wahern

RSA and the government were extremely tight lipped about it, including refusing to confirm what data had been exfiltrated. At the time news stories recited that some evidence pointed to the PRC. There may have been some followup after media attention moved on.

I'd be curious if anyone on HN could confirm whether RSA quietly reissued new keyfobs. The safe assumption was the intruders got access to the TOTP secrets, but strictly speaking that was conjecture, unless that was later confirmed directly or indirectly.

This may have been a different incident, but at some point there was chatter about a possible physical intrusion targeting a TOTP backend server for DoD or defense contract systems (Lockheed Martin?).

I think really serious incidents tend to be more vigorously suppressed, unlike humdrum PII exfiltration, for the same reason that during wartime states don't want the enemy to have unequivocal confirmation about how successful an operation was, e.g. whether the secrets exfiltrated included credentials to specific systems.

I briefly tried to keep a list of these types of hardware-based authentication systems hacks. But it's a chore, especially following up.

> I would like to conclude by telling a cautionary tale. Let us try and place the Antikythera Mechanism within the global context of ancient Greek thought. Firstly came the astronomers observing the motions of the heavenly bodies and collecting data. Secondly came the mathematicians inventing mathematical notation to describe the motions and fit the data. Thirdly came the technicians making mechanical models to simulate those mathematical constructions, like the Antikythera Mechanism. Fourthly came generations of students who learned their astronomy from these machines. Fifthly came scientists whose imagination had been so blinkered by generations of such learning that they actually believed that this was how the heavens worked. Sixthly came the authorities who insisted upon the received dogma. And so the human race was fooled into accepting the Ptolemaic system for a thousand years.

> Today we are in danger of making the same mistake over computers. Our present generation is able to view them with an appropriate skepticism when necessary. But our children's children may be brought up within a society dominated by computers, that they may actually believe this is how our brains work. We do not want the human race to be fooled again for another thousand years.

-- E.C. Zeeman, Gears from the Greeks, January 1986, http://zakuski.utsa.edu/~gokhman/ecz/gears_from_the_greeks.p... (https://web.archive.org/web/20250502052226/http://zakuski.ut...)

Not to contradict your point, but in 2011 RSA's SecurID backend servers were hacked. TOTPs require shared secrets, and their server had all the secrets to the SecurID keyfobs they managed. Security is hard.

There's a significant misanthropic sentiment on the left stemming from, among other things, the mid-century environmental movement. It creates for a maddening incoherency, but I guess that's typical of all politics at scale.

The misanthropy is infused in popular culture, and specifically in the way ecological sciences and history (for additional reasons) is taught in schools. I not infrequently have to discuss this with my kids when they recite something they've learned in school and I can hear the misanthropic cynicism in the framing and intonation.

Pretty cool that they seemed to have come up with the idea on their own, but they're definitely not the first: https://graphics.stanford.edu/~seander/bithacks.html#ZerosOn...

Not sure I agree with this pattern for strings, but if you're gonna multiply for an allocation like that and are concerned about consistent idioms, use calloc or [non-standard] mallocarray, which will check the multiplication for overflow.

Two kids from my child's parochial middle school were suspended for a day last week. I've seen many suspensions over the years, but never once an expulsion. One time several years ago (at another school, mind you) a half dozen families tried to force the expulsion of a kid for the frequent hitting that occurred. My child was one of the kids to get hit. But the principal pushed back extremely hard and took a ton of flak. She stood her ground, though in the end the family voluntarily changed schools.

Today in many liberal cities kids simply can't be suspended at all, period. In many other areas corporal punishment and suspensions continue to be used way too much. But actual results don't really track the way people assume they do one way or another.

What's the real difference between parochial schools and public schools? IMO it has little to do with policies or resources, but the fact that parochial schools demand parental engagement. It's often a prerequisite for admission. If the school knows the parent is engaged and working with the school, they'll often deal with behavioral problems that most public schools wouldn't or simply can't. By contrast, a friend of mine saw his entire public grammar school get shutdown by a self-identified radically progressive school board in Boston for failing to expel a kindergartner after a single incident (perpetrator, black boy; victim white girl; though really if anyone was paying attention the boy was arguably the victim, both by the ridiculous outrage, but also whatever was happening in his home life). This was at a school specifically created to mix rich white students with poor black students, and every family opted in to the experiment, and the school staff was simply following the gold-standard liberal policies the school was created for; policies which in this case were easily defensible, IMO. Its sad the way things went down, though the hypocrisy exposed was telling. People want to throw money at problems, virtue signal, and demand everybody else do something about these problems, only so long as they're not personally effected.

If the parent isn't engaged or can't be engaged, throwing more resources at the school won't help. If you want better outcomes, shift attention toward helping parents become more engaged. There are myriad ways to do that, and I really don't know what might help. But trying to fix the problem through school policies and resources isn't going to work. That avenue has been exhausted, though it still demands vigilance in maintaining appropriate resource distribution. Unfortunately, suggesting this kind of approach has categorically become a form of victim blaming--i.e. blaming parents for being poor.

Some public charter schools do the exact opposite, take in the problem kids so they can be given an environment better suited to their challenges. For example, Gateway Highschool in San Francisco. And they have better outcomes for those kids. But better is relative, and they get alot of criticism from those convinced equity demands the whole student population be perfectly shuffled across all classrooms, and who argue having such options excuses the district from providing even more resources to the average classroom. Many of those same people also work to prohibit ever removing a problem child from a classroom (see recent controversy in SF, about schools secretly doing that despite city prohibitions on suspension or even class removal), arguing instead every classroom should have 2 or 3 additional instructors, as if that would magically cease the disruptions.

That's true to an extent, but much less true of Catholic parochial schools. In fact, such schools will sometimes have a population with average income less than the local public schools. Of course most parochial schools won't have special education programs, so that's a huge filter, but as I pointed out doesn't account for the budget gap.

In any event, "picking your customers" is exactly the point of the previous poster(s). Money doesn't really explain what we're seeing. Once upon a time there was a very strong correlation, and people presumed causation, but now it's quite clear that the causation wasn't there. Certainly not directly, which is why throwing more money at the schools isn't helping.

California spends more money on low-income school districts than the average, and I think that's generally true most other places, especially since No Child Left behind (which for all it's problems by-and-large forced states to invest in poorer schools.)

Nationally, per student cost at Catholic parochial schools is roughly 1/2 of public schools. (Couldn't find California specific numbers, but it tracks what I've seen.) That's cost/spending; tuition is even less. Special education programs eat up 1/4-1/3 of public school budgets, so there's still a gap after accounting for that.

1973 was over 50 years ago. Even the poorest, most "backward" states have long ago largely remediated spending inequities. What you hear today to support claims of inequity are cherry-picked esoteric cases to drive outrage, just like every other topic today. In reality there's clearly much more going on than what advocates for this or that would ever admit.

Maybe the rules have changed in the US, but as of early 2023 SMRs were subject to the same "Aircraft Rule" regarding their containment structures as any other commercial reactor.

The US has been energy independent for many years, now. But the bars on exporting oil and natural gas that were put in place in prior eras were lifted, so American consumers are now exposed to global pricing similar to when we were import dependent.

It doesn't follow logically at all. The origins of judicial immunity have distinct historical roots, just as Congressional speech & debate immunity has distinct roots.

There's an argument it might effect prosecutorial immunity, presuming someone was a stickler about consistency, but it's tough to say because the justifications are arguably based on a poor historical understanding of how prosecutors took up cases. (Historically prosecutors, even criminal prosecutors, were often private individuals paid by the local government to prosecute a case, or even prosecute a case entirely on their own volition. But today many jurists just assume the prosecutor has always and only been a distinct executive office, which if they're well read enough--but not too well read--might think sometimes had some quirks about who filled the office.)

I'm not very familiar with the C++ standard, but I don't think the C++ standard requires compilation to fail, either. It has similar language to the C standard. Per C++23 4.1.1p2.3,

> Otherwise, if a program contains a violation of any diagnosable rule or an occurrence of a construct described in this document as “conditionally-supported” when the implementation does not support that construct, a conforming implementation shall issue at least one diagnostic message.

The C++ standard does seem to explicitly require the compiler to reject translation units with a failed static_assert. (The requirements for #error are a little confusing; not sure if a failed #error in a conditional block requires failure.) But I couldn't find a rule that mandates failure for invalid implicit int conversions. Implicit pointer to int conversions are invalid for the same reasons in both C and C++. Basically, AFAICT C++'s type safety in this regard is a matter of historical compiler behavior, and now the major C compilers are adopting that behavior, which they previously had allowed (with a mandatory diagnostic message) for backward compatibility reasons.

The unitary executive approach is pretty extreme. In one recent opinion before they pulled the trigger, Roberts court admitted that they could have reigned in the excesses that followed Humphrey's Executor, implicitly admitting its fundamental reasoning was well grounded. That was quite an admission because Roberts had been championing the unitary executive since the 80s.

In fact, few legal scholars dispute that the executive power is unitary, though they might disagree on the implications. As Humphrey's explained in detail, the issue is about areas of the government where the executive nominally overseas work that has a congressional or judicial character. For example, administrative judges and Federal prosecutors exercise a kind of judicial power. And the whole Federal Reserve exception SCOTUS quickly formally carved out is because the Fed exercises a kind of congressional budgetary power.

Humphrey's said that when an agency or officer is exercising a non-executive power, Congress can limit the president's control over how it can be exercised, including reasonable limits on the president's ability to fire the officer.

Ignoring unitary executive proponents like Thomas who choose to ignore the ambiguous intentions of the constitutional drafters, or the early history of the first congresses actually limiting some executive power over officers, people like Roberts primarily argue that Humphrey emphasis on the character of the power is just too difficult for the courts to police; they want a brightline distinction defined by whether the office is nominally under the executive branch, even though that approach is in tension with the actual, if equivocal, original meaning of the constitution. But not too brightline, because letting the president control the Fed was a bridge too far. So they created that exception which clearly is rooted in the same logic as Humphrey's, but they (ironically) pretend it's just something they pulled out of thin air as a one-off.

What version is your compiler? As of GCC 14 and clang 15 an implicit pointer conversion to int is an error, not merely a warning; and this is without specifying any special conformance or warning modes. I think implicit int conversions have been a constraint violation since at least C99, requiring a diagnostic, though I'm not sure if the switch to an error instead of a warning was prompted by a change in wording in C23 or just a general change in attitude and less concern with failing on pre-existing (but wrong) code.

The debate began with the First Congress, but largely petered out in the early 1800s and didn't really pick up again until the rise of the regulatory state in the early 1900s.

There are newer law review articles but none quite so comprehensive and earnest as Cass R. Sunstein & Lawrence Lessig, "The President and the Administration," 94 Columbia Law Review 1 (1994), https://chicagounbound.uchicago.edu/journal_articles/7779/

That's the same Lawrence Lessig who fought (and lost) copyright extension. 1994 is long before tribal politics became as pervasive and extreme in academia as it is today (not that it didn't exist back then). The paper pulls its punches and assumes unitary executive proponents are arguing in good faith, rather than rationalizing a foregone conclusion.

Legal systems typically use non-monotonic logic. Most formal logic systems, particularly in mathematical fields, use monotonic logic. Monotonic logic isn't well suited for the law or most other areas of human activity.

If you want an entire legal system formally defined in logic, you're going to have to do a ton of novel work in expanding the understanding of and application of non-monotonic logic because there isn't much scholarship compared to monotonic logic systems.

That said, France is one of the only countries that has tried anything like this. Their tax system is required to be defined and expressed algorithmically, and they even built a programming language and compiler tool chain to do this. I think it uses monotonic logic, though, and I don't think anybody has seriously suggested the French tax code is something to be copied, neither as a tax code nor an approach to legal codification more generally.

A large Greek minority? Please share your sources for that because I'd be very interested in reading that.

AFAIU, Greeks were there, but as traders who came because it was a prosperous kingdom. For the same reason other groups from around that region also had a presence, and vice-versa. Prosperous nations tend to exchange populations and build economic, cultural, and political ties.

But if you're implying the presence of Greeks or an adoption of Greek culture was the reason for the rise of the Aksum empire... I'd certainly like to read those sources.

The very early adoption of Christianity might have had something to do with it, at least in terms of creating a unifying identity within and among the broader region. But Greeks weren't the only Christians. Ethiopia already had ties to non-Greek Levante and non-Greek Arabian peninsula communities, and probably Persian traders, as well--Persians were the Greeks of the Indian Ocean. Not coincidentally, the Horn of Africa sits at the nexus of multiple major economic spheres and sea routes. The Aksum Empire originated in the highlands, but for much of their time they controlled or had a strong presence along the coast.

Lies, damn lies, and comments.

The discourse has moved on for now, but 10-20 years ago when, why, and how to comment code was a hot topic. I'm sure the discourse will circle back, especially given how comments can be used to steer these models.

If you hosted your own email server, why would you need to be familiar with SES, especially if you've been hosting longer than SES providers have been around?

Like email, I run my own HTTP server, serving directly to clients. I know about Cloudflare just from HN threads, but have never used it or know much about that whole reverse proxy universe beyond the very low-level details from having written several reverse proxies myself.

It's not that simple because it's asymmetric. The companies track you (via firms that can see your purchases across different retailers) but how can you track the companies to find a bargain? Historically you might follow Consumer Reports, your neighbor's advice, or just look at advertised prices, but if everybody is offered a personalized price, now it becomes more difficult for you to compare or even identify prices. And what you're offered today might not be--and if Amazon is any indicator, won't be--the price offered tomorrow, making it more difficult to plan and budget across purchases (individuals don't have the scale and analytic prowess retailers have).

Fair price discrimination would involve some kind of bidding system, but that has high transaction costs for both sides. And naturally sellers aren't interested in maximizing global efficiency or competitiveness. Like any company they prefer "solutions" that give them an advantage over the consumer.

It still might be a net win overall, and I don't have strong opinions one way or another beyond being apprehensive about knee jerk public policy proposals, but surely the sellers will see a larger share of the benefits, possibly accelerating wealth inequality and people's growing sense of economic insecurity. That sense of security is critical for maintaining free (or freer) markets, otherwise the population is prone to using their political powers to try to take back bargaining power, and very often that winds up being a loss for everybody.

They can't know, they infer. AFAIU, normally they just detain you at the airport and harass you to try to break you. To jail you they're technically supposed to be confident enough about you knowing the password to be able to charge you with a crime (presumably something like obstruction, possibly specific to immigration law, otherwise right against self-incrimination might prevent a conviction on failure to disclose alone), or have other evidence of some other crime. Then you end up in the legal system, where courts handle due process and a judge, preliminarily, and then a judge or jury decides if you knew the password.

Note that the recent high-profile case of a man being jailed involved him refusing to decrypt, rather than claiming he didn't know. He was deliberately trying to test the law regarding the permissible scope of inspection of digital data, to force the matter into the courts so the issues could be litigated in a controlled context untainted by other potential crimes; being arrested and charged was part of his plan.

AFAIU, the San Francisco peninsula (San Francisco + San Mateo counties) has one of the densest networks of ALPRs in the country. You can't drive more than a mile or two in the peninsula without passing an ALPR. And my educated guess is this is a response to the rise of property crimes, including car break-ins and theft, over the past 15 years, which became a huge political issue, locally and of course nationally. Those crimes began to drop precipitously after it became evident that criminals were being tracked and apprehended by the cameras, and I doubt it's a coincidence. IOW, at least in this region the cameras exit because of crime, and they're working.

That's not a defense of these wide ALPR networks, and certainly not a defense of how they're managed. But my point is that it's a thorny political issue because in many areas they actually work, at least to some significant degree. Whether or not they're worth the privacy cost, or whether or not alternatives would work sufficiently well, are fair questions, but precisely because they're fair and contentious questions means preventing their use won't be easy politically. Many of politicians and LEO officials pay lip service to privacy concerns, but behind the scenes they're wary of doing anything that would rollback the capabilities these systems provide.

Has Apple backported anything recent to their forked gmake? Have they ever backported any features for that matter?

A scholarly and far more rigorous argument against copyright and patents can be found in Against Intellectual Monopoly by economists Michele Boldrin and David K. Levine. "We show through theory and example that intellectual monopoly is not necessary for innovation and as a practical matter is damaging to growth, prosperity and liberty."

It's a published book you can buy in hard copy (I bought the ebook on Kindle) but practicing what they preach it's freely available online, http://dklevine.com/general/intellectual/againstfinal.htm

I didn't want to guild the lily. Switzerland also has a significantly higher per capita GDP than the US. 1/4-1/3 higher.

Switzerland is just a really bad example to use because they're significantly wealthier than the US. The only other two non-city-states with a higher per capita GDP than the US are Ireland and Norway, but Ireland's is inflated because it's a tax haven (less real money available for public spending), and Norway's is inflated because of their oil and gas fields. Though, comparing the US to most any other country, especially individual European countries, is already specious. Switzerland is ~9 million, compared to ~340 million for the US. Scale matters, because of variance, selection bias, and the policy conclusions you can reasonably draw. A better apples-to-apples comparison would be between individual US states to individual European countries, or to compare the US to the EU as a whole[1]. People don't like to do that because such comparisons tend not come out the way they want. It would be interesting to read a follow-up comparing Colorado to Switzerland, not least because they're both mountainous regions. Not nearly as easy an analysis, though, because you'd have to figure out Colorado's share of Federal road infrastructure expenditures, plus Colorado-specific road data.

[1] To be fair, comparing the US to the EU can be a chore because many publicly available datasets, even from EU agencies, encompass not just the EU proper but larger geographic regions, or subregions of the EU. And of course Switzerland itself is just such an example as they're not a full member state. Like, try finding out the number of heat-related deaths. I couldn't find any numbers just for the EU proper. Some numbers included Russia, the Balkans, and/or Turkey, some were for subregions of the EU, and often it was a chore just to figure out which countries or regions were used in the report. It's a mess.

Switzerland has ~440 people per paved road kilometer. The US has about ~80 people per paved road kilometer. That means Switzerland has more than 5x the number of tax payers to support each kilometer of paved road. Maybe Switzerland was smarter than the US in terms of not building infrastructure it can't adequately support, but in any event....

Hmmmmm. It's late, but FWIW I think this comment from Martin from last year might be relevant: https://news.ycombinator.com/item?id=40838721 And I'm guessing the note that was added is fn#150 in C23. Volatile accesses aren't general memory barriers, but I think Martin's point is the potential for UB behavior means the compiler has to preserve the sequence order of the potentially UB operation relative to the volatile access.

What if x is a register to toggle divide-by-zero exceptions? Normally this is none of the compilers business, but the whole point of volatile is a mechanism to express stuff like that, so it needs minimal semantics, e.g. no time traveling (compiler barrier), to be fit for purpose.