speedplane

> Bernie supporter here AND UBI supporter, (not Yang's version per se though). I support a bigger more expansive UBI that would basically cover all food, housing, and major monthly expenses.

I agree that those basics that make up common humanity should be covered. But I differ on how to get there. UBI means writing a check to someone, and letting them spend it how they wish. They can spend it on food and healthcare, their startup, or alcohol and gambling.

But if the purpose is to set a minimum level human decency (food, housing, healthcare), then we should provide that level of decency, rather than writing a check and hoping people will use it wisely. If an entrepreneur takes their UBI check and rather than buying healthcare, puts it into a startup that eventually becomes big, that may be a better result for the overall economy, but we've still failed that person in providing a minimum level of humanity.

The moral purpose behind UBI is not to just write checks, it's to allow humans to retain their humanity. Providing solid public schools, healthcare, and basic housing better provide that minimum level of dignity than sending a person a check.

> there is more to an economy that processor speeds ... I frankly do not know how much increase in modern hardware capabilities contributes to the productivity of the economy.

In industrial times, you would be right. However since the "information revolution", a huge amount of productivity gains can be directly attributable to transistors. Sure it started with improving simple calculators, but then came spreadsheets, industrial CAD models, instantaneous global communication, remote teams, global branding and a whole lot more.

In fact, it's pretty fair to say, that nearly every standard of living improvement in western countries since roughly 1980 can be attributable to the transistor.

> Yang supporters believe expats should also get the freedom dividend.

Well, this is what Trump believes. A solid 30% of the U.S. stock market is owned by foreigners, and so when U.S. corporations used their Trump tax break to increase their market value, 30% of that effectively gave foreigners a bump.

His tax plan effectively increased taxes in expensive "blue" states and gave that money to foreign investors.

> Yang is unequivocal that expats should not receive the dividend while they are abroad.

What is the moral basis for this? Pretty much every other U.S. right and rule is grounded on U.S. citizenship, not where you're currently residing. Basing rights on where you live (rather than citizenship) also leads to some weird results. If you deny expats some right because they don't live in the country, then shouldn't you grant non-citizens who are indeed living in the country those same rights? After all, the standard is where you live rather than citizenship.

We shouldn't ban any technology. However, we should ban a technology when it is used for _____. The ban should cover the use, not the technology itself. It's fine to make building a nuclear bomb illegal, but studying radioactive elements should not be.

Similarly, the technologies this article describes "identification, correlation and discrimination" should not be outright banned, but maybe they should be when their use conflicts with other important values (e.g., due process in criminal prosecution, privacy rights).

Recent targeting of facial recognition does not "miss the point", the reason it has become an issue is because it has started being used in the criminal justice system. No one really gets upset when it's just used to tag your photos.

I know developers love abstractions, but we should not try to build abstractions of technology and regulate those. To borrow from the article, identifying a person based on their "gait" is not nearly as serious an issue as facial recognition, even if abstractly they may seem similar to a developer. Instead, focus on the direct problem at hand, regulate it, and only after the passage of time when commonalities become clear, build an abstraction.

Given that most cosmology relies on a huge percentage of dark matter, which cannot be detected, and a huge amount of dark energy, with enormous conflicting calculations, I think it's fair to say that astronomers are wrong about a lot of things.

> You probably can't [live in a home that loses 90% of its value], because there must be a reason for it to have lost 90% of its value

I agree 90% is extreme. However, the nice thing about owning a home is that even if it loses value, more often than not, other homes will also lose their value.

Say you buy a 1 bedroom place for 500k, and 5 years later you have 2 children and need a 3 bedroom place, but your home lost value and is now only worth 400k. The good news is that the 3 bedroom place also probably lost value. So even though your home decreased 20% in dollar value, the 3-bedrooms also did too, so your house (as far as in-kind value) is worth the same.

In fact, in some cases you could go further and say it's good if your real-estate loses money. Suppose that you bought that 500k place, and had 100k left in your bank account afterwards. Now 5 years later the real-estate market sinks 20% and your home is worth 400k. Suppose you didn't invest your 100k and it's still all cash. When the housing market sinks 20%, your in-kind trade value plus your existing cash is actually worth more than if the real-estate market did the opposite.

For the above reasons, it's better to think about your primary residence as planting a flag in the area that you want to live rather than a financial investment.

> I think the bigger thing for Open Source Chips is going to be the expiration of a ton of the x86 patents next year.

AMD has been building x86 chips and the patents haven't stopped it. ARM has been building non-x86 chips and the patents haven't stopped it. I'm failing to see how the expiration of x86 patents will have any effect.

> Once the mess becomes a burden, it's a good time to clean up.

Definitely the way to go. It's not a problem until it's a problem.

This trend (if it's actually happening) is a symptom of the death of Moore's law. When Moore's law was operating in full swing, it would rarely make sense to build your own chip using open source. In the time that you could design and build your chip, general processors would have doubled in speed and you'd be better off waiting for the general processor.

Here are a few predictions, some of which have already occurred, that may result due to the death of Moore's law:

Already Happening:

- More custom chips (squeezing the last bit of performance)

- More reliance on the cloud, to push off processing power where there are more economies of scale

- The rise of traditionally "second tier" processor manufacturers (e.g., AMD, ARM) to be head-to-head with traditional leaders (e.g., Intel).

- A greater amount of chip manufacturers R&D dollars spent to each dollar of revenue.

Starting to Happen

- China and developing countries catching up with chip technology (when the leaders are no longer growing exponentially, it's easier to catch up)

- Governments imposing their will on chip developers (when there is less competition over performance, other factors like trust and national origin will start mattering)

- Trade secret theft, i.e., in the past if you stole Intel's designs, you would get one good chip, but that theft would be obsolete in 18 months. Now, it gives you a much longer advantage.

- An societal shift from utility to branding, i.e., as all goods start becoming equal, branding is the main differentiation.

- Living standards catching up to western and U.S. standards.

Further Afield:

- No significant technological improvements for decades.

- Stagnant per-worker/capita productivity.

- Economic growth becoming far more tied to population than individual productivity.

- Economies/governments fighting to increase their population (e.g., through legal immigration or by force).

- Government's power and control becoming based more on population rather than ideals or innovation (e.g., China).

- More monopolies ... in a dynamic and innovative society, a small smart company can defeat a larger slower one. In a stagnant society, that won't work and the competitive advantage can only be obtained by consolidation and economies of scale.

- Social unrest ... in an exponentially growing society, there is room for every generation to become wealthier than their parents, but in a flat society, on average half will become richer and half will become poorer.

> A lifestyle business is one where the owners have set a target business size and profit level, and do not try to grow past this; some owners even actively inhibit growth to keep the business from getting too large.

I think this is too far narrow a definition of "lifestyle business". The better definition is simply a business that fits the founder's intent and lifestyle.

I know several founders that started from nothing, built their company to turn a sizable profit and resisted big VC money.

It's demeaning and inaccurate to call them "lifestyle businesses", they made a calculated decision. Roughly, they took a chance with self-financing, and maybe a ~40% chance bet on making a good living, versus taking the VC money and having 3% on becoming unbelievably wealthy.

Given a 40% chance of making several million and a 3% chance of making billions, it's pretty reasonable for folks to take the higher probability, even if the statistical expected value is better with the VCs. These aren't people who "gave up", often, they made the smarter decisions.

What's saddening is that Mint was so ahead of their time in this area, but it just didn't happen.

Why can't your banker do your taxes for you? Why can't they tell you how you'll pay for your kid's college tuition? Why can't they give you a personalized budget to reach some level of wealth in a certain number of years? Why can't your banker tell you when you're ready to buy a house or if you're borrowing more than you can realistically afford? Why can't they tell you when you're reaching dangerously high credit card debt or whether you can really afford that auto-loan?

They could do all of this with the current data that they have. But imagine if you gave them more data, like your current employment position, geographic location, and family status. They might be able to tell you if you're being under or over-paid, how others similarly situated plan their savings, or when is the right time (if ever) to move from renting to owning real estate.

Banking systems have an enormous wealth of data, that can do so much good, but they are still mostly a simple table of deposits and withdrawals.

> From what I have seen of Yang Gangers, that could very well have been the result of real people.

Maybe it is, maybe it isn't. The very fact that people are questioning whether political support is real or not the significant problem.

> after responding to someone's comment about the Universal Basic Income (UBI) concept, and got spammed with negative replies. I figured it was just ardent supporters, bots make sense though given the speed of the responses.

Ardent non-supporter of UBI here! Not a bot!!

The nefarious issue with UBI is that it threatens our existing social safety nets. The social goal is not to give everyone a single basic income, it's to give everyone a single basic standard of living.

It's far more fair and moral to give folks access to basic standards of human decency (e.g., healthcare, education, housing, food, air), than writing them a check and letting them fend on their own. The moral underpinning of social safety nets is not to increase the total or average, but to increase the lowest.

> The author presents no evidence of these accounts being bots other than them being closely connected and cliquey.

The sad truth is that the vast majority of bots are extremely unsophisticated, they don't even try to hide their IP address through a proxy server, and basic tools like Google Analytics can identify this. In Google Analytics, just find the "Network" section, and see how much of your traffic is from "amazon web services", and just block all of it.

It may not block sophisticated scrapers, and it could potentially harm legitimate users (e.g., amazon based VPN services), but it's amazing how much "bot" traffic is identifiable.

The only real bot traffic that's hard to identify are actual people with machines that have been compromised.

I don't have a problem with procrastination, and I don't feel guilty about it. I think it's optimal.

Generally, try to find out the last day something is due, figure out if that's a hard or soft deadline (if soft, get an extension), estimate how long it'll take to do the work, and then start the work exactly within that time limit. Doing it any sooner means that you're likely putting off even earlier deadlines.

Procrastinating is not a problem, submitting work late or low quality is.

> I think that's exactly what Amazon meant here. See the comment someone posted elsewhere in the discussion about PopSockets

I can't speak to PopSockets, but both Tile and Sonos are companies that are small enough to still have a huge amount of runway within the U.S., Europe, and Japan. I would be very surprised if this dispute was because Tile/Sonos were selling their products at a discount abroad and Amazon was threatening to bring that discount into the U.S. The far more likely scenario is that Amazon is threatening to promote cheaper knock-off goods that likely infringe patent and trademark rights.

The reason that Amazon can get away with this, is that enforcing those patent and trademark rights is incredibly expensive, potentially millions of dollars a year. Amazon is smart and knows the cost of litigation, and likely asks for discounts close to (but a bit less) than the amount that it would cost the company to actually defend their rights.

> I think the portrayal of the lawyer's lifestyle is a little exaggerated, but I agree with the larger point. Pay and work conditions are determined by social status as much as anything else and in the US, at least a lot of it (perhaps not the Bay Area), lawyer is a higher-status job than most. ... "Free pizza and snacks" does feel pretty infantilizing.

You point to two pretty important reason why lawyers continue doing what they do, and why the career path remains attractive compared to engineering, even if lawyers ultimately earn less.

1 - In general, as a lawyer, your perceived value goes up over time (gray hairs are money-makers). Whereas, in general, as an engineer, your perceived values goes down over time.

2 - A lawyer has a sense power. The legal field requires them to be independent (they are beholden to their clients, but not anyone else) and also knowledgeable on how to navigate (or manipulate) the system of rules that society has put in place. This provides some sense of power and agency. Today, even though many engineers probably "know" more about how individuals or society is manipulated, they generally work for major companies, and even those that do not don't have the incentives to properly bring such injustices to light.

If engineers were somehow incentived (i.e., make money) from outing perceived technical injustices, I suspect they would quickly eclipse lawyers in both compensation and stature.

> How can Person 2 be sure that Person 1 hasn't modified the API response before Person 2 receives it? ... If the API response is signed somehow, Person 2 could go retrieve Service A's public key (directly from Service A) and independently validate that the API response was actually received

The problem here is that Person 1 cannot be trusted, so they can't be the one providing the signature. Even if Person 1 signs, hashes, or encrypts the message when sending to Person 2, all it can prove is that it came from Person 1, not that it came from Service A.

If Person 2 wants to be sure that the message it got from Person 1 actually came from Service A, it will need the signature provided by Service A, not Person 1. To get the valid signature, it will need to contact Service A.

This is a long-winded way to say that if you want to trust what you got, you've got to go to the original source. HTTPS provides tools to do exactly this, and it's special because every time you buy a computer or server, trusted certificates are pre-installed on the machine. Without that initial level of trust, you can't trust anything you receive from anywhere.

> HTTPS gives you no guarantees that the license server you think you are talking to is the real license server

What? This is the entire purpose of HTTPS! To do this securely:

1 - you create your server;

2 - you tell a certificate authority (like Symantec, Digicert, or Let's Encrypt) how to find your server, and they do the diligence to make sure you're not trying to redirect another person's server;

3 - they provide you with a private encryption key and expose the public decryption key;

4 - you save the encryption key on your server.

Now, anyone who receives any information from your server can be sure that it came from you because (a) your server is the only one with the encryption key and (b) we trust Symantec, Digitcert, etc to distribute the public decryption key.

> So you cannot use HTTPs to prove to a third party a response or a request when using client certificates is genuine.

HTTPS is not sufficient for such third-party exchange, but they are necessary.

If you (say "System 1") ask for a twitter feed from an intermediary (say "System 2"), which in turn scrapes the data from twitter itself (say "System 3"), then HTTPS can indeed help. You can't rely on any hash or signature produced by System 2, because they could modify the data and make up a new hash. Instead, you would need to rely on the hash from System 3, to confirm that what you received from System 2 is authentic. Only tools like HTTPS, with their pre-installed security certificates, can do that.

>> APIs do not need to sign every response, they just need to properly use HTTPS.

> That doesn't make sense. The problem described in the article was that the request documents aren't signed, thus there is no way to verify if a response document was actually outputted by a web service.

Suppose that you ("System 1") is getting data from an intermediary ("System 2") which in turn is getting data from Twitter itself ("System 3").

Even if the intermediary System 2 signs the data, all that proves is that you got it from System 2. It does not prove that it was not tampered with when System 2 got that data from twitter directly, System 3. It would be easy for System 2 to tamper with the data, and come up with it's own signature.

If you, as System 1, want to confirm that the message you got from the intermediary (System 2) is authentically from twitter itself (System 3), you would need to get the signature from twitter directly. You would need to ask for twitter's signature (System 3's signature), not the intermediary's.

So system 1 will need to contact System 3 in order to validate the information it got from System 2. There's no way around this.

> I think you are right. ... At some point system 1 will need to talk to system 3 to validate the message

Yes, this is why any post claiming to "roll their own security" is a farce. The current way security works (using HTTPS) is to pre-install trusted certificates on the machine at the hardware manufacturer or OS installation level. The keys that are pre-installed are this initial high level (usually root certificates), can then secure lower level machines, which can further secure even lower level machines. This only works because we trust our hardware manufacturers (e.g., Dell, HP, etc.) to install the correct certificates. These manufacturers are analogous to "System 3" in the example above.

> it's s possible, for any number of reasons, that one might want signed API responses independently

At it's core, HTTPS works because there is a distributed system of trust. The principle is that you don't need to directly trust the server that you're communicating with, but you trust another computer that has vouched for the one you are communicating with.

If you roll your own security in any way, at some point you need to send an encryption or decryption key. Even "unhackable" encryption algorithms are worthless if your adversary knows the key. Thus, you need a way to communicate that initial key information securely. Currently, the only way to do that is by (1) manually entering the key on each server, (2) using near sci-fi technology like quantum communication, or (3) by having the keys pre-installed on every machine by the hardware manufacturer or OS provider.

The option that has worked, HTTPS, uses option 3. Maybe you can roll your own encrypted communication system, but you'll either have to rely on manually entering the keys (which in turn rely on other insecure methods like email and phone), or trust the computer's manufacturer to pre-install the keys on the system your using.

There really is no way to "roll your own" system securely without these steps.

> If the engines don't start, or you don't get the predicted thrust out of them, well, that's why it's called a suicide burn.

Fair enough, but this is exactly what the Soyuz has done for decades, and NASA (as well as Roscosmos) found the approach to be acceptable for human spaceflight. It may introduce complications, but it's clear that it's doable.

> That's why they are talking about signature from system 3 along with the payload. So even if they trust system 2, they can be sure system 2 has not tampered with the message generated by system 3.

No that wouldn't work by itself. System 2 could tamper the data, create their own signature, and send it to system 1.

The only way it could work is if System 1 got the signature directly from System 3, or at least got System 3's public signing certificate. Either way, System 1 needs to communicate directly with System 3 to ensure the data it's getting from System 2 is authentic.

> while maybe you could technically accomplish it with HTTPS, there are huge usability gains to be had in exchange for the inefficiency of duplicating some lower-level functionality

If you are not using HTTPS, you cannot just build your own "higher level" version of secure and authenticated communication. HTTPS works because trusted certificates are pre-installed on each of the machines before they start communicating. Without those pre-existing trusted certificates, no amount of encryption, signing, or hashing can guarantee secure and authenticated communication.

> OP is talking about system 1 getting a response generated by system 3 VIA system 2 (potentially trusted man in the middle).

So they are effectively saying that they do not trust system 2. If that's the case, a signature from system 2 would not help because the signature itself could not be trusted. They would need the signature from the original source, system 3.

> They're not talking about the person making the API request needing a signature to verify its authenticity. It's about if someone else sends you an API response that they retrieved, you should be able to verify it wasn't tampered with.

If a system retrieves data, it should do so with HTTPS, and then it's authenticity can be guaranteed. If it does not use HTTPS (or some similar protocol), then it's authenticity cannot be guaranteed and no amount of signing or hashing can fix that.

> The Superdracos are powerful engines but they don't have anything near the delta-v to always return to land after an abort even if you fill the entire Dragon with propellant. So you'd always need the chutes anyway.

Not sure that's true. The chutes bring the speed of the capsule down quite a bit, just a short burst of the dracos at the last few feet could allow it to softly land and wouldn't require much propellant. This is exactly what the Soyuz does. My guess is that this approach was rejected by NASA (not SpaceX) due to complexity rather than feasibility.