Aaron1011

In this case, there was already an existing Lean statement of the problem in the formal-conjectures repository, which they re-used: https://github.com/openai/NavierStokesAndEuler/blob/8937a8f4...

> And tape is very secure, with built-in, on-the-fly encryption

What exactly is this referring to?

I believe you're think RFC 6018: https://tools.ietf.org/html/rfc6108

Related HN discussion: https://news.ycombinator.com/item?id=15890551

I thought that the issue with /dev/urandom was that it wouldn't block when read shortly after startup (when the entropy pool wasn't yet initialized).

> That's enough to turn a dollar into 16 billion in 5 years.

I think it's actually 1.6 trillion

> It doesn't matter in practice if the content is still accessible when the browser tells people that accessing it is dangerous.

It certainly does matter. There's a fundamental different between people being discouraged from accessing a website, and said website being completely inaccessible.

Displaying a warning to users doesn't make sites "inaccessible".

I was referring specifically to the author's claim that deprecating HTTP and displaying a warning to users is the equivalent of "rendering large parts of the web inaccessible" and "massive book burning".

> Also, if Google succeeds, it will make a lot of the web's history inaccessible.

> It's like a massive book burning, at a much bigger scale than ever done before.

How on earth did the author reach these conclusions?

> I'll ignore the irrelevant marxist talking point

Which part of the parent comment was a "marxist talking point"?

A government can imprison people for horrible reasons, but still not have the worst radio.

> As of now, text rendering methods are missing and for security reasons you cannot read back pixels from the canvas.

Does anyone have an idea as to what those reasons might be? I've heard of JavaScript access to certain CSS features being limited (e.g. getComputedStyle()), but I'm not sure what the benefit is here. Is there any way that user information could be leaked through a paint worklet context?

That's to be expected.

The idea behind my script is that the URL is encoding the unix time of the first visit to that URL. By starting at the current time and working backwards, the first HTTP 200 you come across should be the current page.

I tried that, but found that guessing backwards from the current time works better: https://gist.github.com/Aaron1011/2595f8699ade9d4df16398a68e...

You and the lawmakers opposed to that bill certainly seem 'allowed to say' whatever you want on that subject.

Let me be more clear: What does this have to do with 'What you can't say in Silicon Valley', or 'animosity towards Trump'?

How is this related to the parent or OP?

> Look, things like murder or pedophilia are unabigiously evil

If by 'murder' you mean 'unjustified killing', then that's trivially true. If, on the other hand, you just mean 'killing', then it's far from obvious that killing is 'unambiguously evil' (self-defense comes to mind).

> I feel like society, at least a larger portion of it, understood this in the past. Your creating taboos. Things we don't dare talk about or explore because we fear having our lives destroyed by twitter lynch mobs and the like.

Harassment on social media is certainly an issue, but it's ridiculous to describe 'people criticizing me on the Internet for what I say' to 'censorship'.

> But what you actually want to do is knowing as "mobbing" in Europe and it's generally illegal (at least in some countries)

No, what I 'actually want to do' is allow people to chose which companies to purchase from, and to allow them to advocate for others doing the same. What exactly do you mean by 'mobbing'?

> If your paper was critical of the Fuhrer brown shirts would storm in, trash the place and assualt people

Are you really going to compare online speech to physical violence?

> Live and let live. There are people out there with different views than you. Some of those views might be down right offensive if you really thought about it.

How do you determine which of those are 'unambiguously evil'?

> That is censoring and shutting down the argument. Who are you to make that call?

If people aren't allowed to state that 'behavior X makes person Y unethical', then how are we supposed to determine what is 'objectively unethical'.

> You don't find it bad that a bunch of people, based on their own non-objective oppinion

What is an 'objective opinion'?

> get to ruin someones business and/or career?

Are you saying that it's a bad idea for people to boycott businesses, or that boycotting businesses shouldn't be allowed? If it's the former, how do you distinguish between 'good' and 'bad' reasons to refrain from purchasing from a business? If it's the latter, what would that even mean? Should people be forced to buy from a particular company?

> I feel like I'm talking to a Hitler youth right now

If calling someone unethical is "shutting down a conversation", what is comparing someone to the Hitler youth?

> Which is not what we're talking about. Only in your own mind. But here is the issue again, as soon as you decide, on your own, that something is "harmful" for however you decide that, now you get to do whatever you want.

As opposed to (objectively?) determining if something is 'objectively unethical'?

> I realized I felt more comfortable discussing controversial ideas in Beijing than in San Francisco. I didn’t feel completely comfortable—this was China, after all—just more comfortable than at home.

> Restricting speech leads to restricting ideas and therefore restricted innovation—the most successful societies have generally been the most open ones

There's quite a difference between 'I feel uncomfortable discussing topic X in location Y' and 'location Y is restricting speech'. The only concrete example in the article of the former is a 'toxic reaction' to work in 'intelligence augmentation, genetic engineering, and radical life extension'.

What exactly does a 'toxic reaction' mean? Is there a meaningful distinction between it and 'strenuous debate about ideas'?

Based on the examples given, this article seems to hold 'mainstream' and 'heterodox' ideas to different standards. Criticism of mainstream ideas is (rightly) described as 'necessary to get the really good ideas', 'what drives the world forward', etc. Criticism of heterodox ideas, on the other hand, is a 'restriction of speech' and a 'toxic reaction'.

I wish that Altman had provided more a single example (the reaction to 'intelligence augmentation, genetic engineering, and radical life extension') instead of vague references to 'controversial ideas', 'casting the people behind the ideas as heretics', and 'heresy.

From Comcast's RFC that's linked in the thread:

> R3.1.1. Must Only Be Used for Critical Service Notifications

> Additional Background: The system must only provide critical notifications, rather than trivial notifications. An example of a critical, non-trivial notification, which is also the primary motivation of this system, is to advise the user that their computer is infected with malware, that their security is at severe risk and/or has already been compromised, and that it is recommended that they take immediate, corrective action NOW.

Not only is Comcast trying to justify this awful practice, they picked one of the worst possible examples to do so. There is no set of circumstances under which a 'You have malware!' popup should be taken seriously.

I can't seem to find a definition of "Partial disclosure" on either the website or the IETF RFC draft.

Morse code: "translation"

18: - .-. .- -. ... .-.. .- - .. --- -.

Based on the white paper, "Blueborne" is really a collection of distinct vulnerabilities in various implementations of the Bluetooth protocol. This is in contrast to something like the 'Over the air' vulnerability (https://googleprojectzero.blogspot.com/2017/04/over-air-expl...), which was a bug in the firmware shared by Android and iOS.

From the white paper:

> Despite this, the Linux Kernel is lagging behind in implementing some modern mitigations in its default configuration. Both stack canaries - which protect against stack overflows, and KASLR (kernel address space layout randomization) are lacking in most devices running Linux today

It seems that they opted not to try to bypass stack canaries, probably because of the number of Android devices running old versions of Linux.

It seems inaccurate for them to categorize this as a problem with kernel itself, however. The kernel itself isn't "lagging behind" if mobile/embedded devices won't update to never versions containing newer mitigation techniques.

Part one of the three-article series: https://www.reuters.com/investigates/special-report/usa-tase...

> I don't trust people who are more code-savvy than I am (that's most people) not to insert or exploit weaknesses in open-source software or other open code

That applies to closed-source software as well. With (popular) open-source software, on the other hand, you can be confident that "people who are more code-savvy than you are" can examine the code for inserted weaknesses. Existing vulnerabilities can and with be exploited if there's an incentive to so so, regardless of whether or not the source is available.

> With closed-source software, I know the origin point of the software I install, I know the names of the individuals or teams who developed it

That seems like the exception, rather than the rule. Consider browsers, for example. I can see exactly which people have commit access on the open-source Firefox or Chromium projects. When it comes to a closed-source browser such as Microsoft Edge, on the other hand, I only know that "the Edge team" develops it. I have absolutely no idea who is currently on this team, or the quality of any individual member's work.

> and therefore I know who stands behind it, because their reputation is based on that released software working

This doesn't mean that closed-source software is intrinsically less vulnerable than open-source software. Microsoft's reputation may be based on Windows working, but that didn't stop WannaCry - nor will it stop future exploits.

> If something goes wrong, I can take clear action because I know who is to blame, e.g. Vivaldi, Microsoft, etc.

Realistically speaking, what action can you take, besides switching to other software?

> With open-source software, that liability for the software developer is thus offloaded to "the community"

You're conflating open-source software with software developed solely by the community. Many open-source projects, such as Chromium, Firefox, and Linux, do have specific organizations that are either involved or responsible for their development. Closed-source software only gives you an opaque team or organization to blame, while open-source software can give you a specific commit - diff, date, and author.

> Too many people can see it

Direct access to the code may make finding vulnerabilities easier, but as shown by the number of security vulnerabilities in well-known and well-funded closed-source projects (Windows, iOS, etc), it will not stop determined attackers from finding and exploiting them.

> too many people can make changes How many is "too many"? If you're referring to the number of people with commit access, then you're almost never be able to know that number for closed-source software. If you're referring to the number of contributors, then it's not much different from trusting the core development team in the first place. Regardless of where the code originally comes from, you're trusting the maintainers to be able to recognize bad and/or vulnerable code, whether done accidentally or maliciously.

> and it's happening way too fast

Do you have a specific project or projects in mind here? This seems very similar to the issue of "too many people can make changes" - you can only make an informed guess, at best, as to the development rate of closed-source software. Unlike open-source software, you can never know exactly how many changes went into a particular release.

> Suppose, for example, that a student’s top choice school is hugely popular. But their number two to five schools are only slightly short on places. Then it could make sense to register for the number two school in the first round. They would have good chances to get into the second best school. Going for the number one choice is risky: if they don’t get in, they have no shot at any school in their top five anymore.

Why would not getting into the first-choice school affect the student's chance of getting into any of their top five schools? The article's earlier description of the Boston method makes it sound as though this wouldn't be the case.