sharkbot

Don't forget to include:

- Link: The Faces of Evil

- Zelda: The Wand of Gamelon

- Link's Crossbow Training

- the various Hyrule Warriors games

Good luck! :)

According to the linked article, that’s exactly what they did. It was a legitimate bug, but the security consequences were lower than low. It’s a code quality issue, not a security issue, but both are worth fixing.

Agree. Purely opining, but I assume that it's because of the emotional connection that artistic media has on people, despite the flaws.

People remember the emotions the artwork engendered, and thus the whole work is associated with the feelings, flaws and all. If the work is particularly widely known, the flaws can become a stand-in for the work itself.

I see this in video games - I'm fond of the NES-era "flaws" and limitations (palette limits, sprite limits, sound channel limits), but less connected to the Atari 2600 or SNES/PS1/NDS/etc flaws. Shovel Knight is charming; A Short Hike, while great, doesn't resonate on a style level.

There are parallels to the “rapid application development” push of the 90’s. Visual Basic, Tcl/Tk, Python with Tkinter, HyperCard; all of them promised shortening the development cycle and democratizing computing. Code was interpreted rather than compiled, dynamically typed rather than statically, and a lot of batteries were included.

It sorta worked, and sorta didn’t. I’m seeing no evidence that this round is different. LLMs allow coding via natural language and assuming a lot of context that is typical to human conversation, but a lot of coding is delving into nuance, which is going to be work, no matter the tool.

There is no formal “next in line”. The closest potential successor would have been the deputy prime minister; Chrystia Freeland held that role until a few weeks ago when she dramatically resigned and sparked this chain of events.

Currently, this is “Working as Intended” in Canada’s political system.

Now for the most important question: can you run DOOM on it? :)

I’ve been thinking about this topic thru the lens of moral philosophy lately.

A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule.

Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and aligning with virtuous characteristics), where rule following isn’t the main focus. I’ve been part of (heck, I’ve started) lots of debates about the value of some arbitrary control that seemed out of touch with reality, but framed my perspective on virtues (efficiency, convenience) or outcomes (faster launch, lower overhead). That disconnect in ethical perspectives made most of those discussions a waste of time.

A lot of security debates are specific instances of general ethical situations; threat models instead of trolley problems.

I’m thinking of the metaphor between Newtonian and general relativity. At low energies, masses and velocities the two theories correspond in predictions with little discrepancy. If the velocity/mass/energies increase dramatically, then Newtonian physics will fail to give accurate predictions.

Same with “hire smart people and let them work”. When salaries are relatively low, consequences are limited and incentives are well aligned, that approach works. As soon as any of those things change, then the “manager mode” fails dramatically.

As someone who ascribes to “manager mode” most of the time, I’m going to start looking more at places where the assumptions break and (carefully) try out “founder mode”.

I think that’s an oversimplification. If you have a Windows system handy, look for a file named “errata.inf” [0]. It’s a giant configuration file that is full of tweaks to make dodgy hardware work reliably.

Hardware, software and firmware are all prone to mistakes, errors and corner cases that are surprising. Security issues generally live in the intersection of systems with different metaphors. Hardware is not immune from issues, and software can help reduce that impedance mismatch.

[0] Found an instance here, no claim to its veracity or safety: https://www.gherush92.com/documents/744E.asp?type=2&file=C%3...

It's also a complex number, a Unicode character, an ASCII character, an Extended ASCII character, a glyph, the multiplicative identity element, a raster image, ...

The GP point is correct; we implicitly convert between all these representations naturally and quickly, but there are interesting branches of mathematics that consider those conversions explicitly and find nuances (eg, category theory).

This might be No True Scotsman, but it doesn't sound like you are a "finger gunner" after all.

After (fairly) long time in the industry, it seems to come down to:

- understanding what one's clients need (not what they ask for)

- understanding what's in the realm of the possible (technically, politically, organizationally)

- understanding what are the possible futures (good, great, and abject disaster)

If, after answering all those questions, one still advocating for a rewrite, you've shown the maturity needed to undertake the effort.

"Finger-gunning" is usually related to skipping those steps, not the ultimate decision.

(edit for formatting)

I feel like there are parallels to computer security. A lot of my experience in this domain is looking at systems that were designed in a thoughtful way, but the designer didn’t fully appreciate being surrounded by a universe (especially one full of people of varying mixes of deviousness and cleverness).

The “real world engineer” job exists, it’s a security engineer. And it’s equal parts awesome and draining.

I don’t have your answers, but the runtime source has some pointers that would likely get you the answer you seek: https://github.com/golang/go/blob/master/src/runtime/HACKING...

It sounds like blocking calls switch to a system stack and return the Go stack to the executor pool, but I don’t have source links to back up that claim.

Just to be clear, there are many aspects of biology that that professor is ignoring on a regular basis that you’ve elided (hibernation, molting, limb regeneration, etc). What specifically about procreation is important enough to call that individual’s expertise into question?

What are alternatives you would suggest to these frameworks?

(I am also deeply skeptical of these frameworks, but don’t have a strong argument against them, and they seem pervasive in the security industry)

But the Ferengis changed their society to include “fe-males” due to internal politics and change from within. It wasn’t instituted from the outside, it was Ferengi society advancing via the means of their own political system.

I think that speaks highly of the Ferengi social system.

Buy a TE pocket operator. They are reasonably priced. If you like chiptunes, PO20. If you want to sample, PO33. If you want a drum machine, PO32.

I have an OP-1 and a collection of pocket operators. The PO’s are my favourite creative outlets, by far.

Mostly a note to self: it is interesting to read this account and connect it to the financial planning case studies that show up in personal finance blogs and articles. It seems like there’s a lot of shared terminology and practice between the domains.

Incorrect. The program under inspection could halt or could not halt; undecidability is a statement about Turing machines inspecting that program and unable to make a determination (via a clever proof by contradiction).

The Halting Problem is a truly interesting result, and for the most part uninteresting in practice.

The halting problem has been proven definitively undecidable via proof by contradiction, by Alan Turing. The proof implicitly created the notion of Turing machines, a key model of computation.

There is a solution to the halting problem. It’s that it is undecidable.

It would be interesting have a Forth running on it, as I feel the philosophies are aligned.

I don’t mean to belabour the point, but I think the nuance is worth exploring.

The key point in my view is “control”. You’ve referred to Uber.com/Xmas-sale as an example where Uber the economic entity is in charge of their own shortening and therefore avoids the problem. However, Uber the company may fall on hard times, sell their real and intellectual property and we’re facing the same issue of a lifetime mismatch between an owner and an URI.

Incentivized blockchains are theoretically singletons and perpetual; the worst case of a history rewrite is economically disincentivized. The lifetime of the URI database exceeds the URI lifetime.

In practice, I agree with you that companies should ensure control over their URIs over their lifetime. The advantages of a blockchain approach are far outweighed by the current downsides.

The article talks about ownership transfer of a url database and the potential for history rewriting. An incentivized blockchain could be part of the solution to ensure history rewrites are not economically possible. I don’t have a protocol sketch, this is just a marginalia comment.

Exercise left for an interested reader, which sounds like isn’t you :)

I can barely believe I’m typing this, but an incentivized blockchain (aka Bitcoin et al) is a legitimate option to ensure a coherent and mutually agreed upon history of information in the face of competing economic actors. Too bad about the climate change and scams that seem to be part of the bargain…

I think it could fit in with a conversational chat bot the same way that ads are part of podcasts and YouTube channels: a conversational and explicit ad that helps pay for the otherwise freely available content.

Full disclosure: I work at Google, but nowhere near the chatbot stuff. This is my humble opinion and nothing more.

I won’t comment about your other topics, but I’ll point out that current inflation is far from “maxed out”, at least in mature Western democracies with their own central bank and currency. ~9% is high historically, but inflation has run hotter in the not-so-distant past.

2% inflation is not a natural state of affairs, it’s a target that’s considered the “appropriate” amount of inflation.

If someone wanted to get in touch with you, what would be the best way?

There are a few paths forward for you, and a lot hinge upon your skills outside of security (somewhat your morality).

Computer security is a lucrative field, and a broad one.

You could continue the bug bounty approach, which leads into vuln selling (with the attendant morality questions). You could go into systems security research, a long term project but worthwhile intellectually. You could contract (needs networking and business), you could FAANG (needs patience and soft skills), you could government (needs patience and more patience).

My advice: don’t rush. You have at least 50 years of career ahead of you. The decisions you make now will influence your direction for years, but there’s very little you can do to completely derail your future. Try some things, see what resonates and clashes and learn more about you.

Context: 25 years in computer security in a variety of roles, currently FAANG, currently management. My 17 year old self would likely be somewhat surprised at my circumstances, but hopefully not upset :)

In fairness, I would likely never been recommended that book unless this article had been published and remarked upon by you, so I think there was some value even if you consider it ancillary.

I’m going to pay forward a book rec found via a Hacker News comment: Never Split the Difference by Chris Voss.

It’s mostly tactics on how to negotiate well, and one piece of advice I’ve adopted is to start my questions with “what” or “how”, not “why”.

“Why” comes across as interrogative; forcing “what” or “how” creates enough time to reassess the actual uncertainty and rephrase as a curiosity question, not an implicit accusation of wrongheadedness.

“Why did you choose this algorithm” becomes “how did you choose this algorithm?” or “what factors did you consider when choosing this algorithm?”

It can be manipulative when done in isolation. My other main takeaway from the book was to have a genuine interest and concern for the other person’s needs, even when you disagree.

Between the trick and the mindset, I’ve found it’s served me well.