nirui

> sci-fi technology

You know, based on some people in China has learned building VPN/proxies, the best and cheap way to communicate under surveillance/censorship is to hide it in plain sight. In fact, that's how most these proxy software works.

So no, you don't need sci-fi technology. If you really want to communicate, context-coherent code words though bugged phone line should be enough, at least enough to arrange a meet up.

Also a interesting thought: maybe one day when human invented a device that could listen to quantum communications, we turn it on and ended up detecting a sea of encrypted conversations from another space-time perhaps even an universe just aligned with ours, and the device also experiences unexplained packet loss. That's what I call a plot of a sci-fi story :)

If you don't know, China runs censorship program against radio signals beginning from the cold war time and it's not officially stopped yet: https://en.wikipedia.org/wiki/Radio_jamming_in_China. Of course it's not blocking ionosphere level, but not that different than chaffing the air (at the receiver side).

I kinda wonder what if Microsoft (or any major software company) would give their engineers a few decades of time just to refactor their existing systems, opposite of piling on new features. Will it result a much cleaner code, better architect, and stable product?

The last Windows I daily use was Windows 7 Home (same era with Windows Server 2008). The newer ones don't really improved much featurely from my (user) point of view, and from what I've heard, it's getting more sloppyer every newer version.

Well, it's a war, some people will die. But if drone saves one, that's one life goes on, at least it's very important for that individual life, people often forgot about that when they drown themselves in numbers.

And, if this method got "industrialized", they'll probably use survey drones to do a scan first before more expensive bigger drone gets deployed.

Damn, how long they been fighting now? Years, as far as I can remember. You know sometime I think human beings don't deserve anything pass the tree stick age.

> An automatic keep alive would keep pinging if you're dead

Look it this way: an automated request, a email click, it's all just signal collection. If something keeps making an automatic requests beyond it's intended need, then it's just bad signal collection.

I'm pretty sure there are better ways, especially the intended sample rate is 1/week which fairly high fault-tolerant for the use case. For example, you can send keepalives only when user's device is unlocked and in use, etc.

But of course that require client-side development, not sure if you're willing to get your hand dirty on that.

Firefox is a browser so it make sense to implement their TLS like that.

But we're talking about a lib of a programming language here, things happened in there effects your own reputation when you ship something built on top of it.

So the real question is, has others such as OpenSSL done the same? If yes, then yeah it's normal, but if no then I don't trust people from Google.

> independent web developers

Hmmm... the market is kinda narrow.

But more importantly, say I self-hosted this service, then, I have to answering emails for the rest of my life telling a program I'm still alive. It's kinda high maintenance all on it's own.

That is assuming this service continuous to run without upkeep, at very least keeping it powered, and connected to the Internet. I'm not really sure what comes first, the end of my life or I got bored of doing it.

I know it sounded inapplicable for a lot of people especially who do remote works, but still if you're thinking about letting a machine run your death plan, maybe it's also the time to start make people connections, such as with lawyers, partners etc, people you can trust and have the capability of handling issues.

Also, if you do remote work, maybe setup an account inheritance plan if the platform supports it, assuming the account is dedicated for working for the effected team of course.

Also also, just an idea, what if you make the check passive? Instead of having to answer emails, some automated procedure will send keepalives to tell the program to not trigger? That will massively lower the cost of using it.

> AI Can Write the Code. Who Verifies It?

> Simple: automated software verification

> .... With the same clever tools, skills, and harnesses we use as AI engineers to push code at breakneck speed, we can build elaborate testing and verification automations.

So, in short, AI is going to verify it?

Not picking on ads, I'm sure the tools mentioned are useful, but exactly how effective they are? How many bugs it has discovered/reduced (compare to tests + human verification)? And how much time it saved? Without these info, the article is not that useful.

If you feel the need to quote that, just remember that it was from something written back in 2012. That was a time so beautiful, even the light reflected from a raw sewerage tank could create a full spectrum rainbow with twinkling stars if you capture and bring it to today's world.

Now days, the world has grown much bigger, and people are accustomed to unfamiliarity (the world of strangers), with no need to understand and love, with no need to bring people together. So the check is much straight forward and quick: if someone thinks stupid, acts stupid, then maybe they are stupid. Brutal and useful, high utilitarian efficiency.

> Looking forward to when fixing the game breaking bug means some poor sod picking through absolute spaghetti

Actually, if AIs in the future is truly realized as promoted, then you can just prompt the AI to get the problem fixed. The idea is, the dev in the future will never look the code ever, they give instructions and the AI implement the functions. It's like operate Jarvis from The Iron Man.

BTW, let's get off-topic a little since we're off the home page.

You know back in the day people called Elon Musk the "real-life Iron Man" and it's so cool and all? Now if you watch those movies again, it is just hard to ignore the detail such as how few people shown working inside the Iron Man tower and residence.

Maybe the true story of the movies was in a society of high productivity, mans who's powerful and dominating fight war with each other while regular people just trying to survive between the waves of destruction and reconstruction like ants in fire works.

Based on the setting `network.http.response.timeout`, which is timeout related, I'm *guessing* Firefox cannot distinguish between a network EOF or a logical/request-level EOF?

But that aside, it's kinda typical for a software from the developed world to have fault tolerance this bad. The engineer who wrote the code probably never ever annoyed by network error aside from a few well-known cases, and thus don't take these problems to their hearts.

For example, have you tried to download big files with a connection that has 100ms ~ 20seconds latency jitter? That happens with crossborder connections in/out of China. And in India, your users sometime experiences power issue which set their router to reboot or redial, that also causes an interruption in download.

Of course, people in these countries can't pay you much. But, these problems can all be solved/mitigated in software. Do you want to improve your software so it can be more robust, or do you want to waste user's time sitting in front your software just to get things done?

"Just let AI write all the code" is actually reasonable if (and probably only if) almost all code of the project was generated straight from the prompt and never get checked (but it's function still might).

It's like asking AI to generate HTML pages, then just eyeball it to see if the result fits the spec, all without reading the actual code underneath.

Is it ideal and good quality? Hell no, your HTML page maybe 50MB large and comes with some extra tags that's not even in the W3C spec. But... if you observe the behavior of regular consumers and what cheap shit they got lied to paying for, you'll know that most of them don't know (or maybe even care to know) about quality.

Also there's the fact that most top LLMs can now generate code that works mostly correctly, enough to keep most consumers from complaining, all of sudden it sounded reasonable for a for-profit company to try out this route.

Again, I really don't like where this is going, but I can't ignore what I see.

"Daily tasks" is still a bit vague of description. Based on my experience, even Flash could sometime make mistakes including something as obvious as simple arithmetic (kinda daily task if you do shopping/counting etc), or when the question is not defined enough.

I had some fond time using Flash, asking "what's what" questions against objects I found in nature etc. The answers I got were fine, so it was benefiting to use, but I don't think I'll pay for that, it's still not "assistant" level helpful.

> such that only the client and app server can see plaintext, and the relay sees only a jumble of ciphertext. A “gateway” sits between the relay and app server to handle all of this cryptography — decapsulating requests, encapsulating responses — and the app server handles only plain HTTP

Wouldn't that be better if you design an oblivious encryption method so the encryption and decryption is handled by the origin server (a.k.a Target Resource in the RFC) and the Client? Instead of letting anyone in the middle to handle that data?

Their current design looked not that different than if you just connect to a public anonymous SOCKS5 server (which don't decrypt TLS traffic) and uses it to connect to a website hosted behind Cloudflare. It would probably work the same way too, since someone has to host a "OHTTP Relay" the same way they host a anonymous SOCKS5 server.

> with government workers set to be the first batch of daters

Oh yeah, the government workers, a group of people known for their prolific dating and people skills. This will go so well.

"Any hard Nos for you?", well, those who ignored the calls to their number is a no brainer big No, and also those who don't know how to fill their SMFF-29f-A form, which is different from SMFF-29F-A. Everyone here hates people who don't know the difference between SMFF-29f-A and SMFF-29F-A.

I'm guessing by commercial software, you mean GitHub etc.

Well, I too dislikes their enterprise tune, "Changing is consistent, GitHub give you advantage (over other companies)" blahblahblah. Many developers I know are on GitHub because it was/is the place for individual developers to share code, not because the "company advantages".

HOWEVER, I can't ignore the fact that individual developers just can't pay enough to keep the machine running, so it's reasonable for GitHub to pivot towards commercial market. On the other side, GitHub is still benevolent enough to provide some enterprise-class service back to freetier users. This arrangement checks out for me so far.

I do self-host some of my projects too with Gitea. But I never dare to use my domain in my Go packages, due to long-term security concerns.

When I initialize my projects, I just use .internal domain, then if I decided to upload the project to GitHub, I'll change the URL to GitHub to make it more convenient to the users. Otherwise, manual download and `replace` directive like I suggested.

This don't make things better through.

Putin and Trump sits in the opposite side of the political spectrum, so as the country they lead, and yet they still managed to archive something similar.

It's not that hard to manage the country to a point where nothing in the country, even law, can hurt it's leader anymore. Sometime a bit of time and patient is all it takes.

The "We won't sell you data, pinky promise..." argument from article https://kevquirk.com/is-firefox-firefucked is reasonable, but if you're really hating AI ... well, Brave has their own AI called Leo, which is IMO even better implemented than Firefox's.

A GitHub URL at least is still an credible identifier, your custom domains is not, and likely will never be given how the system is accustomed to. Domain is for branding, not identification.

Unless of course, it's special domains that has identification built in, such as .onion which is generated in such way (cryptographic keys) no other people can easily obtain control even after the domain is no longer maintained.

If you really don't want to use GitHub, an alternative is just use .internal suffix (i.e. yourproject.internal/project) in combination with `replace` directives in go.mod. But that require your user to manually download/install your package and then edit their own go.mod.

Major Internet companies are still American-centrist, after all, many of them are American platforms and concerns (if not only concerns) American interests.

Google for example, they provide CAPTCHA to train their own AIs. Since Google mainly operate in the US, it make sense for them to optimize for Americans.

Another example is Cloudflare's CAPTCHA page, which is created based on measurements of American/first-world networks. But if your connection is "sub-optimal" (a.k.a, not first-world enough), it is possible that you don't even get the chance to load the verification scripts before the server cuts the connection and force a page reload, forming an infinite dead loop.

I feel the Internet is no longer international anymore, especially after all the AI scrapers. Now days are the days of contraction and everyone is guarding their own boring little caves against what they've defined as "thievery/stealing", while putting very little effort into actual useful thing such as gaining market and user (a.k.a expansion). The CAPTCHA implements maybe a sickness of it.

Depends on what you're doing, the "source-available" model may not work. Because many software earns their money through just few tricks, maybe it's more user-friendly design, maybe it's better predictive algorithm etc. These tricks hidden deep in the logic so it's hard for the competitors to figure out in months time.

But if you made the source code available, the trick will be reveled in plan sight and you lose advantage quickly. After that, you turned software making a laborer's game (you need add laborer to add and/or steal ideas faster than your competitors), it's way less fun.

If you want to make money, you have to play the art of balance. How much do you want to make open, and how much advantage you want to withhold.

I wish I saw this comment two years ago while the stock price of one of our local company is still cheap. I sold all my shared before the price slightly tanked, earning just around 14% profit. Now two years later the price has gone up ~100% and they paid dividends twice during the time.

Should have treated it the old-fashion way, not the modern day-trading way.

I think the example is still too generic.

First thing is, if your service has 7 call layers, maybe it's just too deep.

Second thing is, I found that retry strategy works the best if you define it based on what the nodes are actually doing (instead of treating them as generic nodes). For example, if node D is a database failing a transaction, you may just configure it to retry the transaction instead of doing an application-initialized request resubmit, because the database probably knows better about why the transaction has failed than the application connected to it.

Third thing is, retry is worth it only when progress has been and/or can still be made. If the resources is no longer available forever, then there's no point of retrying.

The problem about AI censorship is that, you can't preform bans without also create privileges at the same time. Sure, you can censor your AI to provide a "safe" version to the public, but someone will have the access/privilege to the uncensored version.

What stops the CEOs or even employees of the AI firms from creating something harmful such as WMDs etc themselves? They almost definitely already have that access. And this is not a zero-possibility thing, given how some of the top CEOs has preformed these years. Remember that one guy who did a \o salute in public, and the private island thing?

If Americans don't like Chinese AI, all cool. But then maybe they should start true open AI companies to build for the betterment of mankind instead of letting these few for-profit CEOs daily yelling nonsensical lies to cover those profit-seeking sinister asses.

I'm just reading the code here:

  // Before template expansion, .git was removed so that a fresh repo can be initialized; remove it again in case
  // some template variable usage has conflicted with this directory and impacts git operations.
  if err := root.RemoveAll(".git"); err != nil {
    return fmt.Errorf("unable to remove .git folder")
  }

Why the `err` isn't carried by the error message? For security? Then maybe log it internally?

User/operator can't really fix the problem if you keep giving them information this vague.

Hmmm, I was wondering who were the "volunteers or people paid to do fundamental research" (in their project docs), it turned out to be new grads LOL.

But I wouldn't blame Torrent or IPFS, these project maybe less shiny, but they actually work, so :)

If I may guess, given how delicate chem or bio weapons are, even if AI can lay out a method to create one, the first thing the weapon would destroy is likely it's creator(s).

Of course, with the exception that such weapon is created by organized crime groups, such as drug cartels such.

Probably don't worry nation states tho, these guys already got way worse things in their warehouses than what individual baddies could ever imagine.

Speak of that, I'm kinda surprised not one Full Self-Driving enabled Tesla has ever sneak out of their owner's locked garage to rob a bank or something.

Wonder what's up with the GNUnet (https://www.gnunet.org). Apparently there's still activity on it's development, but I didn't see adaptation/integration, even in free software like Linux. Sure it's not 1.0 yet, but the open source world is filled with sub 1.0 software that works great.

A stable online identify is important, that's maybe why you rent those domains etc. But after rent and forego quite a few, I slowly realized that domain at it's current format isn't a stable presence, instead it's more like branding instead of an identify. If an identify can be operated by different people without it's previous operator agreeing, is it truly an identify?

But I do need an identify, always under my control as much as possible, so people can trust the content and service running on it without having to guess if it's still me operating it.

Wow, you guys are really REALLY naive aren't you.

They made it sound like it, but this is not a victory at all, this is a temporary strategic compromise to silence the most sensitive/foreseen privacy advocator for now. But they will not stop here, instead they'll keep advancing the mechanisms, opinions and laws, so one day when the pieces aligned, they can come back to turn this tap off while having people lied to their side.

Forced age verification needs to be abolished completely and people who advocated for it punished to the point that their political career ends, this should be the baseline.

But of course, based on my understanding of everything, no, nobody will do anything effective against it. Everyone will just be "Yeah... they forced a component on my system that could act as spyware to monitor me, then have me pay for it without give me any control. But guess what, I will accept it because they said it's good for the future of mankind", like a peasant would. This is the tax you paid ended up for you, you know?