1,077 karma · joined July 7, 2015
In case that renders as a link by Hacker News, I've added a space here and removed the https part:
en.wikipedia.org/wiki/Olbers%27_paradox #:~:text=In%20astrophysics%20and%20physical%20cosmology,infinite%20and%20eternal%20static%20universe.
What it does is that it highlights that text in the page, with a yellow background color. Making the rest of the text difficult to read (your eyes are drawn to the very yellow highlighted part).
I would definitely not wear 500-600 USD headphones in any of those areas.
But I think crime in Stockholm is a bit off topic. However I don't think the inherent risk of being robbed - wherever you are in the world - is off topic for the discussion.
People rob kids of Airpods all the time, because it's a status item. These new Airpods will be a status item too. This will increase the risk of robbery - be it in Europe or the US or elsewhere.
I'm sure there are larger cities in the world where the likelihood of getting robbed is low (Tokyo?), but that'd be the exception rather than the norm.
I never really understood the combination of noise cancellation and home use only. I think noise cancellation really shines when out and about in public, like the subway. But I can't imagine anyone using those things on the go, at least not where I live.
Finglass is a litte bit of a "celebrity" in 21st century classical studies: his works on for example Sophocles are very highly praised, and I have strong reasons to believe that his Sappho will be really good.
The comments here on Hacker News seem to have tripped on the examples given (keywords: politicians, journalists) and turned this into the more generic and politically loaded discussion whether it's desirable to "cryptographically verify" what politicians write.
But that's not the point! The point is that DKIM is technically not designed for this use case and the way people misuse DKIM for this unintended purpose is highly problematic from a cryptographic and engineering perspective.
I think the best way to think of DKIM is that it's a "cryptographic protocol" in the sense that git is a "cryptographic protocol" because it uses SHA1. If you think "PGP" (not the best example :-)) or "Telegram" you have the wrong idea: DKIM is a bunch of cryptographic primitives haphazardly bolted on email to solve a specific problem. It's not good cryptographic design because good cryptographic design anticipates unintended usecases and deal with them appropriately.
1) Read the DKIM RFC.
First of all the only field that it's required to sign is the From: header (see RFC, section 5.4). So you could still forge an email but have it pass a DKIM signature check.
If people believe that DKIM "cryptographically signs" e-mails in the sense of PGP, then that's a problem, because that's not true. A DKIM signed email doesn't actually say anything: you have to look at the signature which part of the message are signed, which is not standardized.
So you could have this situation when people, like journalists or even people on Hacker News, think a forged email is valid because it has a valid DKIM signature (but the signature is over the From: header only). E-mail is complicated as it is without having to explain to people who have binary classified an email as "forgery" or "not forgery" based on a specific combination of email-headers and DKIM signature specification. Let's not do that.
2) Look at what mail providers actually do with their DKIM keys.
For legacy reasons due to DNS providers and length of TXT records, many large internet providers use DKIM keys that are 1024 bit RSA.
Already 10 years ago, most standard bodies started to recommend against the use of 1024 bit RSA. It's deprecated. Like MD5-deprecated.
The fact that many service providers use the same key for all emails for all customers and reuse that key for years, increasing the likelihood of the key being leaked, is another case against trusting DKIM for this purpose.
Unfortunately I share your same statistics: I was very active in the early 2010:s and in that period I lost about 10 friends/acquaintances. Since then even more people I've hung out with are gone.
So yeah: wingsuiting is dangerous. But BASE itself can be done "reasonably" safely I think: personally I was always more fond of slider down (low) stuff, like buildings, and in my mind that's a safer sport than wingsuit BASE.
As a Swedish/Finnish man (and a somewhat stereotypical nerd at that), I'm paler than probably 95% of the world population.
Although facial recognition features (in the sense of trained AI models) often work fine on me given a good quality underlying photo, what often fails instead are preprocessing steps or color correction, especially in real-time systems. This can be the camera itself or software handling the image later.
For example if I'm in a Google Hangout in a normally lit room and then I move into slight sunlight or a lamp, my face will overexpose into a blob that looks like a low quality photo of the sun. It renders white, like #ffffff proper white. It's not actually overexposed at the hardware/camera level, but the software "corrects" it that way.
This typically never happens to other people.
> Malleability. We also see no relevance of “malleability” to the standard definition of signature security. For example, if we slightly modified the system then replacing S by −S and replacing A by −A (a slight variant of the “attack” of [75]) would convert one valid signature into another valid signature of the same message under a new public key; but it would still not accomplish the attacker’s goal, namely to forge a signature on a new message under a target public key. One such modification would be to omit A from the hashing; another such modification would be to have A encode only |A|, rather than A.
They key here is the second half of the paragraph: "it would still not accomplish the attacker’s goal, namely to forge a signature on a new message under a target public key".
Similarly how the design doesn't see a problem with malleability in the sense of converting one valid signature into another valid signature, It seems to me it was never a design goal of Ed25519 to begin with to strictly define the set of valid (and invalid) signatures.
This is why cryptography is difficult, because it's easy to use a primitive in a complex system and assume things about the primitives that possibly make them unsuited for the system developed.
So he died from hypokalemia and other reasons, but the main (or only) reason for his hypokalemia was the licorice habit. I think this is a good example when it's both correct and not correct to say that the licorice "caused" the death.
Contrast with two examples on the two extremes:
Consider a situation when he had instead of licorice had ingested some obviously known poison: then I think it's a much more valid statement to say that "man dies from eating poison", because the idea of the poison and the idea of death are very close together.
Consider a different situation where the man was smoking one pack of cigarettes _per month_ or _per year_. Then it's not as obvious to say "man dies from smoking". The smoking probably contributed to the death in various complex ways.
So you could say that "man dies due from hypokalemia due to excessive licorice consumption not counterbalanced by having an otherwise healthy diet" which is possibly more nuanced, and possibly more (or less) helpful depending on what your purpose is to clarify or simplify things.
Thanks for sharing this article, I find this a good and fairly apolitical educational example that I can use when talking about complex causal relations in the future: how cause and effect can be conflated in both positive and negative ways depending on who you are talking to, what you are talking about, and what the purpose of the discussion is.
I think the only gotcha is to handle the last block read in step 1 in case it's not evenly 1 kiB. Otherwise the first read in step 3 will overlap the blocks.
The past 10 years I've often been the first employee - or one of the first - joining or building up the company's security organization. The combination of (1) having a specialist skill and (2) being around very few other people with the same skill, naturally leads to a situation where too much clarity can be a bad thing. If a non-specialist define a security role, they will probably screw it up. And that's okay.
If you've worked in startups long enough you eventually get a lot of experience in how to hire people whose expertise you do not understand. As an employer and employee I enjoy the collaborative process of defining the role around the candidates strengths and weaknesses.
You need to understand that Swedish culture is really unhealthy right now and I ask all of you - I plead to you - as a Swede, to please stop giving Swedish policy attention so we can, on our own, solve our problems and get back to some kind of normalcy and humbleness.
What has happened the past 30+ years and has become really problematic the past 10 years is that Sweden has this extremely unhealthy culture of believing in Swedish exceptionalism while at the same time craving attention from other nations, and promoting this belief socially. While the Swedish Corona strategy is not explicitly designed to be contrarian at the world stage (and therefor get a lot of attention), the way Swedish mono-culture works is that the people who implement policy (as well as many citizens) chauvinistically and subconsciously believe that Sweden is somehow superior to other nations and at the same time believe that Sweden (as an exceptional country) has something to teach inferior countries (i.e all other countries).
So where we are right now is that we have this unhealthy feedback loop where Sweden initially did it's own thing, and as it turned out to be different that has been a signal to policy makers that Sweden is right. Because Sweden is exceptional, so if the policy is different from inferior countries (i.e all other countries), it must be right.
I wish, probably more than anything else, that other countries would just stop giving Swedish policy makers this attention because then maybe, hopefully, our politicians can start to do what's right for our citizens instead of what gets attention and talking points at the world stage.
This is far broader than Corona: Sweden gets way too much attention overall, because Swedish politicians and government communication employees have nailed "marketing" more than anything else. They crave this attention and they manufacture policy to get attention, at the expense of the people who live in the country. Often under the guise of marketing Sweden as a "moral super power", superior to other nations.
So please, if you are for example a left leaning American, please don't use Sweden as a political piece. Don't give our politicians this attention. There are many other countries that deserve attention but they deserve attention because they do The Right Thing. Like Denmark. Not like Sweden that fucks things up but enjoy the attention it gets when doing so, citizens be damned.
I'm currently learning ancient Greek as my "Corona project": purely for fun, and mainly because I'm interested in Greek philosophy and culture.
That said, I feel a bit lonely in my country in pursuing this. Sweden has no strong history of classical studies. Some high schools may offer a course in latin, but it's getting more and more rare, and as far as I know there are not even courses in university because the interest is too low. I don't know anyone and I don't know _of_ anyone in Sweden who actually reads/knows the language.
When I talk to friends in the US, the UK and the Netherlands on the other hand, Greek and the classical Greek works (including Homer, of course) seems to be much more popular and also part of normal young adult education. One of my friends, an American in his late 20:s, had to read the Odessey in high school. My fiance from the Netherlands was offered either latin or greek in high school as well. Most of my textbooks in greek are written by American, English and Dutch authors. So these nations seem to have a stronger tradition in classics.
Can anyone care to elaborate the situation where you live? I'm very curious what motivates people to learn dead languages and read books thousands years old.
Under the heading is a small shell script that will download the old debs for you. Note that for it to work and not have wget spam 404:s, you have to update the entire GRUB2_LP_URL and GRUB2_SIGNED_LP_URL to the links in the little table. At first glance it looks like you only have to change GRUB2_VERSION and GRUB2_SIGNED_VERSION.
What you are really saying here that public officials should only be allowed to publish on approved enterprise communications systems that has the budget to pay for compliance certifications.
I think Facebook and Twitter would love this kind of regulatory capture because it would cement their position, hindering startups from taking over in their space (which, we know, is prone to being out-innovated every 5 years or so).
Having worked professionally in information security for a while now, let me tell you these kinds of certificates mean very little for actual security.
Having read over half of those books, the only one I would ever come back to and read again and again with a smile on my face and a feeling of childlike wonder and intellectual curiosity is SICP (number 18).
When Google posted the Project Zero articles, that did not impact my view of Apple in any way. However this press piece affects my view of Apple negatively, so from my perspective this press article has turned a more or less neutral event into one that is negative.
For someone that just want to get a foot in the industry and be useful in some real world scenarios (where knowledge of the most common problems will probably be enough to find real problems) I think this article is a useful resource. But in the long term you will be better and more valuable to skip security resources most of the time and instead go deep in a wide set of areas.
To the stoics themselves, wealth and power are indifferent: neither good or bad.
I say that the title is provocative because wealth and power often provoke people, as can be seen in this very discussion (here on Hacker News). Depending on where you come from and where you are in life, a phrase such as "rich and powerful" may call forth the negative stereotype of evil wealthy people, or it may call forth the positive stereotype of Hacker News style entrepreneurs.
It is much easier to be indifferent to wealth and power if you already have it.
My take on the supposed rise in popularity of stoicism is not that it appeals to the "rich and powerful" per se. I do however think it appeals to people who have found themselves in a situation when they no longer have obvious things to live for, which is certainly the case for these people.
If you suddenly find yourself with free time and autonomy, philosophy is a pretty good thing to fill the void with, I think.
As everything else in life its priority and effort mixed in with a bit of affinity. Not everyone want to put in the effort and time to become top tier in their profession: those who do obviously become better than those who don't.
There are many fundamental issues that can only be solved by very unpopular political decisions, meaning nothing is done because it would be political suicide in the short/mid-term (the next 4-8 years).
1) While the Swedish state has strong finances, the Swedish communes (responsible for most of the practical welfare, like healthcare, education, and so on) are struggling significantly. Taxes likely need to be raised 5 percentage points over the next 10 years just to maintain the current level of welfare. And that is not factoring in the missing professionals, like teachers and nurses. These professions are very poorly compensated so a lot of them quit. On top of the issues with the communes, the Swedish households are among the most indebted in the world, due to cheap mortgages on houses and a housing bubble that is just slowly beginning to deflate. The next recession will be very tough.
2) Sweden has failed with immigrating all low-skilled refugees and economic migrants from third world countries. I think Sweden should be applauded for trying to do the humanitarian thing by helping people in need, but what has happened is that there have been too many low skilled people, too quickly for them to be absorbed into Sweden. This cohort of immigrants simply do not have the skills or education to not be an economic burden on the Swedish society. The costs are enormous. In Sweden the talk is about we've created an "ethnic lower class" that can only survive on welfare. The problem is a welfare state only works if a vast majority pitch in to the welfare state. This is a big contributing factor to many issues in Sweden right now. At the same time, the big unions and the Social Democratic party is hostile to skilled workers coming to Sweden because they may compete with the union members, leading to a lot of skilled engineers and similar being deported because of technicalities. So Sweden is basically doing the opposite of Canada: we are hostile to people who can contribute to Swedish society, but have been very welcoming to people who will never realistically contribute a dime to the Swedish welfare state.
3) There's shortage on housing in the big cities due to regulation and rent-control. There is absolutely no incentives to build new apartments because the return of investment is non-existing, and all the zoning regulations and similar makes it a multi-year project just to get permission to even start building. What happens is the only new apartment buildings being built are apartments that are so expensive only people the people who do not have a problem getting an apartment in the first place (due to being well off) can buy them. For the Swedish 99%, you either need to get lucky, take significant loans (which people have done due to almost 0% interest, which will be a catastrophe when the interests rates increase, which must happen within the next 5 years) or stand in the state apartment queue for 20-30 years. The only way to solve this realistically would be for the state to invest heavily in apartments, basically build away the shortage, and then remove the rent control. Finland did this. But it was highly unpopular.
If you are in the top tier of your profession and you can basically get a job in whatever country you please, I'd hang on moving to Sweden right now.
What I find disturbing is that immigrant criminals, who haven't contributed to society at all, often do not get sentenced to deportation. So we have the situation that people who are a benefit to the Swedish society get deported, but the criminals get to stay.
> Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed. Intel believes these exploits do not have the potential to corrupt, modify or delete data.
This is deceptive. It very quickly acknowledge the confidentiality aspect, but then claims that is "operating as designed" and then immediacy try to damage control by pointing out what the exploits cannot do (corrupt/modify/delete).
> Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits.
This is deceptive. In the first sentence it combines two statements: 1) bug/flaw in Intel products and 2) that it is unique to Intel. In the rest of the paragraph it then claims that the previous statements are incorrect, but only addressing the second point.
> Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.
This is deceptive. It immediately mentions AMD to give the impression that AMD also suffer from the problem.
It then goes on with a straw man about performance impacts ("contrary to some reports").
And then mentions "average computer user" whereas the real problem is obviously not average computer users. Again, deceptive.