jrandm

> Ever hear the expression "Your right to your fist only extends as far as my face?"

I have. A "community guideline" or social disapproval of threatening violence may disallow those sorts of expressions, but they're quite common in certain communities (sports, games, etc - may be known as "trash talking").

> In order to express ideas openly, even firmly and directly, one does not need to be explicitly RUDE to others, and apply personal insults and attacks.

I agree. What one person interprets or intends as "explicitly RUDE" may be interpreted or intended differently by another individual, though, so an open community should assume good faith, correct the socially-determined, arbitrary language violation, and try to focus on the content of the message rather than delivery mechanism.

If you'd like to share examples of what makes you believe ESR[0] is unable to differentiate between a stupid idea and a stupid person, I'd be happy to examine them with you. I myself used Linus as an example of someone who can be famously insulting[1], yet I'm unaware of him actually permanently banning people from submitting new patches to the Linux kernel because he flipped out in a code review.

Indeed, as I think everyone can agree they've been polemic regardless of how you agree with them, the fact that they've engaged with the public at large seems contrary to your statement that they revel in personal attacks rather than engaging a free marketplace of ideas: They share an unambiguous position and offer defense of their ideas against all comers. I suspect most of this defense is done today by the organizations and the legacy they've created rather than them personally, which is why it's more noteworthy when they feel the need to make such strong statements.

> turns out that you don't HAVE to be a jerk, and you can express your strong beliefs in an idea without calling someone a looneytune.

You don't "HAVE" to be a jerk, but you may. I will listen to the content of your words rather than the appearance of your statement, and I believe ESR is aggressively asserting his position the Open Source Initiative should do the same.

I find it interesting you used "looneytune", because I don't see any message from ESR in the month of February using that word.[2][3] Quoting Russell McOrmond later in the thread[4] that does use the word "loonytoon", "ESR tried to post a message where he named and shamed some individuals and activities which he considers to be seriously problematic not only in society as a whole, but software communities as well. The moderators rejected his email to this list. Some might even suggest he is being de-platformed by being blocked from expressing personal political views. I'm not suggesting this, as I'm advocating strongly that those who wish to use software and software licenses to discriminate be invited (strongly if required) to go elsewhere than the OSI mailing lists."

[0]: Or Linus, I suppose, though that's less relevant to the specific topic

[1]: https://www.fudzilla.com/media/k2/items/cache/7a3a7dc8bbb8eb... - I don't mean to insult him and use/appreciate his work/writings practically every day!

[2]: https://lists.opensource.org/pipermail/license-discuss_lists...

[3]: https://lists.opensource.org/pipermail/license-discuss_lists... is quoting a message that was rejected by the moderators. It appears ESR rephrased without public discussion and it never went out to the list.

[4]: https://lists.opensource.org/pipermail/license-discuss_lists...

I don't mean to dispute that ESR may be a jerk, but I'd ask you to consider what his position is:

> It's less bad that people sometimes got their feelings hurt than it is to institutionalize a means by which dissenting opinions are crushed under the rubric of “not nice”.

His point, as I take it, is that a "cancel culture" is antithetical to an open culture. I agree. Excluding someone due to tone, without warning or clear explanation of the violation, especially when it appears the content is a contested opinion, is bigoted censorship.

To steal the Paine quote ESR himself used, "He that would make his own liberty secure, must guard even his enemy from oppression; for if he violates this duty, he establishes a precedent that will reach to himself."

The liberty to use strong rhetoric[0] in defense of ideas is what I see under attack by banning ESR from these discussions.

[0]: To my reading, the most inflammatory remarks he said on the mailing list are:

> With whatever moral authority I still have here, I say to all advocates of soi-disant "ethical" licensing not just "No" but "To hell with you and the horse you rode in on."

in the opening email for that thread and in his penultimate email:

> I am not fooled. You are mounting an ideological attack on our core principles of liberty and nondiscrimination. You will not succeed while I retain any ability to oppose this.

Compared to a typical rant from Torvalds this is pretty tame debate-speak.

If you happen to see this, during an editing pass it would help to include information about what language you're using to present your code examples when the article is standalone for a wide audience.

Something like:

"For this section and the next, let us imagine the guts of a very basic calculator application, expressed in the initial algebra style, using [your language and environment]."

> the code examples are given in a language everyday programmers will probably not recognize

The code examples are given assuming the reader already knows the language and runtime -- not once in the article does it say what this language is or explain the syntax/grammar rules. I would take it to mean this isn't meant for a broad audience, or the author has made a common curse of knowledge[0] mistake.

[0]: "The curse of knowledge is a cognitive bias that occurs when an individual, communicating with other individuals, unknowingly assumes that the others have the background to understand." https://en.wikipedia.org/wiki/Curse_of_knowledge

For some definition of "serious" I think the gains from a readable implementation in your working language far outweigh performance or correctness concerns.

To put it another way, I'm rarely parsing data for it to be directly optimized into a machine language. I'm parsing data to extract parts I care about and then work with those parts. The more consistent this process is the easier it is to debug and fix. If my whole parsing/using-the-parsed-data pipeline is in the same language, say Javascript, then I am still only ever debugging the same language and runtime environment (eg: node v12 on whatever \*nix).

In a practical example, YARA[0] is (confusingly) used as both a format[1] and specific implementation[2] for sharing malware detection rules. ClamAV[3] is a popular open source antivirus engine that added YARA-the-format support a few years ago[4]. If you look at their grammar[5] file as well, you can see that one uses GNU Bison 3.0.4 the other uses 3.0.5. One is 3754 lines long, the other is 1849. We can expect these to behave differently. At a certain point, say because of how regular expressions are handled[6], it becomes easier to maintain your own parser than to deal with quirks/whims of someone else's implementation (generated or not).

[0]: https://en.wikipedia.org/wiki/YARA

[1]: https://yara.readthedocs.io/en/latest/writingrules.html

[2]: https://github.com/VirusTotal/yara/blob/master/libyara/hex_g...

[3]: https://www.clamav.net

[4]: https://blog.clamav.net/2015/06/clamav-099b-meets-yara.html

[5]: https://github.com/Cisco-Talos/clamav-devel/blob/898c08f08b5...

[6]: "In previous versions of YARA, external libraries like PCRE and RE2 were used to perform regular expression matching, but starting with version 2.0 YARA uses its own regular expression engine. This new engine implements most features found in PCRE, except a few of them" from https://yara.readthedocs.io/en/latest/writingrules.html#regu... ; if the regular expression grammar and/or symbol set isn't consistent the things parsing the files won't necessarily be either

I would agree if everyone exposed wore masks the spread of this contagion would be reduced considerably.

Logically, I might extend it to everyone wearing masks would considerably reduce the spread of exhaled contagions. This might first be encouraged in high population density areas, like parts of Asia, and first need to be integrated with fashion[0] to have any chance of broad success. I suspect it will never be a preference everywhere barring some sort of serious consequence (like death) for not wearing the mask.

In this situation, I think the most important thing is to know that normally available or homemade masks are helpful for presenting the spread of the disease. The more expensive masks are better but in this instance, not better in a meaningful way for the average person. The current supplies should be saved for those at-higher-risk populations like medical staff.

[0]: https://www.pinterest.ca/charmed4evr/fashionable-surgical-fa...

My layman's understanding is that any barrier will stop some percent of most things. In the case of small, airborne particles, this stopped percentage of already-dry, floating material is very small. That means inhaling through them is relatively ineffective at stopping you from inhaling the particles.

When you exhale it is more wet and the moisture causes the barrier to catch more of the airborne particles. The barrier also catches any more-solid material that would otherwise land elsewhere, providing a mechanism for the particle to spread.

This means the net gain for wearing them to keep from catching the disease is relatively small compared to the gain by wearing them to prevent the spread if you may have been exposed.

> Finding an algorithm that approximates how a human approaches a page layout doesn’t feel like it would be all that hard.

"In CS, it can be hard to explain the difference between the easy and the virtually impossible."

https://xkcd.com/1425/

Going Postal by Terry Pratchett is a story involving a competition between a traditional post office and a light-based telegraph system called "clacks." You might enjoy the book and/or television adaptation.

After his death a few years ago, an idea from the book was actually implemented on the internet and is the reason you see "GNU Terry Pratchett" around.[0][1]

[0] https://www.theguardian.com/books/shortcuts/2015/mar/17/terr...

[1] https://www.reddit.com/r/discworld/comments/2yt9j6/gnu_terry...

The sibling replies by IggleSniggle I fully endorse as supporting my meaning in the original post.

As to explaining more about my thought process: You asked a hypothetical "what if" question which, given the question itself is imprecise, I interpreted as you wishing information was always conveyed to your desired precision/accuracy, and extrapolated that (given this is a public forum) into general communication.

I shared my thoughts, specifically that it seems impossible for a person to always communicate perfectly to an unknown audience, and offered a different hypothetical. The last line explains the punctuation use in my "what if."

I believe accurately conveying identical information in a manner everyone can understand is an impossible, or at least unreasonable, burden to place on individuals.

Instead, what if people tried to hear graciously and "assume good faith"?

The quote is ripped from HN's guidelines.

I got sidetracked searching for pictures of the multiplayer part of the game Vagabond's Quest.[0] I wasn't successful, unfortunately, but a number of the pages outside the login wall were archived.[1]

I think you might find several of these pages entertaining,[2] especially if you're familiar with text-based games (especially MUDs and MOOs[3]) and a Dungeons and Dragons-esque setting. The items, combat (PvP and 1-player), and any other aspect of chance were transparently dice rolls and modifiers in-game.

Because this is Hacker News, don't miss out on the >20-year-old anti-hacking mechanism.[4][5] Keep in mind this is for a sequel or companion game that came (IIRC years) after the original.

With that stage set, picture a black background and some grey text with scattered red/green/blue highlights. The logo was probably the only image. The page would reload every few seconds, but you could manually reload and see new messages sooner. If your username was in a chat text it would make the text larger (both the line and your name, I think).[6] Maybe under a few other conditions too: if you were fighting someone, if it was the admin/mod/dev(!) Falados, I think you could add a few of your own word filters at some point. Originally it was just your username in the line, I'm pretty sure. The combat moves and rolls were also part of this chat stream. I remember being in busy rooms with dozens of people, frantically refreshing, trying to read the top of the screen quickly before it was lost.

It was great!

I hadn't quite connected the games to programming yet, but I imagine the Hall or Arena you "joined" for Player vs Player combat and chat was by visiting the page of HTML generated by Perl scripts (I remember URIs ending in .pl, maybe some CGI thing?) that had a meta tag to trigger the refresh. It had a regular form with a submit button and the page reload was convenient because that was the only way to see your message or anyone else's new in the page.

I'm amazed how clearly I remember playing, if the details are a bit fuzzy. Looking for pictures I came across this,[7] and am excited to read through and maybe check out a beta. Thanks for prompting the search!

[0]: http://www.angelfire.com/games2/LanderZ/vq.html

[1]: https://web.archive.org/web/20000818004717/http://www.netdra...

[2]: https://web.archive.org/web/19990902013706/http://www.netdra...

[3]: https://en.wikipedia.org/wiki/MOO

[4]: https://web.archive.org/web/19991105152436/http://www.netdra...

[5]: https://crypto.stackexchange.com/questions/47177/would-sha1-...

[6]: FONT tags, I'm 99% sure. This was probably one of my early view-source learn-by-example sources, in a futile attempt to cheat

[7]: https://playvq.com/roadmap/

React is cool if you want components. Web components had crap support because browsers needed to implement them; React you could use immediately.

I agree Redux isn't an improvement there, media queries for user preference[0] were. However, rendering details aside (this may still use a CSS class), you might choose to give a separate option inside your regular UI or have some other interactive blob that is colorscheme-aware but needs to be told that manually. Maybe you have lots of options. The app-colors state can be set to some explicit value initially or default-inherit from the environment, but it still has to be tracked somewhere that isn't the stylesheet. It doesn't have to be Redux but it does have to be something.

Relatively soon I expect web components will start to eat into the UI framework nonsense.[1] React never really hid the need to know HTML, CSS, and JS well just like jQuery didn't. They made it _easier_. They also encouraged a plug'n'play ecosystem that made it easy to kinda-sorta hack together what you wanted -- without having to do much reading. Bold prediction: In the future we'll look back at a lot of "React developers" like we do at "jQuery developers" now.

[0]: https://developer.mozilla.org/en-US/docs/Web/CSS/@media/pref...

[1]: https://caniuse.com/#search=web%20components shows Safari as the only partial out of major browsers, plus some in the long tail. I've only poked at it a bit recently, they were a mess last time I tried (years ago)... it's much better.

Think of a different website: maybe goggle.com (no idea what's on this domain), seems like a reasonable typo.

Would you be bothered if your computer or network was sending emails to whoever "goggle" is, not "google"? Should goggle be penalized for receiving things you freely sent to them?

The problem is more you're sending data you don't mean to than that someone owns the place you're sending it.

I think an extreme circumstance would be someone hijacking microsoft.com and trying to ransom it off but I'm not really familiar with ICANN's specific powers.

Why should everyone in the world not get to use a thing because Microsoft has some naming scheme? These places have been shouting whatever data at a random (edit: unintentional and uncontrolled rather than random) spot on the internet for years and that's a huge problem.

Opening up an auction is a nice way to draw attention to the problem, get MS to literally&figuratively pay for it (even if the price 10x'd it's not like M$ couldn't handle $17MM), and make it no longer the seller's problem.

I didn't say anything about capabilities.

If a base requirement is the thing is implemented with X, like wanting a table made of teak wood, and you give me a table that doesn't have any teak in it you've ignored half of my requirements. I don't care if you assessed my needs as being better met by oak and you made a fine table, I need to put a teak table somewhere and you completely failed at that task.

The point of a take home test that says build foo in Python so we can see it in Python is not "to see if a person can get things done," it's to see how a person gets things done in Python.

If someone says write a grep-like thing in Python so we can see how you write something like that in Python and someone else submits anything in Perl that's not an XY problem. It's a basic failure to meet clear requirements.

Can substitute airplanes[0] and computer games/graphics[1], though if we have to be that pedantic I found a couple names[2] in the history of satellites section of wikipedia that don't seem to have formal education beyond a military technical school.

0: https://en.wikipedia.org/wiki/Wright_brothers#Early_career_a...

1: https://en.wikipedia.org/wiki/John_Carmack#Early_life

2: https://en.wikipedia.org/wiki/Konstantin_Tsiolkovsky and https://en.wikipedia.org/wiki/Herman_Poto%C4%8Dnik

I think it's important to distinguish that many of the things being monitored are not being posted publicly. From the article:

> In 2016, the company expanded that analysis to students' school email accounts, monitoring all messages sent over district networks.

> Gaggle monitors the digital content created by nearly 5 million U.S. K-12 students. That includes all their files, messages, and class assignments created and stored

> "opened a Google Doc, wrote down concerns about a boy in class acting strange, then typed every bad word they could think of"

I can see both sides of monitoring school equipment, or at least maintaining the ability to access it, but I don't believe most people here would consent to active content monitoring of every email, document, message, and drafts of documents even on workplace devices

I agree it'll probably become the new idiom in JS, but it probably needs another few years to begin taking over from the idiom that existed for decades before (and still works).

If you've seen that more common than call/apply for years then you probably work almost exclusively on new projects, with people that convert things to bleeding-edge, or with heavy transpilation: The spread operator as used there has only existed in regular released browsers/node for 3-4 years. I don't think it's a stretch to say the vast majority of code out there at this time won't be doing it that way.

That's a significantly newer syntax, so I wouldn't say it's "more idiomatic" than explicitly referencing the original function on the prototype (which is idiomatic to JS) and was the way to do it until the spread proposal, Array.from, and similar additions, what, ~5 years ago?

If anything isn't that code _less_ idiomatic in that it's less specific to JS and more of a generic operation?

> On GitHub, a fork refers to a copy of a repository used by a contributor to stage changes they’d like to propose upstream

I'm not sure this is accurate and is the crux the argument. IMO a fork on GH refers to a "fresh" (in terms of the tooling around the repo, eg issues/PRs) copy of the repo on another account, which may be used as a branch to push to upstream but may also be the "traditional" fork, the difference is entirely in how the copy is used. If you've got a public "personal branch" with its own associated tooling it doesn't seem like a stretch to call that a fork, whether temporary and intended to be sent back upstream or not, and to me it's a difference without a distinction about why "personal branch" is a better term than "fork." Forking a repo (spinning off a dev section, including CI/CD/issue tracking/management -- a branch implies sharing that infrastructure IMO) isn't the same thing as forking a project (spinning off a competing project).

To the cathedral and bazaar points, I don't see how GH affects the development style at all. The only thing that really makes the mailing-list driven Linux dev more decentralized is that it's done via email... yet someone still chooses what goes into releases, maintains & hosts that mailing list/website mirror and could limit access, or the "core" team could simply email each other and lock out any public view. GH can be configured to be just as open (if needing their "fork" model to keep anyone from being able to push over the original hosted copy) or just as closed, depending on how the project is run. The cathedral and bazaar is about project philosophy and management, not the underlying tech, to my reading.

Given the disclaimer that the author is building a GH competitor my cynical thought is this is really marketing aimed at the programmer niche; I would have enjoyed it more as a contrast against centralization and the benefits of his (as I understand it) more free/open/decentralized competitor.

All that said, I think sr.ht/sourcehut is a cool project and can easily see myself switching to it. How have the ads in 2600 been working?

> You don't have any rights at the border.

This is, to the best of my knowledge, factually untrue.

> Canadian courts have generally recognized that people have reduced expectations of

> privacy at border points. In this context, privacy and other Charter rights continue to apply

> but are limited by state imperatives of national sovereignty, immigration control, taxation

> and public safety and security. The Canadian courts have not yet ruled on whether a

> border officer can compel a person to turn over their password and on what grounds, so

> that their electronic device may be searched at a border crossing.

https://www.priv.gc.ca/en/privacy-topics/public-safety-and-l...

It goes on to specify that while the law is unclear, an unpublished Canada Border Services Agency policy states searches "should not be conducted as a matter of routine; such searches may be conducted only if there are grounds or indications that “evidence of contraventions may be found on the digital device or media.”" [nested quotes sic from page, presumably from this unpublished policy]

IANAL (nor Canadian) but the Canadian Charter of Rights and Freedoms and the Customs Act, and probably many more documents and judicial rulings, define the rights available to anyone crossing the Canadian border. CBSA policy may not be legal, and only by exercising their rights and refusing to cooperate with illegal orders will citizens be able to affect change.

Many brave people in the past have risked detainment, property seizure, and worse in order to protect the civil rights of millions of others. Apparently, in regard to safeguarding personal data privacy, this is again necessary.

Could you elaborate on that thought?

Individuals also have the authority to assert their rights, one of which in Canada is the freedom from unreasonable search and seizure[0]. R v Fearon[1] places limitations on this exact type of search one could easily argue aren't met given the descriptions of these searches I've read.

[0] https://en.wikipedia.org/wiki/Section_8_of_the_Canadian_Char...

[1] https://en.wikipedia.org/wiki/R_v_Fearon

Why doesn't everyone simply refuse to share passwords, as is mentioned numerous times on various Canadian government websites? Basic search finds tons of pages from all sorts of departments https://www.canada.ca/en/sr/srb.html?q=share+password

A few samples

> 95% [of polled Candians] know not to share their passwords

https://www.getcybersafe.gc.ca/cnt/rsrcs/vds/nln-sft-stck-p/...

> don’t share your PIN, password or personal security questions and answers with anyone, not even family members

https://www.canada.ca/en/financial-consumer-agency/services/...

> If you’ve shared passwords with friends, now would be a good time to change them

https://www.getcybersafe.gc.ca/cnt/blg/pst-20180913-en.aspx

> Protect your password, don’t write it down or share it with anyone and change it often

https://www.canada.ca/en/employment-social-development/progr...

A few days of every single traveler saying "no" would force them to either begin seizing all electronic devices or to drop the entire endeavor as untenable. This problem doesn't need a technical solution beyond making sure locked devices are actually secure.

I think most programs admit and accept the physical risks of physical sports. Brain trauma is less understood than something like a knee injury, but that's exactly why these studies need to continue to gather data. We can continue to improve safety during play, detection of damage, and treatment after injury.

Anecdotally, most youth leagues I see for contact sports have changed their rules to better protect the players. I would be against any legislation doing the same for adults who are informed of the risk.

What other actions would you propose?

The paper disagrees with your restatement:

> caution must be used in interpreting the high frequency of CTE in this sample,

> and estimates of prevalence cannot be concluded or implied from this sample

https://jamanetwork.com/journals/jama/fullarticle/2645104

Last paragraph before the Conclusion header.

I want to add to what chris_mc and others said confirming this horrible instance is used as a training exercise for lots of the US military.

When I did USMC boot camp in the late 2000s this and other less publicized examples were used to enforce disobeying unlawful orders and encouraging critical thought.

To quote a West Wing episode (AFAIK): "All wars are crimes." I'm glad we try to do better by teaching from our mistakes.

The hourly rate is to make an apples-to-apples comparison to someone whose full-time job is to do that kind of security work, either salaried or contracted.

Would it make sense to award bonuses to every in-house security researcher based on an estimated, hypothetical worst-case cost? It doesn't take much imagination to see how that reasoning applies to other positions. Do accountants get big bonuses for avoiding multi-million-dollar errors? Lawyers for avoiding costly lawsuits? Operations (IT and otherwise) for keeping infrastructure running? Customer service for assuaging disastrous public interactions? Stretched to absurdity, would you pay for a taxi based on how badly you need to get to point B?

I believe saying "preventing these kinds of problems (doing this work) is what we pay you for" is a reasonable conclusion and paying a market rate for that general value makes more sense versus calculating a kind of commission per individual contribution. That does have a certain appeal (and I wouldn't mind seeing a discussion about it) but I haven't gotten the impression that's the perspective of those who think all* bug bounties should be higher.

*: Added caveat as I'd bet every researcher can name companies that pay poorly

I'd be curious to know what those same folks think regular security staff should be paid.

From another thread here, the author talking about the time involved:

>Two to three hours discovering and writing the initial report, couple more hours (unsuccessfully) trying to escalate it using pre-approved apps.

I'll round his estimate up to 6-8 hours, or basically a normal work day:

$5000 / 8 = $625 an hour

$625 * 40(hour work-week) * 50(weeks) = $1,250,000 annually

Let's say it took an entire week's worth of time (comes out at $125/hour):

$5000 * 50 = $250,000

Is that range wildly out of line for what Facebook would potentially be paying for a full-time employee? The actual salary number would probably be lower, this would be including the cost taxes/insurance/perks/etc.

Even as a contractor, where the "expect to bill ~1000 hours a year" rule of thumb is/was common, puts the range at $125,000-$625,000.

Seems as though if you can reliably find organizations willing to pay these amounts and have the skill/luck/grit to grind out vulnerabilities at those companies you'll make a decent living. Or, put another way, these company's are paying bounties comparable to what the same research would have cost coming from a staff member.