HNHacker News
TopNewBestAskShowJobs

zero_k

862 karma · joined February 1, 2014

submissionscomments
zero_k··on Tom Stoppard has died
My favourite quote from him:

“Because children grow up, we think a child's purpose is to grow up. But a child's purpose is to be a child. Nature doesn't disdain what lives only for a day. It pours the whole of itself into the each moment. We don't value the lily less for not being made of flint and built to last. Life's bounty is in its flow, later is too late. Where is the song when it's been sung? The dance when it's been danced? It's only we humans who want to own the future, too. We persuade ourselves that the universe is modestly employed in unfolding our destination. We note the haphazard chaos of history by the day, by the hour, but there is something wrong with the picture. Where is the unity, the meaning, of nature's highest creation? Surely those millions of little streams of accident and wilfulness have their correction in the vast underground river which, without a doubt, is carrying us to the place where we're expected! But there is no such place, that's why it's called utopia. The death of a child has no more meaning than the death of armies, of nations. Was the child happy while he lived? That is a proper question, the only question. If we can't arrange our own happiness, it's a conceit beyond vulgarity to arrange the happiness of those who come after us.”

zero_k··on I don't care how well your "AI" works
YES. The "This is evidenced by the new set of hacker values being almost purely performative" is so incredibly true. I went to a privacy event about Web3, and the event organisers hired a photographer who took photos of everyone (no "no photo" stickers available), and they even flew a drone above our heads to take overarching videos of everyone :D I guess "privacy" should have been in quotes. All the values and aesthetics of the original set of people who actually cared about privacy (and were attracted to it) has been evaporated. All that remained are the hype. It was wild.
zero_k··on SATisfying Solutions to Difficult Problems
SAT solvers are used _everywhere_. Your local public transport is likely scheduled with it. International trains are scheduled with it. Industrial automation is scheduled with it. Your parcel is likely not only scheduled with it, but even its placement on the ship is likely optimised with it. Hell, it's even used in the deep depths of cryptocurrencies, where the most optimal block composition is computed with it. Even your friendly local nuclear reactor may have had its failure probability computed with (a variation of) it. In other words, it's being used to make your life cheaper/better/safer/easier. Google a bit around, open your eyes Neo ;)

PS: Yes, I develop a propositional SAT solver that used to be SOTA [1]. I nowadays develop a propositional model counter (for computing probabilities), that is currently SOTA [2]

[1] https://github.com/msoos/cryptominisat/ [2] https://github.com/meelgroup/ganak/

zero_k··on SATisfying Solutions to Difficult Problems
Author of CryptoMiniSat here :) XOR+CNF is indeed supported by CryptoMiniSat. Which is cool, but if you _really_ think about it, the resolution operator over these two are gonna give you multivariate polynomials over GF(2). So resolution is poor in CryptoMiniSat, because it only encodes one of the constraints that this polynomial implies (i.e. one that can be encoded in a single disjunctive clause). And if you wanna do the _real_ deal, i.e. "properly" solve multivariate polynomials over GF(2) then you are in for a ride -- the all-powerful, much-feared, Grobner basis algorithms, and I am not touching those with a 100m pole, because they are hell on wheels :) I mean... it's possible to contribute to them, and I know of two people who did: https://theory.stanford.edu/~barrett/fmcad/slides/5_Kaufmann... and of course, https://link.springer.com/chapter/10.1007/978-3-031-37703-7_... i.e. Daniela and Alex. It's... rough :D

Just my 2 cents.

zero_k··on Willow quantum chip demonstrates verifiable quantum advantage on hardware
Wait, is this another algorithm where they didn't bother even cursorily looking at the classical algorithm for even a minute, then compare it with their stuff? Last time they pulled this, it was my field, and I could only laugh. Just stop this nonsense and start doing some real work. Yeah, I know their "work" seems to be "how to extract money using buzzwords" but it's getting tiring, and I don't consider that "work".
zero_k··on Asked to do something illegal at work? Here's what these software engineers did
I wish I could tell a story. Alas, I can't. It turns out that large corporations are excellent at hiding evidence of wrongdoing, and will do everything to cover the backside of high-level execs, because stock price matters. When it's bad, the exec leaves for a "better opportunity", and none will be wiser. The stress of the honest, serious engineer(s) remain, and the exec gets a free ride to their next big beautiful step up the ladder. In retrospect, don't follow internal reporting guidelines, and don't talk to internal lawyers. They either are incompetent or competent, but paid to swipe stuff under the rug -- you'll never find out either way. Instead, go to the relevant regulatory agency, write a detailed report to them, and let it play out.
zero_k··on Hosting a website on a disposable vape
I am happy they demonstrated how useful these devices are. Marking these as "disposable" is a kind of insanity. I recovered a few of them "disposed" (i.e. "randomly thrown away into") in an empty flower pot, and took out the LiPo batteries from them -- which are rechargeable, and have charge circuitry (non-trivial for LiPos). That we somehow decided that it's OK to design these to be used only once feels wrong.

This is the opposite of repairability. We specifically made them impossible to reuse and refill. Makes my tinkerer (and eco-friendly) heart very sad.

zero_k··on Some thoughts on journals, refereeing, and the P vs NP problem
Ah, interesting. Thanks, I'll look into it!
zero_k··on Some thoughts on journals, refereeing, and the P vs NP problem
I work on a (once top-of-the-line) SAT solver [1] and a (currently top-of-the-line) model counter [2]. Actually, I am very interested in the part of the rebuttal of "when each constraint has at most two variables, then the constraint satisfaction problem (and even the more difficult problem of counting the number of solutions) can be solved in time less than the lower bound that is claimed" -- in the model counting competition [3] there are actually problems that are binary-clause only, and I have to admit I am having trouble counting them any smarter than I already do normal (i.e. >=3 length clause) problems. Is there some very fun algorithm I'm missing that I could use for only-binary clause solution counting? I have thought about it, but I just... can't come up with anything smarter than compiling it into a d-DNNF form, which most SOTA model counters (and so I as well) do.

[1] https://github.com/msoos/cryptominisat/ [2] https://github.com/meelgroup/ganak/ [3] https://mccompetition.org/

zero_k··on My bank keeps on undermining anti-phishing education
I'm also with Sparkasse and it's the worst. Their digital systems and their technical understanding is the bottom of the barrel. On the other hand, the "most digital bank" in Germany, N26, a so called "neobank" has laughable security [1]. It's a huge mess over here. I used to also bank in Singapore, the difference is night and day. Fun story: Sparkasse has an integration with a stock brokerage, and the stock charts are PNGs generated at the backend. It's literally 1995-level HTML usage, One can only laugh.

[1] https://archive.org/details/33C3-Shut_Up_and_Take_My_Money

zero_k··on Taking over 60k spyware user accounts with SQL injection
Sometimes, I wish engineers running backend services were not hindered by management nonsense and would just nuke these systems when they are reported, sufficiently backed up with evidence (like here -- though I'd do a personal check first to verify). Seems like some did (congrats), others didn't (Firebase). I can assure you if I was on the other end, I would have escalated until I got fired or the service was down. Unimaginable that some let these run, wake up in the morning, look in the mirror and aren't ashamed of themselves.

People will continue doing their unethical behaviour not because we aren't on the streets fighting for the right thing, but because we just don't care enough, and let them continue.

zero_k··on Springer Nature book on machine learning is full of made-up citations
Springer? You mean the publisher we are currently fighting so they won't mess up our peer-reviewed research paper that we wrote and paid for the privilege for them to mess up (ehm, sorry "publish")? Colour me surprised.
zero_k··on Solving LinkedIn Queens with SMT
Haha, Marijn Heule who is pushing a lot of limits of SAT solving would love this. If you manage to get him excited, he might spend a few years on this problem :) He's kinda famous for solving the Boolean Pythagorean Triples problem using SAT [1]. He loves puzzles. He also got Knuth excited about a bunch of fun puzzles.

BTW, these puzzles also tend to have a lot of symmetries, which SAT solvers are pretty bad at handling. You can break them, though, using a variety of techniques, e.g. static symmetry breaking [2], or symmetric learning.

[1] https://www.cs.utexas.edu/~marijn/ptn/ [2] https://github.com/markusa4/satsuma

zero_k··on Reversing the fossilization of computer science conferences
Yes. Exactly. If you make it readable and understandable, somehow the reviewers think it's easy. NO! It's easy because I made it easy for you to understand, and that's a good thing! If you invented BDDs or Petri Nets today, and didn't explain it over 5 pages of unreadable Greek alphabet, it'd be rejected. It's hilarious and really sad. Both are extremely useful, and intuitively "easy" tools. But they are so incredibly good and useful.
zero_k··on Reversing the fossilization of computer science conferences
Haha yes. Some people don't publish work in the form of a paper, because it's just so much hassle and you'll get a bunch of nitpicking nonsense reviews while the tool is used by hundreds if not thousands of people/researchers/etc. It'd be hilarious if it wasn't so sad.
zero_k··on Reversing the fossilization of computer science conferences
Precisely :)
zero_k··on Reversing the fossilization of computer science conferences
The main issue I see is that papers are actually becoming so focussed on form that they are now unreadable. People prefer reading my blog for my papers than reading the papers themselves. In fact I hear people telling me they understood the blog _better_. The whole academic writing shtick has become so obtuse that not only writing is cumbersome, but so is reading.

The other side of all this academic brownie points via papers (and doing reviews, which has become "brownie points for gatekeeping") is that most academic software is not only unmaintained, but actually unusable. They rarely even compile, and if they do, there is no --help, no good defaults, no README, and no way to maintain them. They are single-use software and their singular use is to write the paper. Any other use-case is almost frowned upon.

One of the worst parts of Academic software is that if you re-write it in a ways that's actually usable and extensible, you can't publish that -- it's not new ("research") work. And you will not only have to cite the person who wrote the first useless version forever, but they will claim they have done it if your tool actually takes off.

BTW, there are academics who don't follow this trend. I am glad that in my field (SAT), some of the best, e.g. Armin Biere and Randal Bryant are not like this at all. Their software is insanely nice and they fix bugs many-many years after release. Notice that they are also incredibly good engineers.

zero_k··on Assignment 5: Cars and Key Fobs
Broke a few of these for my old work -- HiTag2 and Megamos, some of the code&knowledge used for the attack is online&published, but neither can be used to actually break the ciphers as-is [1][2]. The issue used to be that the cipher employed needed to be low-power, fast, and reliable. With current technology, one could easily use AES, and no serious auto maker should be using HiTag2/Megamos. They were hand-rolled ciphers. The way AES is used (i.e. the protocol itself) could still be wrong, of course, e.g. allowing for replay attacks, etc.

[1] Doesn't have some features which you need to use to actually attack HiTag2: https://github.com/msoos/grainofsalt

[2] Used for various pre-processing that is useful (but not neccessary) to break Megamos, but _far_ from the actual attack: https://github.com/meelgroup/bosphorus/

zero_k··on Fun with -fsanitize=undefined and Picolibc
Wow, this: "random() was returning values in int range rather than long." is a very nice bug find. Randomness is VERY hard to check for humans. For example, Python's binomial distribution is very bad on some inputs [1], giving widely wrong values, but nobody found it. I bumped into it when I implemented an algorithm to compute the approximate volume of solutions to a DNF, and the results were clearly wrong [2]. The algorithm is explained here by Knuth, in case you are interested [3]

[1] https://www.cs.toronto.edu/~meel/Slides/meel-distform.pdf [2] https://github.com/meelgroup/pepin [3] https://cs.stanford.edu/~knuth/papers/cvm-note.pdf

zero_k··on Markov Chain Monte Carlo Without All the Bullshit (2015)
Science communication is so important. I write scientific papers and I always write a blog post about the paper later, because nobody understands the scientific paper -- not even the scientists. The scientists regularly read my blog instead. The "scientific style" has become so obtuse and useless that even the professionals read the blog instead. True insanity.
zero_k··on America underestimates the difficulty of bringing manufacturing back
America is not a country, it's a continent. I know, Canada will be a province, and soon Panama of course, but in the meanwhile, it's a continent, not a country.
zero_k··on US Administration announces 34% tariffs on China, 20% on EU
This is not a game. Others will not take it as a game, and will retaliate. You can only play the bully for so long before others start treating you as a bully, and stop backing down, even after you have backed down -- as they never know when you are bluffing.
zero_k··on 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket
Bankrupt only? It should also be criminal negligence. Until some exec goes to jail, this kind of stuff will keep happening. Someone was (likely is...) making good profit out of this business by not investing in IT security. They cheaped out, and other people paid the price, who didn't have anything to do with the profit of the company. Watch out for the execs going around in a few years giving talks about how to build a successful company. If we let this kind of behaviour have zero repercussions, the public will continue to pay the price of private profits.
zero_k··on XOR
But you forgot! It's also a 3-wise independent linear hashing function! Which means it can be used for probabilistically approximately uniform sampling and counting of solutions to boolean functions. This is super-duper useful. We use it to build counters that give probabilistic, but proven, counts. I explained the idea here in more understandable terms [1].

Basically, it halves the solution space approximately correctly each time. So you keep on adding them, until you have say, 10 solutions. Then you multiply the 10 with 2^k, where k is the number of XORs you added. That's it! So cool, no? And it's super-scalable, because it haves it each time, so you'll get to, say, 10 pretty quick!

Some research papers are here [2,3]. I work on this, the tools are here [4,5]. In the last model counting competition, it dominated all other competitors, when combined with an exact counter, slides of the competition here [6].

[1] https://www.msoos.org/2018/12/how-approximate-model-counting... [2] https://arxiv.org/abs/1306.5726 [3] https://www.cs.toronto.edu/~meel/Papers/cav20-sgm.pdf [4] https://github.com/meelgroup/approxmc [5] https://github.com/meelgroup/unigen [6] https://mccompetition.org/assets/files/2024/MC2024_awards.pd...

zero_k··on Computing Tricky Probabilities Using Model Counting
Hahahhaah yes, true.
zero_k··on Computing Tricky Probabilities Using Model Counting
Hahah yes. Thanks for defending me ;) Apparently making something accessible to the public is AI. I thought it was science communication :D It's what we are all supposed to do as scientists, but somehow nobody pays us to do. So I do it in my free time. And some people thinks it's AI. Weird times.
zero_k··on Computing Tricky Probabilities Using Model Counting
Hahha you must be kidding. I am the author. And it was not written with AI. I write that blog, and never used AI to make the blog, or to post here. Weird world we are living in... Ghosts, people are seeing ghosts.

We should have a beer and then you'll see I'm real. Also, look at my history :)

zero_k··on Computing Tricky Probabilities Using Model Counting
Ooopps... it should read "when H1 is TRUE" not "when H1 is FALSE". Fixing now :) Thanks for spotting this!
zero_k··on Computing Tricky Probabilities Using Model Counting
Complicated causal chains can be tricky to work with, but estimating the probability of a bad event (e.g. nuclear facility meltdown) is extremely important. This article showcases how complicated, inter-dependent causal chains can be analyzed through state-of-the-art propositional model counters.
zero_k··on Okta Bcrypt incident lessons for designing better APIs
Another incident at Okta? Oh no! Its security has _always_ been a mess. It's a dumpster fire and no client of their cares because their identity systems are so messed up, that it's better to have the mess of Okta, than the mess they are sitting on. It's kinda crazy they get away with such incredibly bad security practices. Like... this bcrypt issue has been know for a LONG while. We used to test for it 8-10 years ago.

There's either (1) nobody competent enough there to know (which is likely not true, I had a pentester friend recently join, and she is very good), or, more likely (2) management doesn't care and/or doesn't give enough authority to IT security personnel.

As long as clients don't have any better options, Okta will stay this way.

← PreviousPage 2 of 5Next →