tatersolid

> nor can you trust them to be honest

We trust juries with locking people up for life if necessary and settling billion-dollar lawsuits. That’s the beauty of sortition. Most randomly selected people are honest instead of biased party functionaries.

Even if you got 3/4 registered Republicans at one polling location via sortition, the chances of those being people willing to cheat the election is very small as they are random citizens.

Similar to jury selection you would probably keep identity and assigned location secret by law until Election Day to prevent tampering.

Voting officials should be selected by sortition at all levels, similarly to jury pools. Allowing self-selection can allow for collusion or a biased pool of election workers and judges, especially in cities/towns with an established single-party patronage bureaucracy.

I’ve taken to using “US/Eastern” or “US/Central” for clarity. The normal folk understand this format perfectly and they are part of the IANA standard time zone list (aliases for America/New_York or America/Chicago). Also avoids confusion when working with folks in Europe for whom EST means UTC+N depending on the country and time of year.

> We'll probably never convince end-users to "vote with their feet" and use Privacy-focused products.

I’m not so sure. The iPhone is the most popular in the USA despite the cost premium.

Still a fan of Hover. No crap, no scams, just works.

I know it has no security impact in this case, but isn’t it odd a bunch of cryptographers would choose a weak PRNG seeded by the date for a task like this?

Even state lotteries back then used physical ping pong balls and a nothing-up-my-sleeve show after the evening news.

The prolonged conspiracy theories until this discovery make some sense… not having a ceremony around anything supposedly “random” is unexpected, even back in the 1990s.

Based on the features and design, did Anthropic just re-invent and vibe-code Subversion?

> log parsing

There’s your problem right there. You’re lighting money on fire using an LLM to do a token-intensive deterministic task.

To minimize annoyance I’ve set my password manager to generate 16 character random passwords by default. This seems to be the sweet spot for the USA; I don’t recall recently encountering a site with a min >16 or a max <16. Assuming 85 chars that’s ~102 bits of entropy so plenty strong and compatible with almost every site (excepting the rare idiots that ban repeating characters or some subset of symbols).

General Magic failed with all the talent and all the resources. Cautionary Tales podcast featured General Magic in a recent episode; the basic argument was no constraints led to no focus.

My kids stopped saying “six seven” about a year ago. I still have no clue what that was about.

> sites are extremely pushy about replacing your perfectly good password with a passkey

Your password was never “perfectly good” because it is easily phished. Even with TOTP or a push notification app as MFA.

Phishing is an huge risk even for “expert” technical users, and such phishing is the cause of a huge number of breaches and supply-chain attacks.

> most systems have the same username and passwords (customers never change the defaults)

That is horrifying and 100% on your dev team. You should not ship default credentials, instead require unique creds to be set at install. Ship an update which required default creds to be changed.

Who do you think you are, Cisco?

Entra External ID does not allow export of password hashes.

It actually doesn’t allow a whole shitload of stuff that should be there by now.

For example, it supports passkeys, but has no UI for adding or managing passkeys. You have to build that yourself. In a separate app, on a separate domain.

USB Ethernet dongles generally suck. Even “name brand” dongles are cheap crap from contract manufacturers.

He’s a Florida Man. Do not underestimate his capacity to defile himself.

https://en.wikipedia.org/wiki/Florida_Man

Current nuclear-powered ships are run by the world’s premier naval powers and protected by their own stealth or a huge array of armed escort ships.

Have these guys factored in the cost of a task force of protective missile frigates, subs, and destroyers at each site?

It’s a rehash of a conflict from abut 3000 BCE onwards. Who really is the “historical people” of the land that is now Palestine/Israel has been the subject of bloody conflict for 5000 years.

So this is strange, it popped up on Cloudflare’s RSS feed so I thought it was new. I’m guessing they edited the article but haven’t been able find a a diff against the original 2022 version.

The Indiana variant of this phrase was “tighter than two coats of paint” which meant a person who was tight with money (cheap).

For tracking uniques, why can’t we just set a “first_visit=false” cookie if not present on first request? The number of new unique users is then the number of requests that came in without that cookie in whatever time window. Expiration timeline left as an exercise for the reader (month, week, whatever).

This zero-entropy cookie cannot be linked to a specific person and would not require consent under any privacy law I think.

Guild-style unions seem to be about setting and enforcing cartel pricing, not work quality. At least for the construction and remodeling subcontractors I encounter.

Why can’t Postgres auto-tune these values itself in 2026? Microsoft SQL Server has mostly done a good job of this since about 2005. It will set parallelism thresholds, soak up as much cache RAM and CPU as the runtime environment allows, etc. It will give RAM back when the OS is under memory pressure, and schedule worker threads based on current resources.

A DB with a privileged supervisor process could generally detect how much free RAM, CPU usage/layout, etc at startup and re-evaluate periodically while running.

Illinois bans nearly all fireworks, not just commercial grade. You can basically only buy sparklers or tiny fountains.

You have to visit Wisconsin or Indiana to get anything that pops, spins, bangs, or flies. Even those little ground spinners are banned in Illinois and they are hardly “commercial grade”.

That’s generally too slow though; these things run in kernel space as they scan every I/O stream. Context switching and memory copies would kill performance.

> they have not hiked up their prices yet

That one aged poorly. Apple massively hiked prices 2 days later, by thousands of USD on some RAM-heavy configurations.

https://news.ycombinator.com/item?id=48672732

This is market-dependent. We offer email OTP login for small business customers because it is “poor man’s SSO”. You’re basically validating the recipient is still at the company, able to receive at their work email.

Larger customers have IT staff and set up OIDC or SAML with us. We don’t add an SSO tax.

Clarification/correction:

The Nagasaki “Fat Man” bomb was the same plutonium implosion design tested at Trinity.

The Hiroshima “Little Boy” bomb was the uranium “gun” design that was never tested before combat use. The physics and engineering were comparably straightforward so the scientists were very sure it would work assuming the Urnaium enrichment was pure enough.

Vena is one of the most popular enterprise budgeting/forecasting packages. It ships as a new-style Excel extension making Excel the UI for department heads contributing to a rolled up enterprise budget

The key is still in the TPM in that scenario it just requires a password to unlock it.