HNHacker News
TopNewBestAskShowJobs

timtadh

2,028 karma · joined October 3, 2009

Researcher/Hacker from Case Western Reserve University. Now at Google. Likes to tinker and crunch crunchy looking leaves.

- http://hackthology.com

- https://github.com/timtadh/

- https://twitter.com/timtadh/

- https://plus.google.com/u/0/109232399292705173597

- https://scholar.google.com/citations?user=n_se9mMAAAAJ

[ my public key: https://keybase.io/tadh; my proof: https://keybase.io/tadh/sigs/ec8yqyArGNcSDjXNT5rSoYRp-H0vMM3lxVmlY4bpcUQ ]

submissionscomments
timtadh··on Programming for four-year-olds – No assembler required
ROLEX also values your memory. Scrolling that page caused my Firefox to jump in memory size by about 1GB. "Works as intended."
timtadh··on Landlords are trying not to rent to startups in San Francisco
I have found that this says more about the ability of the management and less about the ideas underpinning remote work. Large companies figured out some time ago that they could have a large remote workforce. So it isn't just Basecamp or whoever that is doing remote work. Remote work has it challenges but (and here is the important point) they can be managed if the team knows how to manage.

FOSS proved over two decades ago that you can build complex competitive systems with people you have never met. The fact that you couldn't make it work doesn't mean that it doesn't work. It means your company could not figure out how to make it work for you.

timtadh··on A Response to Your Petition on Edward Snowden
The response was made today.
timtadh··on Why I am pro-GPL
> > It was created as a research project exploring: "transparent, lifelong program analysis and transformation for arbitrary programs."[1] GCC and other compilers were not setup to do this.

> gcc was in fact set up to explicitly not be able to do this.

GCC was originally very difficult to integrate with so that non-free programs could not be built on top of it. However, the creation of LLVM does not reduce to: "GCC was difficult to work with so we made this." There had been many attempts to make "Universal Compiler IRs". These attempts had not gone well. LLVM instead chose to do something at a unique level of abstraction that wasn't good for everything but was very good for its particular niche. Once again, read the paper, LLVM really wasn't created as a reaction against GCC.

timtadh··on Why I am pro-GPL
LLVM was not created as reaction against the licensing model of GCC. It was created as a research project exploring: "transparent, lifelong program analysis and transformation for arbitrary programs."[1] GCC and other compilers were not setup to do this. They needed to build an intermediate representation of a kind that was highly unusual for the time. That is where it originated, as pure research. Trying to build a better mouse trap. Not to become a GCC competitor. It did become one because it turned out they had some rather good ideas!

The GPL is not harmful and I encourage you to utilize it when appropriate for it protects you (the original author) and your target users far more than BSD or other similar licenses.

[1] http://llvm.org/pubs/2004-01-30-CGO-LLVM.html Read full paper not just the abstract to get the full picture.

timtadh··on Hackers Remotely Attack a Jeep on the Highway
I saw a presentation at a departmental colloquium 3 years ago which demonstrated similar capabilities. The point is, car companies are not responding well to this threat even though it is well known to them. In such situations it is in the public's best interest that information about the vulnerabilities be widely disseminated in order to keep the general public safe. Those with know how can already exploit these flaws and likely have been for years. The car companies need to act to secure their customer's systems.
timtadh··on Woah that is some wild postgresql
Another cool thing you can do is solve the 8-Queens problem. There is a great write up at : http://www.andreas-dewes.de/en/2015/queens-of-the-data-age-a...
timtadh··on Thanks Pivotal, Hello Redis Labs
Great project. I enjoyed reading over your code for Volumes and Stores. I have worked on similar things in Go to support B+Trees. Finding the right level of abstraction is difficult for those pieces and I am never sure that I have found it.
timtadh··on What is C in practice?
Question 2 is :

Is reading an uninitialised variable or struct member (with a current mainstream compiler):

(This might either be due to a bug or be intentional, e.g. when copying a partially initialised struct, or to output, hash, or set some bits of a value that may have been partially initialised.)

a) undefined behaviour (meaning that the compiler is free to arbitrarily miscompile the program, with or without a warning) : 128 (43%)

b) ( * ) going to make the result of any expression involving that value unpredictable : 41 (13%)

c) ( * ) going to give an arbitrary and unstable value (maybe with a different value if you read again) : 20 ( 6%)

d) ( * ) going to give an arbitrary but stable value (with the same value if you read again) : 102 (34%)

e) don't know : 3 ( 1%)

f) I don't know what the question is asking : 2 ( 0%)

--------------------

I know of one datastructure (a sparse set of integers from 1-n) which relies on this behavior: http://research.swtch.com/sparse . I always thought it was a neat trick. However, from the article is seems that may NOT give stable values to uninitialized members. Which may make that data structure behave strangly or cause the program to miscompile.

timtadh··on Open-sourcing Facebook Infer: Identify bugs before you ship
I am always interested in what powers these tools under the hood. I had to learn the hard way, you do not write a program analysis tool from scratch, if you can help it. I know I have tried. It is too much for one person to do.

So what is powering this thing?

1. http://sawja.inria.fr/ This is a OCaml library for parsing .class files into OCaml datastructures. There is some built-in analysis it uses

2. Clang and LLVM which is the popular thing to build you C family analysis framework on.

I use https://github.com/Sable/soot for Java analysis myself. It is extremely powerful out of the box and can analyze: java source code, jvm bytecode and dalvik bytecode. I recommend taking a look at that if you are interested in that sort of thing.

The innovation in the released tool seems to be the incremental checking. Haven't had a lot of time to dig into that but that seems to be the important part. In general it is great that they created something useful and practical, that is always a challenge.

timtadh··on Hunting for Hackers, N.S.A. Secretly Expands Internet Spying at U.S. Border
> > "hacking has left teenage basements and has become weaponized and used by governments around the world"

> Source? Particularly with respect to "weaponized". The worst I saw was North Korea alledgedly being responsible for pirating a crappy movie, and a 10 minute shutdown of github a few months ago.

Arguably it has been "weaponized" by the NSA and their allies. See, stuxnet and related threats. There is good reason to believe other nation state actors also have "weaponized" threats. For instance the recent "man-on-the-side" DDOS attack via the great firewall on github. There is also a healthy business for buying and selling vulnerabilities and exploits and the .gov organizations are known buyers.

So yes, I think it is fair to say that "hacking has left teenage basements". That part of the statement the gp's statement it obviously true when you look at say sophisticated carder rings.

timtadh··on Tmux has left SourceForge
Agreed. As a high schooler I loved sourceforge. I would talk it up to people and I had a couple of projects that I put up there. I thought it was the best thing since sliced bread.

Then I saw that famous talk by Linus on git in 2007 (https://www.youtube.com/watch?v=4XpnKHJAok8). Since I had never managed to get SVN working properly for me git was awesome. No server software to install. By the time I wanted to put up another project on the web Github was a thing and I used that. I never looked back, I loved how it was about the code, not how many installer downloads you had.

That for me was the main problem with sourceforge. In the end it was a game (for the devs) to get the most downloads because that was how your projects were judged and ranked. The Github "game" is slightly better and there are multiple ways to play.

timtadh··on Why the Battle of Waterloo was fought
That would have never happened without British involvement, since they controlled the sea. Furthermore, as the article pointed out, Napoleon and America shared similar ideals. Finally, fighting a war in your homeland is infinitely easier than the supply lines Napoleon would have had to maintain to fight in America. It would have been absurdly expensive and would have opened France up to attack from its unfriendly neighbors. In conclusion, I do not think there is a likely scenario that envisions an America under Napoleonic rule.
timtadh··on John and Alicia Nash, 1928,1933-2015
The movie is very hollywood, however the book is both detailed and interesting. I would recommend giving it a read.
timtadh··on My experience of using NixOps as an Ansible user
With Nix it seems like the technology is there. It works. It has a superior model compared with other systems. However, it lacks a corporate sponsor or large community to make it "professional-grade". Canonical and RedHat make their money from people depending on their packages being continuously up to date. Debian has an enormous community ensuring that stable is stable and secure for the duration of its life. Nix doesn't have either, so it is up to the users it does have to be reactive.

That said, I think the benefits of Nix are real. The existing configuration management systems do not have the ability to fully understand the system. Nix does, because everything about the system is contained in the configuration file. As a consequence, you can up and down grade servers without fear of breaking everything. You can check to see exactly what changes between different versions. There is much more control and more assurance that the nodes are in the proper state.

One part of your comment which I do not understand is:

> When you can stand up a fresh VM using Ansible in a few minutes, the value of being able to roll a server back easily is hard to justify.

Isn't this also true for Nix? You just launch the image and push your desired configuration? If you mean time to write a new ansible playbook/role then in my experience, although I am fairly productive with ansible, I would not put it at "a few minutes" from nothing to a new service. Maybe you are talking about the learning curve? Nix definitely seems steeper so a clear win for ansible on that front.

timtadh··on NetUSB Impacts the Security of Millions of Devices Worldwide
I had a great experience putting something together using an ALIX 6f2 (http://www.pcengines.ch/alix6f2.htm) which I bought via a Netgate kit with enclosure (http://store.netgate.com/Network-Computers-C2.aspx). Netgate isn't selling that one but is selling other boards which you can put together something similar. The APU line looks really interesting.

The cool thing about the ALIX and APU boards is they often support buying things like 3g modem cards which you can use to multi-home your connections with pfSense. You could also create an SMS gateway or similar service.

timtadh··on Manual Memory Management in Go
Not a very useful article from the perspective of you are the point where you need to take some control over memory management in Go. The article spends a lot of time telling you should probably don't have that problem or you are not going to do any better than the Go. However, it is pretty easy to start proving you have that problem. Furthmore, you can make a real dent in the problem if you spend enough time working on it.

I should probably not just complain but explain

1. How to prove via pprof and other tools that you have problems related to memory allocation or GC.

2. Some strategies for addressing that problem that don't involve writing an allocator. Using sync.Pool or a recycler pattern. Keeping allocations on the stack etc...

3. How to write a allocation interface in Go for allocating arbitrary objects. Aka emulating New and Make.

4. How to write a allocator backed by a memory mapped files.

I have been working for a while in this space because of my academic research which involves frequent subgraph mining. That particular data mining problem is exponential and certain techniques can use a lot of memory. In order to scale my solution I have need to get the memory allocations under tight control. Sometimes I think I should just re-write in C++ or Rust but Go has provided me a lot of benefits from the concurrency angle so it isn't a win/win to move languages.

Maybe I will write up all of this stuff at some point. It is a bit much for an HN comment.

timtadh··on Dell XPS 13 Developer Edition
I know some are disappointed by the lack of ram in the XPS 13. If you need a beefer laptop there is another Dell "Project Sputnik" (aka Ubuntu) laptop the Precision M3800. http://www.dell.com/learn/us/en/555/campaigns/xps-linux-lapt...

It is more comparable to a Mac Book Pro and can be configured with 16 GB of memory as well as the hi res display.

timtadh··on C++ Streams
Oops, my bad. I didn't read the original closely enough.
timtadh··on C++ Streams
While we are at it Python:

    >>> sum(x*x for x in xrange(1,11))
    385
You could use a map in Python as well, but really, the generator expression is much cleaner:

    >>> sum(map(lambda x: x*x, xrange(1,11)))
    385
timtadh··on Michael Stonebraker wins Turing Award
+1 on all of those books. If you are interested in multi-dimensional indices (R-Trees, M-Trees, and many more exotic ones). You should checkout "Foundations of Multidimensional and Metric Data Structures" by Hanan Samet. Very comprehensive! "Database Systems: The Complete Book" is fantastic (pick up the previous version it is cheaper!) but it only touches on multidimensional indexing.

Also if you are interested in B-Trees start with "The Ubiquitous B-Tree" by Comer. [ http://dx.doi.org/10.1145/356770.356776 ].

timtadh··on Michael Stonebraker wins Turing Award
Agreed. I remember being very inspired by some of his papers when I started studying databases in grad school. His work along with all of those who developed the B-Tree and its variants[1] is really foundational to data storage and retrieval. He also helped to kick off the "NoSQL" and "NewSQL" movements with his C-Store paper.[2]

[1] Proposed by Bayer and McCreight, and independently developed by Chiat and Schwartz, and also by Cole, Radcliffe and Kaufman, improved by many including D. Knuth.

[2] C-Store: A Column Oriented DBMS. Mike Stonebraker, Daniel Abadi, Adam Batkin, Xuedong Chen, Mitch Cherniack, Miguel Ferreira, Edmond Lau, Amerson Lin, Sam Madden, Elizabeth O'Neil, Pat O'Neil, Alex Rasin, Nga Tran and Stan Zdonik. VLDB, pages 553-564, 2005.

timtadh··on Atreus – kit to build your own mechanical keyboard
I think the parent was referring to typing at a steady tempo not typing with a single key at a time. I rarely type with tempo at a computer. It would be interesting (and challenging!) to try.
timtadh··on Exploiting the DRAM rowhammer bug to gain kernel privileges
This most interesting comment here is this one: http://lwn.net/Articles/636143/ . I had not seen that you could fix this by changing the refresh rate before. I also did not know that you can potentially change the refresh rate with new bios firmware. Hopefully, some one will be able to put together solid fixes using these techniques.
timtadh··on Gogs, an alternative to Gitlab
You can always use another code review tool to do pull requests. You can also do it the way Linus does with pull request emails (git request-pull).

It isn't really a deal breaker to not have it built in. There are other ways to use git than following rigidly to the current github model.

timtadh··on California has about one year of water left
From my perspective the problem with water in the US is that no one is charged for the actual water. You are only charged for the processing costs. This means that the market never acts to regulate how much water you use. People will use less water if it costs them more.

However, changing to a market system for water would never happen overnight. People are not used to paying for water and cannot move on a dime. However, long term I think it is our only solution. The midwest, who many on HN seem to have a bad impression of, has the world's largest fresh water reserve in the world (the great lakes). Meanwhile, the plain states and California will have continuing water difficulties moving forward. Long term, people are going to need to move to where there is abundant water. It is not sustainable for so many people to live in marginal areas.

One way to encourage people to move is by having market forces act. If the price of water is cheaper in the great lakes region there will be a slow but steady migration there over time. This will in turn ease the brewing crisis in the west. This isn't the only action which should be taken but we should consider (from a policy perspective) the idea of allowing market forces to act in the water market.

timtadh··on [dead]
Because it doesn't do any good to serve over SSL. They do provided GPG signatures and checksums which provide assurance that the bits you wanted are the bits you got. Ex. http://download.documentfoundation.org/libreoffice/src/4.4.0...

https://www.gnupg.org/gph/en/manual/x135.html

timtadh··on New Tesla battery could power your home, and maybe the electric grid too
It is the furnace blower fan that is the essential thing to power. (assuming a natural gas/propane furnace) With that you can heat your house. If you can heat your house you can have running water. Without heat you will need to shut off the water and drain the pipes so they do not burst. At that point you have no heat and no water and you probably need to just leave.
timtadh··on Let's Build a Modern Hadoop
Docker isn't a VM? In docker everything is native code. There is no emulation. It uses OS level sandboxing primitives to provide protection and isolation. Running an application in docker gives you the same performance profile as running it on the host because it is running it on the host. So if you write your job in C or Fortran you can beat any Java code on the JVM nearly everytime. Especially for linear algebra applications.
timtadh··on Ask HN: I got let go this morning. What should I do next?
I am in Cleveland and know a few of the local startups and such. You can drop me a line if you want.
← PreviousPage 3 of 15Next →