rocqua

Are you perhaps reading a personal advice in a paper, disliking the advice, and then finding that due to the experimental design, it doesn't work on you. And then, rather than concluding the paper didn't intend to inform your personal routine, instead conclude that the paper was badly designed? Or to put it differently. Have you considered how many people live in a way you would never consider close to acceptable?

Because your points make sense but it feels like you are arguing against a bit of a strawman, or arguing for a mostly ideal situation rather than current reality?

For overweight and understrength people, is it not very valuable to know that they don't need the extra steps of resistance training to see real improvement in strength and fitness?

That's why someone suggested a non samesite cookie for reads and a samesite cookie for requests with side effects.

CSRF is mostly about causing side effects, not about access to information. And presumably just displaying your landing page should not have side effects, even when doing authenticated server side rendering. At least no side effects other than creating logs.

No, the program should take care to enable TCP_NODELAY when creating the socket. If the program gets passed a FD from outside it's on the outside program to ensure this. If somehow the program very often gets outside FDs from an oblivious source that could be a TCP socket, then it might indeed have to manually check if it really wants Nagle's algorithm.

I had a look, and it seems cool. But it doesn't seem to do the thing I love about Kani: work with only very partial annotations, only proving the annotations and being a very light lift on code not relevant for the annotations.

I've been trying to convince others of this, and gotten very little traction. One interesting response I got from someone very familiar with the Tamarin prover was that there just wasn't enough example code out there.

Another take is that LLMs don't have enough conceptual understanding to actually create proofs for the correctness of code.

Personally I believe this kind of work is predicated on more ergonomic proof systems. And those happen to be valuable even without LLMs. Moreover the built in guarantees of rust seem like they are a great start for creating more ergonomic proof systems. Here I am both in awe of Kani, and disappointed by it. The awe is putting in good work to make things more ergonomic. The disappointment is using bounded model checking for formal analysis. That can barely make use of the exclusion of mutable aliasing. Kani, but with equational reasoning, that's the way forward. Equational reasoning was long held back by needing to do a whole lot of pointer work to exclude worries of mutable aliasing. Now you can lean on the borrow checker for that!

I don't think the parent post is complaining that academics are writing proposals (e.g as opposed to people with common sense). Instead, it seems to me that he is complaining that academics are writing proposals and papers to impress funding committees and journal editors, and to some extend to increase their own clout among their peers. Instead of writing to communicate clearly and honestly to their peers, or occasionally to laymen.

And this critique is likely not aimed at academics so much as the systems and incentives of academia. This is partially on the parties managing grants (caring much more about impact and visibility than actually moving science forwards, which means everyone is scrounging for or lying about low hanging fruit). It is partially on those who set (or rather maintain) the culture at academic institutions of gathering clout by getting 'impactful' publications. And those who manage journals also share blame, by trying to defend their moat, very much hamming up "high impact", and aggressively rent-seeking.

Not quite. Because that requires pushing an update and only hits those who have windows automatic updates enabled. A lot of companies run those updates on a slight delay, which means they have a decent enough window to block such an update. Microsoft is a big thing to worry about when it comes to independence from the emerging fascist government of the US. But not because 'they can shut off windows'.

The short-term fear should be in enterprise cloud (See ICC judges). The long-term pain lies in blocking security updates (As happened to Russia). One might worry about malicious updates being pushed, but the legal grounds for that are flimsy to non-existent, and Microsoft has very strong business reasons to push back. So even the trump administration would be smart enough to instead target the cloud solutions. Since the legal precedent is very clear and well lubricated "providing services to sanctioned entities", and the business impact is equally crippling.

Linux is not a smart target. But OpenOffice, nextcloud, postfix, those are much easier targets for developer coercion to compromise widely installed software that is important for "linux on the desktop". Ah and ofcourse also the desktop environments, and perhaps systemD are all in a privileged position with much less eyes on.

I doubt that Microsoft has a kill switch. Though through automatic updates they still have pretty strong sabotage capabilities.

But the OS is not where Microsofts power lies. Its in exchange (almost everywhere cloud managed, including for many governments) and SharePoint, with a small amount of teams, where Microsoft is truly a scary prospect for sovereignty.

I believe the reasons we "regressed" into agriculture from hunting and gathering are much more complicated than "we moved into more marginal land".

It does appear that the median hunter gatherer life was better than the median farmer life. But I'd wager that to be true in most areas.

There's also a lot of specialized instructions like AES ones.

But the main thing that makes x86 CISC to me is not the actual instruction set, but the byte encoding, and the complexity there.

That depends on sizeof(*arr) no?

It's a well worn playbook by now. But Meta seems to be the only one where we now have proof of internal research being scuttled for showing the inconvenient truth.

This is line coding, often used on wired connections. But reading a hard drive trace isn't quite a wired connection, so the trade-offs are different.

Most notably with line coding when using positive and negative voltages it is quite important for the average voltage to be zero to avoid building up a charge difference. Whitening can often be used if the downside to an imbalance or long runs is much lower. Notably in RF this is often about avoid harmonics with a little bit of symbol timing advantage thrown in.

Whitening doesn't really require encryption though. Weak cypher streams xored into the data work fine. Even a repeated 256 bit string is quite alright.

Whitening using any non trivial encryption key seems weird to me. AES with a key equal to the current offset in ECB mode already feels over-engineerd.

Certifications prove that you studied, and are smart and or diligent enough to pass an exam.

If those certifications try to teach you bad approaches. Then they don't help competence. In fact, they can get people stuck in bad approaches. Because it's what they have been Taught by the rigorous and unquestionable system. Especially when your job security comes from having those certifications, it becomes harder to say that the certifications teach wrong things.

It seems quite likely from the outside that this is what happened to US traffic engineering. Specifically that they focus on making it safe to drive fast and with the extra point that safe only means safe for drivers.

This isn't just based on judging their design outcomes to be bad. It's also in the data comparing the US to other countries. This is visible in vehicle deaths per Capita, but mostly in pedestrian deaths per Capita. Correcting for miles driven makes the vehicle deaths in the US merely high. But correcting for miles walked (not available data) likely pushes pedestrian deaths much higher. Which illustrates that a big part of the safety problem is prioritizing driving instead of encouraging and proyecting other modes of transportat. (And then still doing below average on driving safety)

Thanks for the correction

Those numbers are too good to expect. If 90% right 10% wrong is the baseline would you take as an improvement:

- 80% right 18% I don't know 2% wrong - 50%/48%/2% - 10%/90%/0% - 80%/15%/5%

The general point being that to reduce wrong answers you will need to accept some reduction in right answers if you want the change to only be made through trade-offs. Otherwise you just say "I'd like a better system" and that is rather obvious.

Personally I'd take like 70/27/3. Presuming the 70% of right answers aren't all the trivial questions.

The point was about security updates. Without forced upgrades the whole ransomware thing would have been so much worse as just a singular example.

The automatic reboot has made the world a better place, because too many people were incredibly bad at making this risk tradeoff.

It might still be bad thing for taking away agency. But it was also a massive improvement to society.

From the perspective of Google maybe, but from the perspective of open source projects, how much does this drain them?

Making open source code more secure and at the same time less prevalent seems like a net loss for society. And if those researchers could spare some time to write patches for open source projects, that might benefit society more than dropping disclosure deadlines on volunteers.

This was not a case of stumbling across a bug. This was dedicated security research taking days if not weeks of high paid employees to find.

And after all that, they just drop an issue, instead of spending a little extra time on producing a patch.

Do you happen to know whether the worry is about the inertness of microplastics, and hence the physical damage of the particles. Or is it in the plastics being chemically interactive with tissue?

How well does the link need to be proven before we act?

The fact that we haven't found the causal link yet is not proof that there isn't one. And a whole lot of correlation suggests that there is. Why should we not take this as yet another reason to regulate throwaway plastic?

There's legally usually quite a big gap between what pictures you can take of people, and how you can publish them.

In places where you don't have a reasonable expectation of privacy, you can generally be photographed. But there are significant limits to how such pictures can be published (including social media).

Is the sun loud in radio frequencies too?

Given speed of light concerns. A week long delay is undetectably irrelevant.

To be a bit morbid, one could also explain OPs observation that "people are more fragile" by the lower child mortality by the hypothesis that these more fragile people wouldn't have made it through infancy before.

I don't particularly believe this, but it fits Occam's razor, so it seems to deserve some examination.

I slightly disagree. Specifically, in the case of academic lectures, on:

> The best power point slides have zero overlapping words with what the presenter is saying except perhaps some slide or section titles.

Especially when not taking notes, having the slides effectively be lecture notes is great to allow you to go back to the content of the lecture days or weeks later.

That does not mean that I want a lecturer to just read from the slides. But I want the slides to be more than just a visual aid for the lecture. They need to be reference material as well. This is also generally accepted, and can be considered the reason so many other presentations where this is a bad idea, still have the bad lecture-style slides. Because its what is modeled to people during their education.

Note, for presentations to stakeholders, or presentations of results, or almost any other type of professional presentation. Slides should probably be visual aids only, and not reference material. But lectures are a special case.

This worked great for me.

It meant that I understood the scaffolding of the course: the broad goals of the subject, the main ways to tackle them, what is currently being explored, and why are we going in this direction at this moment.

There was one class where this started to fail, which was a class without slides or a book. This meant that, without notes, when I recalled a proof technique but not the details, I had to resort to asking others for their notes. Because it wasn't documented anywhere else.

I'm annoyed every time I have to write $(which time). But the stats given by -v are just so much more valuable from gnu-time.