message that matches. there are certain patterns the BEAM is able to optimize to prevent the whole message queue being searched (i think almost every pattern is unsafe and the BEAM only optimizes the gen rpc style message patterns) . but if you are using an unsafe pattern when you have a message queue backlog it will destroy the throughput in the system because the time taken to process a message is a function of the message queue length and the message queue length becomes a function of how long it takes to process a message.

Also, the great thing is you might not even have an explicit `receive` statement in your gen_server code. You might just be using a library that is using a `receive` somewhere that is unsafe with a large message queue and now you are burned. The BEAM also added some alternative message queue thing so you are able to use this instead of the main message queue of a process which should be a lot safer but I think a lot of libraries still do not use this. This alternative is 'alias' (https://www.erlang.org/doc/system/ref_man_processes.html#pro...) which does something slightly different from what I thought which is to protect the queue from 'lost' messages. Without aliases 'timeouts' can end up causing the process message queue to be polluted with messages that are no longer being waited on. This can lead to the same problems with large message queues causing throughput of a process to drop. However, usually long lived processes will have a loop that handles messages in the queue.

there is also some weirdness or used to be some weirdness with linux and modifying shared libraries. for example if you have a process is using a shared library and the contents of the file is modified (same inode) then what behaviour is expected? i think there are two main problems

1) pages from the shared library are lazily loaded into memory so if you try and access a new page you are going to get it from the new binary which is likely to cause problems

2) pages from the shared library might be 'swapped' back to disk due to memory pressure. not sure whether the pager will just throw the page away and try to swap back in from disk from the new file contents or if it will notice the disk page is dirty and use the swap for write back to preserve the original page.

also, i remember it used to be possible to trigger some error if you tried to open a shared library for writing while it was in use but I can't seem to trigger that error anymore.

Is the problem with LLMs and Rust really a problem with the training data or a problem with it being harder to get something to compile in Rust? I presume its easier to get something to compile in the dynamically typed languages, and then slightly more difficult in statically typed languages and then a step up with Rust which also forces you to deal with the lifetime of objects. But maybe with LLMs its different and they can do static typing easier than dynamic but they just really struggle with structuring a program to properly deal with ownership.

you could have failures in unsafe regions you have written yourself to handle concurrency when under load. of course this begs the question why are you writing such unsafe code. i don't think such code would be idiomatic for an engineer with 5 years of rust experience to write. of course there is no links to the full code so its impossible to check the code.

how is combinations O(n)? for n choose 3 generating combinations is going to approach n^3 since the formula is basically (n * n * n) / constant and for sumToAny generating all the combinations is 2^n.

They shouldn't be able to do this to a US citizen on landing based on his first amendment speech. The important thing here is landing because he really has missed his chance to commit a terror. I guess theoretically you could do something bad in the airport but it would seem to make more sense to do something bad on the airplane if you had the opportunity. However, I have seen a tweet where he is complaining about extra attention at Charles de Gaulle [https://x.com/hasanthehun/status/1921511816888242297] and that shouldn't be really surprising. A lot of airport security is ass covering and if someone who has expressed support for a terrorist organization goes on to commit a terror then you are going to wish you did the ass covering. This is not argument that the extra attention is rational based on the probabilities just the way the incentives are going to work.

I’ve seen banks where the OTP code is generated on the client and then sent to the server.

The two things you are talking about are very different. One is signatures and one is encryption.

the closest you can get to what you want is a trusted third party who would help derive the final key. so the key could not be revealed to law enforcement without cooperation of the trusted third party who would verify policies like time, etc. it may also be possible to have the 'trusted third party' be a piece of tamper proof hardware. i think generally people are suspicious of these schemes because it relies on 'trust'.

also, i think apple has a scheme similar to this for protecting the passcode from being brute forced when recovering from iCloud backup. however, if this scheme breaks it doesn't reveal the encryption key i believe it just allows the passcode that protects the encryption key to be brute forced which I guess may or may not result in the encryption key being revealed.

You still have to be careful with supervision trees and parts of the tree restarting. For example your system might work if the whole erlang operating system process is suddenly killed and restarted but your system might start corrupting data if parts of the erlang process tree is restarted. Erlang gives you a good model to work with these problems but it doesn't allow you to completely turn off your brain. If you walk in thinking that you can just let things restart and everything will be fine then you might end up getting burnt.

from the point of maximising value in the economy its a game where in a single iteration co-operate is strictly better than any alternative. if the other player co-operates then that is the best outcome. if the other player defects then you are still better off co-operating than defecting.

but the problem is the real game being played is different because the political process ends up diverging from maximising value in the economy. the free trade argument is this is because the political process is captured by concentrated interests who benefit from tariffs to reduce competition. the deadweight loss caused by tariffs to the rest of society is not properly accounted for in the political process because the cost is diffused over many people. other people who accept the text book comparative advantage argument but reject free trade will claim to have a different optimisation function that is not purely maximising value in the economy. for example maybe they think its important to have a strong manufacturing base in order to make it easier to re-arm to fight a conflict.

but if we accept this situation then its difficult to say what the optimal strategy is because you don't really know the payoff matrices for the players. even what they tell you could be a lie and might be difficult to derive what their values are based on their actions.

Some of it looks like 'small town' style intimidation where the group in control of the governing bodies will use law enforcement to intimidate anyone that might bring them embarrassment or threaten their power. The article even mentions a case where this happened:

> Maxie Allen, 50, and Rosalind Levine, 46, were questioned on suspicion of harassment, malicious communications and causing a nuisance on school property. After a five-week investigation, the police concluded that there should be no further action.

> A police officer also said that elected officials could be treated as harassment suspects if they continued advocating for the couple.

> Andy Prophet, chief constable of Hertfordshire, defended the arrests, saying that the force had given warnings and they were lawful, although he conceded that “with the benefit of hindsight we could have achieved the same ends in a different way”.

I thought runners were also using creatine but I can only find discussion around this for amateurs online. I'm not sure if professional runners are using it. It would be interesting to know if professionals are using it because as far as I'm aware it is not a banned substance and presumably if it had a benefit they would be using it. But maybe I'm just bad at googling because I found this article that claimed 80% of athletes at the Atlanta Olympics were using creatine (https://runmrrun.com/creatine-for-running/). Though, this page seems to be trying to sell creatine supplements so maybe should be taken with a bit of skepticism.

US citizens do have a right to listen to the opinions of others under the first amendment so if the US government does have a visa program then it needs to be run in a way that is viewpoint neutral. so the US government can't revoke the visa's of people who have controversial opinions. of course the funny thing is being lectured about this by people from Europe or other countries like NZ, AU, CA or UK where it is common place for the government to revoke or deny visas for people who have the wrong opinions.

I think these lawsuits with large damages against media companies are going in a bad direction. But this also includes the lawsuit against Alex Jones and the Covington kids lawsuit but I don't think you will find many people that have some kind of consistent principal when dealing with this. They will just have some magic rule that will mean the law suit against Alex Jones is good and Trump's law suit is bad or vice versa. There is even a similar thing going with this list of 1A violations from the current administration. Similar things went on with the last administration but I didn't see a Kreb's summary post but maybe I missed it.

1) is possible because it uses some interesting options like nice/mlockall/changing its oom score so if the atop process went out of control your box would probably be fucked.

this seems similar to the alex jones decision. these large defamation suits threaten the first amendment. i'm sure partisans on both sides will have some excuse why one of these suits is fine and the other is terrible.

I guess for computationally expensive things the only real option is to put it behind a login. I’m sure this is something SourceHut doesn’t want to do but maybe it’s their only decent option.

They mentioned PAM module so maybe the sql injection just allowed bypassing the authorization of a system that was using the PAM module. Like it’s in the realm of possibility that a PAM module that wanted to validate a user against credentials stored in a pg database might shell out to the psql command to do this. Though, the whole thing is very questionable.

python does have pointers under the hood. objects are passed via pointers. i think the implementation is tagged values in order to support dynamic typing and passing non-pointer values efficiently. but if there was no object tagging the runtime would be very similar to go. both have objects passed around as pointers using some form of garbage collection to handle memory safety.

the optional static type checking in python gives you a stronger typing than what golang does because you don't have to type everything as (None | Foo) and presumably its a type error to perform Foo operations on a (None | Foo) type.

There are allegations that the Perkins and Coie firm abused their access to a SCIF in order to make unauthorised queries targeting Trump campaign members during the run up to the 2016 election.

The full text of the executive order is available here: https://www.whitehouse.gov/presidential-actions/2025/03/addr... and mentions removing access to a SCIF:

> The Office of Management and Budget shall identify all Government goods, property, material, and services, including Sensitive Compartmented Information Facilities, provided for the benefit of Perkins Coie. The heads of all agencies providing such material or services shall, to the extent permitted by law, expeditiously cease such provision.

It has also been publicly documented from court transcripts that contractors were making unauthorised queries but I don't believe it has ever been released who the contractors were or who they were targeting. Hopefully, if this is the reason for removing SCIF access the current government is able to make these documents public without redaction. Though, the whole thing could just be a conspiracy theory generated by people piecing together bits of random information.

I don’t think there is a difference between go pointers and references in python. For normal pointers to structs at runtime I suspect the implementation is very similar. Maybe it’s different for typescript because the compiler can protect you from null references statically and I assume if you are using python types the python type checker can also protect you at compile time.

Employee NICs and employer NICs are effectively the same thing, they just have different names. Your employer has a bucket of money to pay employees with. Some of this money is given to the government and some of this money is given to their employees. Saying the money given to the government is on behalf of the employee or the employer is mostly irrelevant. There are cases where it is relevant if the employee or employer can get tax refunds against the money but mostly it is irrelevant. Who actually pays the burden of tax is a question of tax incidence (https://en.wikipedia.org/wiki/Tax_incidence). In theory the burden of income taxes could even be falling on your employer. But it is very likely that most of the burden of income taxes/payroll taxes falls on the employee. But if you are doing cross-country comparisons its much easier to just total up all taxes related to employment in one bucket and compare them under the assumption the incidence burden would be similar across different countries.

the UK has a 20% VAT as well. I don't think the person you were replying to was taking that into account. Also, they are probably not taking into account employer NICs which are effectively the same in terms of tax incidence as employee NICs but people incorrectly treat them differently because the employer nominally pays them. But if you think about it for a second, your employer makes two payments to the government one of them is called employee NICs and one of them is called employer NICs and both of them are based on the employee's wage so it is silly to treat them differently. Though, I'm guessing Canada probably has employer payroll taxes as well. Employer NICS can get up to almost 14% so it is a significant tax in the UK.

1.5 billion over 15 plaintiffs does seem high. i was under the assumption a wrongful death would not reach 100 million often. so its kind of questionable that is he is paying out an average of 100 million per plaintiff for the torts he was found liable for.

its always the same its just what is considered conformist is pivoting at the moment. the reason these contrarian/independent thinkers were valued were because they were really conformist. but they will be truly contrarian and independent once the pivot is over but then they won't be valued.

I guess it depends how much of this is running on the device, and how much is running off the device. If its all running on the device then it might be possible for someone to inspect what exactly is going on. If important parts are running off the device then those parts will be a black box.

you can expect a country that is controlled by its people voting to be a bit schizo to some degree when it comes to treaties. surely, you cannot expect something that is meant to have large effects on domestic policy like the Paris climate accord to be stable in the US when there is a lot of difference of opinion domestically over it.

is there a supplement available that has links or screenshots to the posts that were part of the study?