md_

Do you mean you re-interview and then stay in your current role, getting a raise from the competing offers? Or do you mean switching employers?

In any case, most FAANG have fairly fixed salary ranges for each level. Now's a time of big salary increases, as you note, so there's more flexibility, but you should expect this strategy to fairly rapidly hit the maximum for your level unless you get promoted.

So, if it's all about money, two strategies:

1. Switch employers, get a big initial stock grant + bonus. There tends to be more flexibility on the initial grant than on salary itself.

2. Get promoted.

I see quite a lot of recruiting for staff/senior-staff/pricipal roles, both within FAANG and without. It’s a bit harder to know what this actually means outside of FAANG, but my (very first) impression is that plenty of midsize companies have roughly similar positions to the better known FAANG staff+ roles.

This is the least useful answer I can imagine anyone giving to the original question.

How is it different than WebAuthn+FIDO2?

Indeed, but I do wonder whether most users need a single global identity anyway. FIDO keys or—gasp—passwords-per-site seem to solve the real problem most users have (which is, you know, maintaining logins).

I do think if there were strong user demand for a unified web identity (beyond email identifiers, which aren’t obviously improved by blockchain), we’d see more adoption of OIDC, including offered by IdPs who only provide that service.

Instead, the common providers are providing federated identity as a sideline—you don’t create an Apple or Facebook account because you want to be able to sign in with Facebook elsewhere on the web; you create it ‘cause you want to use Facebook’s app.

Users don’t care—or don’t understand—federated identity, so they sure as hell aren’t going to be interested in blockchain-decentralised versions.

Thanks for sharing the examples!

The obvious criticism is indeed that these use cases could be addressed—if not with Postgres—with Merkle trees, no? Like (at a quick glance) MediLedger wants auditability similar to (say) Cert Transparency, and is using a “permissioned” blockchain to do that. How that differs from a centralized or partially centralized model like CT isn’t obvious to me.

Perhaps more importantly, though, none of these examples seem like they demonstrate the supposed appeal of “Web3.0”: permissioned blockchains, by definition, do not have truly distributed ownership; the entire bullshit premise of Web3.0 from people like (ironically) a16z is that you get to own “digital assets.” Yet permissioned, partially centralized blockchains—-irrespective of whether Postgres would be a better solution!—-exhibit none of those characteristics, right?

If all the hype around “Web3.0” is just a way of saying “supply chain tracking will be done, at greater cost and complexity, in a distributed manner”, that doesn’t strike me as deserving of all the hype. What broad cultural or economic impacts will it have?

Good question. Without looking into it, one theory I might have is that the client does the DNS resolution and then just proxies the HTTP request through Signal's servers.

In general, I find the privacy implications of either solution a bit hard to reason about. Having Signal proxy the requests leaks to the website that someone is sending a link to the site via Signal, but not who is sending the link. If the link itself is sufficiently unique, though, that could be an issue.

On the other hand, if someone sends me a link and I in turn send it on (without clicking) via Signal, and doing so causes my client IP to be revealed, that seems sorta bad. So the proxy makes sense here.

/shrug

I don't think any of the risks here are huge, and the options all have tradeoffs, which I guess is why you can disable the feature.

You can disable this. But just to be clear, the preview is from the sender. I think it’s reasonable to assume that someone sending a link is willing to click the link, no?

(There’s also a “privacy-preserving proxy” in the middle, FWIW: https://signal.org/blog/i-link-therefore-i-am/.)

Not surprisingly, this turns out to have a totally benign explanation.

Still, I do think this demonstrates how hard it is for (apparently) well-meaning, somewhat-technical users to understand what their software does.

I don’t think reading over firewall logs is a very good way to ensure trust in client-side software, of course. (Aside from just being ridiculously time-consuming, there are too many easy ways to exfiltrate data. Like…sending it to the Signal servers?)

But I do sort of idly wonder, given the ever-increasing complexity of the trusted computing base, how we can make it so users who are (apparently) concerned enough to read over firewall logs can more productively evaluate trust.

I wish I had realized before I clicked that this was not, as the title suggests, thoughtful industry analysis. Rather, it's an investment pitch from a startup to help them raise capital.

I would suggest a barometer for whether a new technology does, in fact "matter": how much of the writing about it is by VCs and startups looking to hype their own investments.

In the case of "the Metaverse", that ratio seems to be surprisingly close to 1.0.

(Another barometer of significance is, "Does it have a definition which is sufficiently concrete to say what it isn't?," which the 'metaverse' seems often to conspicuously lack as well.)

I think that's accurate. And historically, there's been more moral opprobrium directed at mercenaries than those who fight for a country.

There’s every reason to be skeptical of the US government’s use of spyware, but at least it is, notionally, a democracy responsive to its citizens. A for profit company selling to the highest bidder is surely even worse, no?

Like, yeah, I want nuclear weapons to be abolished. But if NSO were selling briefcase nukes to everyone interested, I wouldn’t say, “but what about the SAC?”

Watch makers rarely use the term "waterproof": https://www.hodinkee.com/articles/why-no-watch-is-waterproof. For a time, the FTC banned this.

The Fenix 6 is also 10ATM water resistant. ISO says a dive watch must be rated to at least 10ATM, but honestly: if you're going diving, you can just take off your smartwatch, since you'll want a dive computer anyway.

That’s a significantly different statement than the one you started with.

Indeed, but my point was that the reality is complex. It depends on what news you view; a blanket statement that "the more news you consume the less understanding" is apparently false.

> We see it in survey after survey that the more ‘news’ media you consume the less you are in line with understanding what is actually happening.

[citation needed]?

https://www.frontiersin.org/articles/10.3389/fpsyg.2020.5608... shows a nuanced result:

"First, we find that social media use is associated with several negative consequences, including the endorsement of misinformation related to COVID-19, lower knowledge about how the disease is treated, and greater prejudice toward Asian Americans...

...individuals using print and radio sources were less common in our study, but these sources were also associated with lower knowledge of COVID-19 and greater stigmatization of Asian Americans.

Finally, and in support that some media formats can have positive influences during public health crises, individuals using web news sources were less likely to endorse misinformation. These findings overlap with recent Pew Research Center findings that individuals utilizing national news on news websites are likely to closely follow COVID-19 updates which could help account for why the endorsement of misinformation was lower."

This seems (unsurprisingly) to depend on the source:

"Further, misinformation scores were significantly lower among participants who frequently use CNN (t = 2.054, p < 0.05) compared to those who do not as well as among participants who frequently use the New York Times (t = 4.397, p < 0.001) as compared to those who do not. Prejudice was similarly lower among participants who frequently used the New York Times (t = 3.070, p < 0.01) as compared to those who did not. Finally, participants who frequently used NPR scored significantly lower on misinformation (t = 5.256, p < 0.001) and prejudice (t = 2.082, p < 0.05), and significantly higher on treatment knowledge (t = −2.242, p < 0.05).

People who used Fox News scored significantly higher on misinformation (t = −4.117, p < 0.001) and prejudice (t = −2.392, p < 0.05), and significantly lower on treatment knowledge (t = 2.766, p < 0.01) than people who did not use Fox News. Participants who frequently used Facebook similarly scored significantly higher on misinformation (t = −3.360, p = 0.001) and prejudice (t = −3.574, p < 0.001), and significantly lower on knowledge of COVID-19 treatment (t = 3.900, p < 0.001) and symptoms (t = 2.387, p < 0.05). Participants who frequently used Twitter scored significantly lower on knowledge of treatment (t = 2.621, p < 0.01) and knowledge of symptoms (t = 2.538, p < 0.05)."

So those who consume "legit" (my words) news sources like the NYT or NPR score well on knowledge and low on misinformation. Those who use primarily social media or Fox News score high on misinformation and low on knowledge.

Sadly, Hackernews readers are not broken out among the sample.

So, like, NPR? That already exists, of course.

Or should there be more direct political influence, as you suggest—NPR, but the editor in chief is elected every four years? That seems deeply problematic, for somewhat obvious reasons.

So what, in your mind, is a more “democratic” news media?

I don’t think most journalists would accept the view you attribute to them—that they are opponents of democracy—but the logic seems like it applies to any expert specialization. Is that your argument—that all experts are inherently opponents of democracy because they “tell us what to think?”

Sorry. I'm not trying to be pedantic, but how do you define this kind of thing?

E.g. "deterministic?" A naive Bayes model that optimizes for inflammatory text keywords is deterministic. Is it what you want?

I think you're making the point that consumer comprehension of how a system works is important, but at what level is that comprehension needed?

> 2. Ban communication technologies which the underlying behavior is a black-box to the user. It should always be apparent to the user why they are seeing what they are, and in what order.

I don't understand elliptic curve cryptography, but I still use ECC TLS.

I think that's not as simple as you describe.

The glib answer is, "They publish corrections." Which many do.

But I don't think that addresses the (valid) criticism about the Iraq invasion: while there were some errors of fact, there were primarily errors of omission, where the media were too willing to act as uncritical stenographers for politicians' claims.

We see, in a way, the same phenomenon in the Trump era: whatever lunatic allegation Trump or his acolytes would make, the media felt the need to cover it; after all, whatever the President says is inherently news, no matter how crazy.

Yet in both of these examples, the problem isn't that the media represent some sort of powerful cabal, which I think was what the OP implied: it's that the media are too spineless to truly hold to account those in power (in both cases, the President of the US). Viewed that way, the premise of the original question is incongruous: it's deeply strange to criticize only the "Princeton and Columbia"-educated "media elites" who too-uncritically reported on the claims of the President, and not the Yale- and Harvard-educated President (and son of a President)--or the billionaire heir to a fortune President who came later--who uttered those false claims.

The media absolutely deserve to be criticized for their uncritical reporting before the invasion of Iraq, as I said before, but the original criticism sounded like we want a weaker media who will be less able to question false narratives espoused by powerful players. And I think if you look at these stories more closely, you'll realize we want the opposite.

The big question, of course, is not whether media--mainstream or social--have ever "gotten it wrong", but what steps we can take to make them better.

The mainstream media very much got it wrong on Iraq. I agree with you. Yet the reality is more complex than your anti-elitist tirade suggests.

It's inconceivable to me that a well-functioning democracy can exist without trustworthy--and trusted--institutions who (yes) have an outsized influence on public opinion. The policy issues faced by citizens in a modern democracy are too complex to expect everyone to "do your own research."

So the question is, how do we foster those trusted institutions? How do we hold them to account when they go wrong? And how do we make them more deserving of our trust?

If the answer is, "We won't, but at least we'll have an algorithm that rewards CTR", well...I respectfully disagree.

Like I said, it's not a quantifiable statement, so I don't believe it or not believe it. If you're saying that FB promotes people faster, yes, I can believe that--younger companies generally tend to.

I am quite skeptical that the median time for a new-grad hire to get to L7 at FB is 7 years or fewer, but I guess this is something that we could answer with some weekend scraping of LinkedIn. ;)

At this point I don’t understand what’s being argued about. Are you saying you have anecdotes that this happens? Yeah, probably. I have some, too.

Are you saying the median total comp for a 7-year total experience Facebook engineer is $1m? If so, what’s your source? (Or what are you claiming? The top decile? The top quartile? Etc.)

I might not have understood it, which is different. Can you make it a little more explicit for those of us who are slow?

That didn't answer my question. How does Signal supporting Mobilecoin or Session supporting--whatever this is--impact your usage of Signal/Session?

Sure, I guess. I would tend to argue that with hardware access they can do a number of things, though:

- They can install a wifi-enabled* keylogger that exfiltrates your OTP. Yes, they have to use the OTP before you do, but that seems solvable to me--just program the keylogger to transpose one of the six characters that comes after your (now known) password.

- They exploit any number of likely plug-and-play vulnerabilities in common OSes (e.g. https://www.thetechherald.com/tech-news/disable-plug-n-play-...).

- They steal your computer. Are you using FDE? If not, your cookies are sitting there on disk waiting for them.

- They...steal your phone next time you forget it at your desk. ;)

Are there scenarios where TOTP can protect against a non-phishing attack? Yeah, I can construct one if I really have to. (I think you're thinking too locally; my top argument for TOTP would be that I can rarely be sure the identity provider has implemented reasonable quotas against password brute-forcing--and who knows how well they secure things like server logs against rogue insiders?)

But if you tell me you use TOTP because you're afraid of a local attacker plugging in a keylogger--and not because of phishing--I think your priorities are out of whack. :)

* Or they use a covert channel, but I'm not serious about this part: https://dl.acm.org/doi/10.5555/1267336.1267341

Yep, Apple solves this by moving FIDO key material around via iCloud, I believe. But it requires a good syncing mechanism like that.

In principle it's similar to the password manager problem, which is a bit ironic: if everyone used password managers, most of the same security issues would be resolved. (There are a few cases where a FIDO key is better than a password manager, but not many!)

TPM-based like...Windows Hello?

Both Windows and Mac support host-based FIDO keys. Of course, the downside here is that you...can't move them to a new computer. So they're sort of hard to use on their own, hence people still turn to portable (but less secure) solutions like TOTP and SMS.

The fault with phishing _always_ lies with the victim, by this logic.

Put differently: if you assume the user to be infallible, there's very little reason to use 2FA of any kind. (Don't believe me? Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.)