md_

I think they're referring to attestation (https://fidoalliance.org/fido-technotes-the-truth-about-atte....), which requires that attestation certificates be shared with a minimum of 100,000 other devices in order to ensure they're not unique IDs.

Maybe the parent misread the spec as saying a _maximum_ of 100,000? Or something?

Hmm, what opportunities? Genuinely curious what you mean here.

The biometrics don't authenticate you to the remote service. They authenticate you to the device that has the keys that authenticate you to the remote service.

Biometrics are a convenient replacement for a screen lock pattern/PIN, but not a necessary one, of course.

https://www.wired.com/story/fido-alliance-ios-android-passwo... is a good explainer.

This announcement is primarily not about hardware keys, right?

I think their point is that they don't want to have the window of vulnerability (to loss) when they have added a new account but haven't yet rotated their off-site key?

That said, the real answer is that FIDO keys can be synced by e.g. Apple (as described in more detail here: https://www.wired.com/story/fido-alliance-ios-android-passwo...). So you can potentially just make your offsite backup be a hardware key that gets you into your iCloud keychain, and (if you are willing to trust Apple) use your iCloud for backing up all your other accounts' keys.

I like the analogy, but it strikes me as missing the upside (and other potential causes of problems the author may be seeing).

Bisquick is a great solution if you have only one problem. I want more solutions like Bisquick: easy to map to the problem (pancakes -> Bisquick; not pancakes -> not Bisquick), hard to fuck up, low marginal cost above the inputs. It's great!

In the converse, we have lots of custom software solutions which are exorbitantly costly over the long term. Small companies without in-house expertise have to figure out how they will maintain software they depend on when their consultant (or the boss's nephew) leaves. Big companies with significant workloads and workforces can afford (and indeed, profit from: https://danluu.com/in-house/) high-complexity custom engineering, which is...fine...but even FAANG have trouble figuring out how to incentivize system maintenance and support.

At heart, I believe we haven't come to grips with the extreme disparity in capital costs vs unit costs of software, such that we don't really know how to pay for the unpredictable costs of bitrot and maintenance. As a result, every software development project is ultimately a question of "how are you going to pay for its ongoing support".

Right, but my point was that if you can't reliably estimate how long something will take, you can't estimate how long it ought to take, and, by extension, can't estimate if it's taking longer than it should.

So, as a leader, how do you know if someone is over or underperforming?

Makes sense. But it's well-known that software delivery estimates have huge error bars.

I frankly would have limited insight if a skilled engineer reduced output by 30% in order to work a part-time job.

Ultimately, the challenge here is that managers and engineering leads just don't have a great ability to know how expensive a project should be, which is sort of bizarre given that for a lot of software the development costs are the primary costs!

Er, I’m confused. Is the point of this essay that endpoints might be compromised?

I mean, yeah? I agree, I guess? But also, that’s not an interesting observation, is it?

Agreed, but perhaps, even more constructively: "Great, you agree we need more of an ability to shine a light on--and hold people to account for--human rights abuses worldwide."

The US has been deeply hypocritical by opposing the ICC, for example. But the policy fixes that we need for what's happening in Xinjiang--public accountability, international institutions with teeth--are the same ones we needed for what happened (and is still happening), at a fraction of the scale of Xinjiang, in Guantanamo.

"Whataboutism" only works because the whatabouters assume their opponents will reflexively defend the US (or whomever). The implication is, strangely, not "The US has done this too, so we need strong institutions to hold the powerful to account" but, rather, "The US has done this too, so whatareyougonnado?"

It seems pretty inhumane to see the victimization of minorities in China purely through the lens of US domestic politics, but ok, sure. It’s not about the human rights issues, it’s about…upvotes from American HN readers?

As with everything, there's nuance. But, yes, it's politically a lot harder to argue for sanctions that will have a significant effect on consumers/voters than those that will not.

I think a reference to https://www.theguardian.com/world/2019/jun/17/china-is-harve....

Where'd you get your law degree, Mr. Hutz?

"If"?

Like...forced sterilization and "re-education" camps for religious and ethnic minorities? https://www.newyorker.com/news/a-reporter-at-large/china-xin...

Spying on Uighers abroad and holding their innocent relatives at home hostage so that they will not agitate against human rights abuses? https://harpers.org/archive/2022/04/the-spies-next-door-uigh...

Or employing slave labor in factories in Western supply chains? https://www.aspi.org.au/report/uyghurs-sale

This is probably more true for headhunters than for in-house recruiters.

FAANG mostly (completely?) use in-house.

I think that substantially underweights the role of luck.

But, I will admit, these conversations often strike me with what I see as two clearly different mental models. The first is what I might call the Bayesian (or perhaps "Rawlsian", or "anthropic") model, where the thinker assumes, "I am unlikely to be much different from anyone else", and thus takes overall success rates to be a sort of guidance: "Most startups fail; the expected value of a startup is negative; therefore I won't start a startup."

The alternative mentality I see here seems to be more of an egocentric one: "I'm special, I believe in my ideas, and I can make it."

It seems to me the egocentric view is certainly a necessary condition for wild success, but obviously an insufficient one: people who are special need to identify their specialness to avoid a fate of what might be called "elite mediocrity". But plenty of people who aren't special think they are, and achieve worse outcomes as a result of their unrealistic goals.

Unfortunately, the prescription here seems to be to simply "be clear-eyed", which is easier said than done.

“Practical and repeatable” seems to omit the overwhelmingly high failure rate, no?

Sure; Keynes coined the term "animal spirits." Yet the criticism (that economics is too modelling-based) is widely levied, e.g. see https://www.theguardian.com/commentisfree/2016/sep/19/its-ti..., https://aeon.co/essays/economics-is-once-again-becoming-a-wo....

Is it the whole story? Probably not. Like I said, I'm not an economist.

But given the extreme challenges in empirically testing macroeconomic models, it should be no surprise that economists might--as somewhat irrational humans--over-rely on theoretical models.

Yes, this was my point: that prior, economists had silly ideas about humans which make no sense.

Can you give examples of this done well? Genuinely curious, as I’ve not seen it.

Fair enough, but I don't think seniors who buy American Liberty Coins after watching Tucker Carlson were informed by Graeber's economic sins--whatever they may be--in "Debt". ;)

https://carnegieendowment.org/chinafinancialmarkets/86397 presents a reasonable argument for why you can't just compare debt-to-GDP between very different systems and expect it to make sense. (The US in particular is, of course, in many ways an outlier.)

"Debt" isn't about monetary policy, though. It's about the anthropology of money, trade, and debt. It seems to me that those aren't subjects exclusively, or even necessarily optimally, addressed by economists, who, as a different commenter (correctly) wrote* above, aren't actually interested in the history of those ideas.

* Interestingly, I think that was meant as exculpatory for economists, which is itself a bit revealing.

I think your criticism of Graeber is somewhat fair. And it's a fair point that incorrect popular/lay theories don't mean experts don't know how things actually work.

That said, I do think Graeber is right to emphasize the role of culture and belief--anthropological ideas--as an antidote to overly quantitative/mechanistic models. I'm not an economist, but it does seem like behavioral economics was pretty revolutionary in advancing the idea that humans are not just rational utility maximizers, despite Keynes using the term "animal spirits" nearly 100 years ago.

Again, speaking as a layperson, it's frankly a bit weird to me how distant economics, anthropology, and psychology seem to be from each other.

Yeah, but it’s not the norm.

Don’t get me wrong. Windows did a lot of work on driver stability. But I think cletus is too narrowly focused, and misunderstanding the context around Android and Fuschia.

Fuschia has been described as a replacement for both ChromeOS and Android, with a goal of solving a range of problems (not just driver compatibility) and unifying the target development platform (beyond the somewhat-limited Android-for-ChromeOS options that exist today).

It does not seem to me that it’s primarily about fixing Android driver compat, which could probably be done in simpler ways (and, as others have noted, Treble sort of kind of exists to mitigate).

(I also was amused that Cletus claimed that Windows drivers run in userspace—generally not true—while claiming that there are no real-world microkernel OSes.)

Huh? Are you saying that in Windows, drivers don’t run in kernel space?

https://techcrunch.com/2018/07/19/one-day-googles-fuchsia-os... says, as of 2018, “about 100” people work on Fuschia.

I find your “much higher than 1000” estimate a bit surprising.

Huh? It’s widely said that microkernels trade performance for security. You seemed earlier to be saying that running core functionality in userspace implies a degradation in security. Typo?

I'm far from an expert, but my understanding was that Weimar Germany did cause hyperinflation by printing Deutschmarks. But there's a really interesting point here:

They printed Marks to buy foreign currency with which to pay off war debt.

So, yeah, if you just run the printing presses on the Mark to buy, say, GBP, then the Mark will indeed lose value vs the Pound.

Critically, this scenario can't happen if all your debt obligations are denominated in your own currency, as in the US. The scenario where the USD experiences hyperinflation because the Fed has to crank out ever more money to pay off Treasury obligations simply cannot happen, but it's a fairy tale used, as best as I can tell, to scare gullible daytime TV viewers into buying American Liberty Coins.