bpolverini

The Government already has a monopoly on force and steals our money under the threat of imprisonment in the form of taxation: Now that money is supposed to be allocated into risky investments for abstract, unmeasureable benefits like "soft power," for the benefit of people somewhere else? That creates resentment here. It also infantilizes the Global South.

How much better would it be if we eliminated the IMF, shrank government, and lowered taxes so individuals could freely choose how to benefit the Global South via nonprofit giving? If people don't give voluntarily, why should they be compelled to give in the form of taxation?

I feel like Graeber, an anarchist, would appreciate a decentralized solution like that instead of trying to handle this from the top down.

Very true and worth evangelizing to others. I have unknowingly violated -fstrict-aliasing in some part of my code only to discover later that it is benign at -O0 and metastasized at -O3.

This freaks me out the most in networking code, where there is all kinds of casting of structs (esp. if you blindly copy-paste examples from StackOverflow) and performance usually matters. Rust has inspired me to take more time to profile C code to see whether strict aliasing (strict overflow, etc.) actually make a significant enough improvement to merit the UB-risk, review time, and acid in the stomach.

I buy the premise that Zig is better if you know you will have lots of pointer arithmetic going on. Having written a fair amount of unsafe C interop code in Rust, I feel like these critiques of the ergonomics are valid. The new #![feature(strict_provenance)] adds a new layer of complexity, that, I hope, improves some of this experience while adding safety. Rust's benefits are not free.

The benefits of Rust's (wonderful) model around references and lifetimes come at a significant cost to ergonomics when having to go into the Mordor of some C library and back. I usually find myself wishing I could have some macro where I just write in C and have it exposed as an unsafe back in Rust. I know I can do this by just writing a C dylib and integrating that, but now I've got two problems.

Even still, I prefer writing unsafe Rust to writing C. std::mem::ptr forces me to ask the right questions and reminds me of just how easy it is to fall into UB in C as well.

Who do the Kachin, Karen, Rakhine, Shan, etc. support at this time? Are they siding with the NDL or the military?

If you're interested in seeing an interesting off broadway twist on the Noise Protocol Spec, libdisco and strobe are really interesting:

https://www.discocrypto.com/

https://strobe.sourceforge.io/

The Noise Protocol spec is fantastic. It asks a reasonable set of questions to a protocol designer and in exchange gives a set of safe choices for key exchange. It's a great example of building powerful systems from a handful of simple abstractions. Trevor Perrin (and I'm sure, not just he) did a phenomenal job.

That would be really cool, but I think enforcing that is undecidable. My gut tells me that having that language feature at compile time is the same as the Halting Problem.

What if someone lives in Taiwan or the United States or Singapore or anywhere outside of the PRC? This is exactly the type of sociotechnical pressure the PRC wants to enforce over its diaspora.

As an Italian-American, this explains why every time I go to a Buca di Beppo, I feel like I'm in some kind of merger between a mediocre Italian restaurant and a minstrel show. To those of us who grew up in this culture, it's ridiculous (almost bordering on offensive). Thankfully, I grew up in communities where the Italian's could proudly go to other restaurants that were more respectful of a 3,000 year old culture.

It's tough to feel proud of what Buca di Beppo has done to popularize Italian-American culture in the same way it's tough to feel proud of the movie The Godfather. We aren't all mobsters and we don't all have giant busts of the Pope and cherubs in our houses. Some of us are just computer scientists who like basil.

The dueling rhetoric is the same rhetoric that has been around for decades: Some people really feel type systems add value; others, feel it's a ball and chain. So which is it? The answer is probably "yes." We should all believe by now since history has proven this correct. Most of the time you start with no type system for speed. Then you start adding weird checks and hacks (here's lookin' at you clojure.spec). Then you rewrite with a type system.

I'm a devout Clojure developer. I think it delivers on the promises he outlines in his talk, but I also have no small appreciation for Haskell as an outrageously powerful language. Everyone robs from Haskell for their new shiny language, as they should. Unfortunately, not a night goes by where I don't ask God to make me smart enough to understand how a statement like "a monad is just a monoid in the category of endofunctors" can radically change how I implement marginably scalable applications that serve up JSON over REST. Clojure talks to me as if I were a child.

Rich Hickey is selling the case for Clojure, like any person who wants his or her language used should do. His arguments are mostly rational, but also a question of taste, which I feel is admitted. As for this writer, I'm glad he ends it by saying it isn't a flame war. If I had to go to war alongside another group of devs, it would almost certainly be Haskell devs.

Why are we down voting this? Of all people in the world, Ray Dalio would want us to ask, "Why." Principle #1: Trust in truth. Whether I'm being facetious is an exercise to the reader.

First thing I thought of when I read this was the article by Sam Altman where he calls businesses valued at $100M "really good airplanes."

https://blog.ycombinator.com/navigating-mid-success/

Something is awry in our understanding of moral capitalism at large for statements like that to be met with anything other than derision, and DHH is getting at the heart of why: We've all become obsessed with growth. When the way to get rich in the world is capital gains, as opposed to value creation, the abnormalities in behavior and ethics, which are glorified elements of Silicon Valley culture, fall out as a natural consequence. Having real, powerful values that help evaluate whether something legal is actually ethical means saying "no" to certain kinds of work. God forbid you do that though, lest your investors punish you.

Where your treasure is, your heart will be also. It comes as no surprise to anyone tarrying long over the facts that SV's treasure is gold.

The personification of "Silicon Valley" into some giant evil blob-like entity attempting to consume innocent, creative counter-revolutionaries undermines a perfectly awesome, but 100% non-unique to SV opinion: Technologists (and any industry with any modicum of power) can suffer from a bad case of hubris.

Is creative destruction real and good (most of the time)? Yes. Is your startup selling SGaaS (scuba gear as a service) going to radically impact the disinherited and the poor? No. Is there anything new under the sun?

Still, the criticism of the author is received: More humility from the collective "we" of SV wouldn't hurt.

That video of the crying manager is what made me quit Bridgewater. The craziest part was that the manager who ended up crying became the one who would teach lessons to new hires on how to "diagnose" other employees. Totally psychologically broken.

Ray Dalio won't quit and he won't relinquish power. What you have instead now is this psychotic power grab at the top with three or more people competing for the crown. Any time someone gets close to knocking him out, they get demoted or fired.

Principle #41: By and large, you will get what you deserve over time.

The basis for any oppressive religion is #41. Those at the top deserved it, and, if you are at the bottom, it's because you haven't.

I can see Orwell was right already. "Terrorism" (the word) has become, by and large, a tool of nation-states and institutions like RAND to legitimize another horrific term: "extra judicial killing" (i.e. murder).

The last thing we as technologists need to do is feel obligated to take part in some continuous war against a concept that cannot be defined, with a victory no one understands or articulates.

Liberty has costs. We can either live in perfectly monitored and managed security (i.e. fascism) or make trade-offs that give us privacy and freedom critical to human flourishing.

There is absolutely nothing to root for. He's killed (and his cartel continues to kill) a tragic number of innocent people: women, children, and the poor, all across Mexico. He's a vulture.

With an infinite supply of drug money and weapons coming in from the United States, what is PRI or the PAN or the PRD supposed to do? Mexicans are proud, and the notion of immediately extraditing him to the country that gave him power is an incredibly bitter pill to swallow.

I wouldn't be surprised if he just has an "accident" in the following months that leaves him dead and buried where he committed all this injustice: in Mexico.

With or without "use asm", as hackcasual mentioned, we don't have the control we need, like one might have on some platforms in C. Some of the articles we reference in the top section of the blog post mention this about Javascript and are great reads. We selected these particular primitives because the authors mention avoiding timing attacks as a key feature of their C. We believe that aspect to their libraries is still fantastic even after being compiled with Emscripten, but you're certainly right in saying that JIT'ing and Asm.js complicate things.

Definitely right about that.

The biggest reason was familiarity with the Skein NIST implementation--I've dug through it in the past in research and the like, so I wanted to leverage some experience there. We decided against just using crypto_secretbox from NaCl because it doesn't have a way for us to simply pause and resume to keep from blocking our UI thread on big files. We thought about trying to bolt ways into seeking into the stream output of crypto_stream, but that wasn't performing well. We went as far as trying to use crypto_secretbox in an Asm.js-ified WebWorker, but the performance hit was just too big, so we knew we had to find a way to "schedule" our encryption, otherwise our React.js app would crawl. The reason I passed on AES is far less justifiable, but important to me for aesthetic reasons: Using Skein just seemed like way more fun. Programming without whimsy is drudgery.

My next blog post will cover some of these decisions and performance tradeoffs in more detail with some code. Since you mentioned it, I will add an AES-CTR implementation into the metrics so people can see. I'm curious myself to see how we stack up!

You're right. To be honest, the reason why we don't use it the way it is described in the paper, is entirely out of fear of misconfiguring the Skein context. The NIST reference implementation for Skein doesn't provide a simple way or an example for building the valid configuration for the HMAC construction they recommend, and we always wanted to feel like we had a wall to our back (i.e. being able to check against the NIST implementation or to check against test vectors). They do mention in the paper that doing the keyed mac approach is provably safe, which just felt easier to implement.

Yeah, it is. We use the optimized 64bit version through JNI in our backend.

Skein -- interesting choice. I always liked the ARX construction in skein, and it's cool to see it in Javascript through emscripten.

Partly, but it is primarily to bring those living in rural areas into an urban context as a mechanism for modernizing the economy.

Right now, under the hukou system (https://en.wikipedia.org/wiki/Hukou_system), you can't just move anywhere you want. What ends up happening is those living in rural areas illegally move to cities like Beijing/Shanghai/Shenzhen for work, but can't get their children educated or get healthcare. This is a way to prevent mass migration to the first-tier cities.

Bingo.

All the more reason why client-side encryption needs to become part of our daily interaction with software and cloud services.

This is bomb. Interesting to see someone borrowing a page from microkernels to bring the networking stack into userspace.

Hopefully, technologies like this create a renaissance for protocol design. ZT does the heavy lifting in terms of security and routing, and devs are just left with a flat network that can be optimized for the particular application. We've already had some pretty big wins using ZT to do this for encrypting links between our own microservices -- it'll be even nicer when we can do this at the container-level, without any additional Linux kernel hackery.

One can only imagine what kind of Faustian bargain Cloudflare had to concoct in order to make this all legal.

Once Baidu and the PSB have managed to extract enough useful intellectual property from Cloudflare, it will only be a matter of time until they find a reason to block Cloudflare and replace it with a domestic service that can be even more tightly controlled.

Cloudflare is phenomenally competent, but Matthew Prince is likely in for a serious surprise that has nothing to do with technological innovation and everything to do with sociology and a different culture.