HNHacker News
TopNewBestAskShowJobs

kelthan

294 karma · joined January 4, 2023

submissionscomments
kelthan··on HTTP/2 rapid reset attack impacting Nginx products
Yes, because it's exploitable.

Systems that require very high cognitive load on their human operators (whether machines, programming languages, etc.) are alway destined to fail. Human beings are not good at doing boring, repetitious work that requires them to stay focused: lapses will occur. And hackers are going to find and exploit those gaps. So the best way to avoid those problems is to build solutions or specifications in which those gaps are not even possible.

Modern software systems are some of the most complex systems that humans have ever invented--and they just keep getting more complex over time as we layer new things on top of them. Think of a really high Jenga tower with lots of holes in the base.

That means we need to strive to keep things simple. That may mean making decisions that prevent common or severely impacting failure cases from being possible, even if it is a little more difficult to do, or eliminates an esoteric use-case. This is even more true when writing specifications that others will implement and/or be expected to conform to.

kelthan··on Ask HN: Show me your half baked project
This is mostly to deter malicious behavior because it makes it unprofitable for bad actors to publish malware by spamming the store with dumb apps that are only life-support systems for their little packages of joy.

It's a high enough bar to trip up a lot of bad actors, but low enough that it's a simple annoyance for most of us.

But yeah, reason 4,590,234,761 why people who misbehave make things more expensive/difficult/time-consuming for the rest of us.

kelthan··on EU warns Elon Musk of 'penalties' for disinformation circulating on X amid war
There are objective truths in the world. They are called facts.
kelthan··on Where to Start? Confused
Check with any of the nearby college/university business programs for the names of Angel funding groups or programs. They will have a lot of them handy.
kelthan··on Safety vs. Performance. A case study of C, C++ and Rust sort implementations
Bitonic sort has a couple of properties that make it poor fit for a generic sorting algorithm:

* The number of items being sorted must be a power of 2 (2^n).

* The number of comparisons it makes is larger than other sorting algorithms like merge sort, which will make it slower in non-parallel environments in many cases.

Bitonic sort has the advantage that it can be implemented to run in highly parallel environments (hardware, FPGAs, etc.), where the cost of comparisons is offset by them operating in parallel, so the sort completes faster even though more comparisons are occurring.

kelthan··on Brand new HP printer needs HP account to print
I have an Epson with refillable ink tanks, which has been great.
kelthan··on Apple Investors Already Hate the New iPhone 15
At which point Apple will be facing an anti-trust lawsuit.
kelthan··on Do you believe metrics can accurately measure a developer's performance?
Metrics can only measure one or more aspects of performance, assuming they are well crafted. And, metrics rarely cover all aspects of work that is being done. Take a few abstract metrics for example:

* X SLOC written / unit time * X Bugs resolved / unit time * PRs turned around in X unit time

Those represent a significant portion of the work that developers do: writing, debugging, and reviewing code. However, targets for these metrics are going to vary depending on experience of the developer and a number of other factors that may be out of the developer's control. Further, several of these metrics are in conflict with each other:

* A developer can't write lots of code if you are fixing bugs -- bug fixes often result in very few, or even no lines of new code being written. * Big or complex PRs will take longer to review than short/simple PRs. * Fixing bugs (reading code) takes significantly longer than writing code. * Refactoring code for simplicity, supportability, or clarity takes significant time and may result in little to no new SLOCs--but it can be highly valued work. * Not all bugs that affect a codebase are the result of problems in that codebase. It could be that some dependency changed requirements or is providing data in a way that "shouldn't happen" according to the design requirements. * Time spent boosting one metric is opportunity lost to boost another one--unless your developers are significantly under capacity. * A developer can sling lots of new code without adding significant business value which looks good on the metric, but is bad for business.

Hopefully that shows how metrics can be misleading. Metrics are like rulers: they are good at measuring things, but they can't always tell if what you are measuring is the right thing. You will still need to have subjective evaluation in addition to the metrics to properly evaluate a developer's overall contribution to the team.

kelthan··on X plans to collect biometric data, job and school history
I think the point is that if he can pivot to do all the other things, then the social media will follow. However, the markets that he wants to get into require a high degree of customer trust--and I'm thinking he doesn't have much of that left.
kelthan··on World chess federation bars transgender women from competing in women's events
I completely agree with you. As noted by others, this is not a question of managing gender equality in competition: chess has no inherent gender advantage. Though there are significant structural biases for men in competition which is why the ratio of women to men in competition is so low.

This is entirely about political, religious, and social pressure attempting to limit social change that they strongly disagree with.

kelthan··on Ask HN: Best tool to proof-read technical documentation?
Take a look at Vale: https://vale.sh/
kelthan··on Reporter Banned From X for reporting on Tesla Crash
Reminder, Twitter (now X) is a privately owned company. Comments like "How does anyone in our government allow this nonsense?" are answered by the simple statement that the First Amendment allows companies like Twitter (X) to do these things because they are a private company.

However, that does not mean that users of the platform should not consider this a warning that the current owner--despite claiming to be a free-speech absolutist--should be trusted with their business.

kelthan··on Fitch downgrades U.S. after debt limit stalemate
Government spending and business/personal finance management are two completely different things. While lots of people like to equate them, they are fundamentally very different.
kelthan··on Fitch downgrades U.S. after debt limit stalemate
Congress does not make "just in time decisions" in the way you imply. If Congress passes a bill for some program, they agree in the bill what the program will and won't do and they estimate the costs of that program over the lifetime specified in the bill. The nonpartisan Congressional Budget Office (CBO) does those estimates for Congress before the bill is passed. Those budget estimates are part of the bill.

A note on how Congress works for those who are not from the US: Congress, specifically the House of Representatives, has "the power of the purse", meaning that they alone have the ability to create laws that require spending money. The Senate--the other half of Congress--must also pass those bills before they are signed into law by the President, but cannot originate them. The Senate can modify them with the approval of the House, in process known as "reconciliation".

Once a bill is signed into law, the Executive Branch, headed by the President, is required to initiate (or continue) the program defined by the law, and to direct the Treasury pay the bills for that program. Neither the President nor the Treasury has the option to just ignore the parameters of the law that has been passed.

Because the CBO estimates are just that, sometimes the spending required to run the program exceeds the estimated budget, simply because the CBO cannot foresee every circumstance (war, global pandemic, inflation, etc.) In that case, the Executive and the Treasury are still required to continue to run and pay for those programs.

When the Treasure runs out of money to pay for the programs that Congress passed, it must borrow money. The amount of money that it can borrow is defined as the "debt ceiling". Once the Treasury exceeds the Debt Ceiling, Congress must authorize more money so that the Treasury can continue to pay for all of the programs that Congress has passed into law.

When Congress says they won't raise the debt ceiling they are saying "We are not willing to let the Treasury borrow money to pay for the things we told the Executive branch that they must do." But the Executive branch didn't pass the laws, Congress did. The laws that require money to be borrowed may have been passed last year, or decades ago.

If Congress really wishes to control spending (which is what is claimed as the reason not to raise the debt ceiling), then they can do so by not passing bills that require spending more money, since they are in sole control of what the Executive branch can spend money on. Which is why the debt ceiling debate is completely artificial, and not a "just in time" function. Rather it is the current Congress basically saying that they didn't like the spending passed by either themselves or previous Congresses, and they want to retroactively change the laws, and they wish to do so without having to go through the process of actually creating the laws, debating them, and passing them--usually because the spending they really disagree with is wildly popular and would not likely survive the regular legislative process.

kelthan··on Fitch downgrades U.S. after debt limit stalemate
The debt ceiling "crisis" is a completely manufactured political cliff. It serves no purpose other than to be used as a wedge during political debates.

When Congress passes a bill for anything that requires spending, the time to debate that spending is before the bill is passed. Once that bill passes and is signed into law, then US government is now responsible to cover that cost.

The debate about the debt ceiling is all about one party saying that they don't want to pay for the spending that has already been debated, approved, and signed into law. This is akin to going to an expensive restaurant, ordering the food, enjoying dinner, and then when the bill arrives, saying "Oh, I won't spend that much on dinner!". That's not the way the world works. If you can't afford the food, the time to make that decision is when you are making your restaurant choice, or when you are ordering, not after the bill arrives.

kelthan··on Linda Yaccarino’s vision for Twitter 2.0 emerges
That proposal is a perfect example of "enshitification". It also shows that as a CEO she sees Twitter users as product to be sold, not a user base to be catered to.

This is the exact trend that newspapers and print media went through, and look at where they are all going: National Geographic just laid off the last of their staff writers.

And it's not that ads can't be a revenue stream. But the needs of the users have to be balanced with the needs of the advertisers so that both can grow. If the balance tips too far in one direction, the other side will depart. Slowly if you are lucky.

kelthan··on Ask HN: How would you get users for this? Challenge for you
Car buying is going to be a challenging market:

* There are a number of entrenched vendors in the space already for both new and used cars. * Car companies and dealerships are working to eliminate the "invoice vs MSRP" price gap that was people used to negotiate a car purchase. That doesn't mean that gap no longer exists, only that car companies and dealerships are just unwilling to negotiate below MSRP. They are only willing to negotiate the markup over MSRP, which in many cases is ludicrously high. * Some states have taken to legislating away the possibility of selling cars outside of dealer networks. Most with the intent to block Tesla, specifically, but they may also limit opportunities like what you are proposing.

There may be pockets of underserved consumers, but they are likely to have structural issues (low volume, high touch requirement, poor credit, legal concerns, etc.) that make them poor/undesirable targets for the established vendors. That usually translates to small market opportunity, limited upside availability, or both.

If you can figure out a way to completely disrupt the current model, you may be onto something. Tesla did that successfully with direct sales, and it worked until they started running into legal and legislative roadblocks precisely because of their success.

kelthan··on Larry Ellison: Oracle Database 1,000x Faster Than AWS Aurora
That is _probably_ what he means, but there is nothing in the quotes in the article to confirm that is _actually_ the case.

Also, the comment at the end of the article "... RDMA and other key drivers behind Oracle’s ascent to being the world’s hottest major cloud vendor" demonstrates that the person who wrote the article is not interested in asking hard questions. Oracle Cloud is quite a way from being the "hottest cloud vendor" by any meaningful metric, right now.

kelthan··on Why aren’t there more successful education startups?
Because the education market, mostly state run, is significantly underfunded and therefore quite careful about how it spends money. It has same basic attributes as social services startups: very fiscally conservative buyers with long lead-time sales, and the business relationship can be cut at any time due to cost or legislative demands.

That translates to a low profit, high cost of sale (due to long resource intensive sales cycles), and volatile post-sale business environment. Each of those is a drag on profits.

kelthan··on Debris found came from missing Titan sub, says friend of passengers
At this point, we don't know that there was reckless malfeasance at play. However, there is plenty of circumstantial data to indicate that may have been the case. There was certainly an explicit and willful disregard for expert advice or battle-tested opinions. However, we don't have enough information yet (and may never get it) to conclude that was the cause of the accident.

It could be that someone/something damaged the hull (oceans and boats are notoriously hostile environments) and that created a weak spot that failed under pressure, or that some other mechanical failure occurred. However, those are both every bit as speculative as what I'm cautioning against. They are provided for illustration, only.

kelthan··on Debris found came from missing Titan sub, says friend of passengers
Agreed. Hopefully, this will result in a requirement for "black boxes" or "flight recorders" for this type of recreational/tourist endeavour going forward. They aren't going to prevent the accident that just occurred, but they provide valuable data to prevent future accidents.
kelthan··on Debris found came from missing Titan sub, says friend of passengers
Air pressure decreases as you go up at a far lower rate than water pressure increases as you go down. Air pressure at 30K feet is ~0.3 Bar compared to 1.0 Bar at sea level.

Water pressure increases by 1 Bar every 32ft (10m) of depth. To see the equivalent change in pressure in water (0.6 bar) as you see going up to 30K in the air, you only have to go down ~20ft (6m). The pressure on the submersible at 9000ft (2750m) is 276 Bar.

F16s and other planes with composite body panels will sometimes lose a panel due to water buildup between layers of the composite. The water freezes between the layers popping the panel loose from the frame or retainers holding it in place. That is usually not a life-threatening problem (though not desirable). A crack in a submersible pressure vessel at more than a couple hundred feet is usually fatal.

The description of the Byford Dolphin accident in ~300ft (~90m) of water or 9 Bar pressure, is illustrative: https://www.iflscience.com/byford-dolphin-accident-how-livin...

The pressure on the Titan would have been ~30 times greater than what occurred on the Dolphin.

kelthan··on Debris found came from missing Titan sub, says friend of passengers
For those that may not understand the physics:

There may have been monitors that detected structural issues in the hull (nucleation above), but at the pressures that the Titan was operating at, the amount of advanced warning is likely very, short--_maybe_ a second or two, if that. Probably not enough time to notice and reduce the pressure on the hull in any meaningful way.

The slow-motion porthole cracking you see in movies like "The Abyss" is a fiction created by Hollywood for dramatic effect. The reality is far more likely to be like water freezing in a pipe: everything is fine until it isn't.

The pressure the pipe exerts on the water inside of it keeps the water in liquid form until the temperature drops below the temperature/pressure equilibrium (~10F/-12C for residential copper pipe in the US). At that moment, the super-cooled water transitions from liquid to solid virtually instantaneously. <poof>.

The pipe analogy is the opposite of what would happen in the submersible: the pipe explodes due to internal pressure, instead of implodes due to external pressure. But the pressure going from sustainable to unsustainable in very short order is the same.

kelthan··on Ed Sheeran demonstrates how copyright is destroying musicians
There is an automated system for requesting and getting approval for covers, if you want to "cover" your ass while covering a song. (Ahem.) It basically says "yes" and logs the fact that you requested it so you have proof that you fit in the cover carve out you reference.

NOTE: This was explained to me by a musician/producer. I don't have firsthand knowledge of the system.

kelthan··on Ed Sheeran demonstrates how copyright is destroying musicians
All of the FAANG companies have railed against the overreach of DCMA Takedown Notices. However, they are bound by law to comply with them.
kelthan··on Ed Sheeran demonstrates how copyright is destroying musicians
That is part of the rules required of distribution sites like YouTube, Apple Music, Spotify, etc., as defined in US law as part of the Digital Millennium Copyright Act (DCMA). Hence the name "DCMA Takedown Notice".
kelthan··on Ed Sheeran demonstrates how copyright is destroying musicians
Maybe...

Until 2019, 100% of the royalties for the song "Bitter Sweet Symphony" by The Verve, released in 1997 and their most recognizable song, went to the Rolling Stones. The Verve sampled the distinctive repeating string theme in that song from the Rolling Stones' "The Last Time", released in 1965. The Verve even got permission to use the riff from the 'Stones record label prior to releasing "Bitter Sweet Symphony."

https://www.npr.org/2019/05/23/726227555/not-bitter-just-swe...

kelthan··on Ed Sheeran demonstrates how copyright is destroying musicians
A friend of mine who is a managing partner at a law firm specializing in IP law once told me that "once a case goes to a jury trial, it's a 50/50 chance that you win--and the odds only go down from there."
kelthan··on NPR now labeled “state-affiliated media” on Twitter
I suspect that it's part of the push to force companies to pay the $1000 for "the checkmark." Apparently, the conversion to subscription services and for-fee validation is not producing the desired effects so the Chief Twit appears to be doing everything he can to make those that he feel "should pay"--but are not--as painful as possible. (See also NYT.)
kelthan··on Grand jury votes to indict Donald Trump
Just a clarification: Cohen plead guilty as part of a plea deal. So the case never went to trial with an adversarial argument of facts between Prosecution and Defense. Therefore, we don't really know how good the case was.

The fact that Cohen is a lawyer would seem to indicate that the case was solid enough that he was concerned he would lose on merit. However, a friend of mine who is managing partner in a legal firm says that "Once a trial goes to a jury, it's approximately a coin flip as to who will win, and the odds only go down from there." That's mainly because if the case is black-and-white, then there will be some settlement/plea deal prior to a trial.

However, Trump has put himself into a corner where he probably cannot accept any plea deal other than one that would drop the criminal charges but keep any misdemeanor charges. I'm not sure that the NY DA, Alvin Bragg, would be willing to do that unless the case starts falling apart. But in the case Trump will push for an aquial rather than a plea deal so that he can use it to rile up his base.

← PreviousPage 2 of 3Next →