colmmacc

For the first problem, my favorite solution is LeMire's nearly Divisionless implementation: https://lemire.me/blog/2019/06/06/nearly-divisionless-random...

For sampling from a distribution, the best method is Vose's Alias. https://www.keithschwarz.com/darts-dice-coins/ is my favorite write up.

The "Steve Jobs" movie features a made-up subplot about Jobs insisting that the Fire Exit Safety signs be turned off to achieve "absolute blackout" in a theater. They very reasonably point out that no fire Marshall would approve it. I'm surprised for that reason, especially in midtown Manhattan. I've seen a fire marshall do a full inspection of a Broadway show and they were very thorough. This store is just a few blocks from there.

Wow this brings back memories. Over twenty years ago I added Vary support to various mod_cache submodules for Apache 2.0, and it was way too high a pain to reward ratio. It just uncovered so many user agent bugs and crazy backends. I remember arguments about being able to cache variable based on non-literal virtual headers (e.g. a geo location header), and a crazy request to Vary based on "Date:" ... which makes absolutely no sense. The whole thing was just too clever for its own good. It's no surprise that language selection ended up in URLs (/en-US/..) rather than "Vary: Accept-Lang" features.

I think the article is wrong on this but it's more subtle than that. Probability distributions have a peak; there is still a token with a peak probability. What's interesting about these techniques is that token by token it can actually make the peak token even more probable. A distribution doesn't have to be "flattened" to leave a watermark - it can be "amplified" and made "more peaky".

I'm not a bio-weapons expert, so I'll leave that alone; but I'm optimistic on information security capabilities.

There is a very painful period of risk while 30+ years of code that never had the benefit of this analysis is suddenly scrutinized by the equivalent of a million "taviso"s ... but the authors and defenders can do it too. There are asymmetric costs, and they are higher for defenders, but it's still a stabilizing arms race. Ultimately I suspect it will force more formal verification of security properties; but the same models enable that at lower and lower cost than ever before too. We should land in a place of much more rigorous information security.

From where I stand; the existence of distillation and the creation of open weight models aren't going away. Whether they are a good thing or not, there's probably no real effective option to ban or control them. I won't be surprised when we see self-service tools that allow inexpert individuals to distill and maintain their own Frontier-class models with information security capabilities. It wouldn't be much of a singularity without that.

As a defender, it's just best to assume all that and get on with things. It's not that useful or interesting a question to ask whether it should be allowed or not. It's not like a global policing mechanism will emerge in that timeframe.

I was at ANSSI headquarters last year doing a technical presentation and several of their questions were about Post-Quantum Cryptography, "Q day" (when a practical Quantum Computer is expected) and other related things. They keep a close eye on this stuff and it's to their credit. Similarly the BSI in Germany have been promoting Post-Quantum security for some time now.

I work at AWS, where we have been deploying Post-Quantum Cryptography for quite some time and have experts. We're making easier than ever, but the sudden changes in deadlines do make me wonder how many companies are going to have to spend more time than they'd planned on migrations and settings. The "context switch" of working on PQ can be quite expensive. Most tech people have no idea what ML-KEM, ML-DSA, or HQC are, or how to not worry about SHA, HMAC, or AES. It's going to be a ride!

You're right but in my experience in Washington state - Park rangers, forest fire marshals, and reservation police will all rigorously enforce the bans in places that are prone to wild fires. The local community won't have much sympathy either. People get how dumb that is. You also see bans enforced in very well off communities that basically have their own police force too. It's fascinating how these micro-cultures all self-regulate.

32-bits are great for recording too because they do an incredible job of capturing the dynamic range without having to be precise on the preamp settings. It removes an entire job from the recording workflow.

192 for mixing and mastering can be useful especially if you're doing a lot of effects, especially anything that pitch shifts. But I've seen low quality phone-microphone recordings make it to the master; if you capture lightning in a bottle, it hardly matters what the settings were, what the microphone was, or anything else.

Unless it is very specific to a proprietary product, craftspeople take their jigs with them from job to job, building up a personal library over a career. As a software developer I've always had a well-tuned IDE and shell config in a safe place.

Something I think about a lot is what is the equivalent for the software builders of today using AI tools? how do make these harnesses exportable and portable? You might think employers would be against this; make it more costly to leave. But I actually think most will favor this because it makes people more productive more quickly. But we have to find ways to normalize it and show that there are no security leaks in the process (like might make it in to a set of personal steering prompts).

Reed-Solomon is an Erasure code, and I definitely wouldn't look to that for Secret Splitting. Those leakage models are gnarly. But if you want something else that is more general - there are Monotone Span Programs. Seriously underused.

Related: https://observer.com/2026/03/the-catholic-priest-who-helped-...

Chris Olah, one of Anthropic’s co-founders, got in touch. What followed was, by McGuire’s own description, mind-blowing. “They basically were asking for direct help from the Vatican to convene and help the industry, because the industry was going so fast down this road,” he recalled.

If GitHub flipped a switch and enabled IPv6 it would instantly break many of their customers who have configured IP based access controls [1]. If the customer's network supports IPv6, the traffic would switch, and if they haven't added their IPv6 addresses to the policy ... boom everything breaks.

This is a tricky problem; providers don't have an easy way to correlate addresses or update policies pro-actively. And customers hate it when things suddenly break no matter how well you go about it.

[1] https://docs.github.com/en/enterprise-cloud@latest/organizat...

The four essential freedoms of the Free Software movement are ...

1. The freedom to run the program as you wish 2. The freedom to study how it works and modify it (which requires access to source code) 3. The freedom to redistribute copies to help others 4. The freedom to distribute modified versions, so the whole community benefits from your improvements

To my mind ... GenAI coding make all of these far more realizable, especially for "normal people", than CopyLeft ever has. Let's go through them ...

Want to run a program as you wish? Great! It's easier than ever to build a replacement. Proprietary or non-free software is just as vulnerable to reimplementation as Copyleft is.

Want to study a how a program works and to modify it? This is now much more achievable.

Want the freedom to redistribute copies to help others? Build your own version! It may not even be copyrightable if it's 100% generated (IANAL).

Want to distribute modified versions? yes! see previous.

I dunno; seems like generative coding can be as much a liberator as any kind of problem.

EC only works if parents are the sole carers, and every success story I've heard had one main parent doing 90% of the care-taking. No daycare would do it, and if you can find a nanny, au-pair, grand-parent or other carer who is up for it ... small kids still just behave differently around different people. If they have a different level of comfort, anxiety, or reluctance with a person it breaks down.

Our two year old is potty training right now, and this was definitely a factor for us. We had to wait until it could be explained. Another factor is that diapers are now so absorbent that the kid feels no real discomfort from a pee or a poop. His main motivation is peer pressure and to be a bigger kid; concepts he's only recently caught.

That's almost certainly right. I couldn't see that as anything other than "Teal" but Éalú makes perfect sense especially thematically.

That does make more sense.

Native Irish Speaker and Sci-Fi fan here. What an unexpected delight. For those who might not pick it up , the author name "Máiréad Ní Ghráda" is that of an unmarried (that's the "Ní") woman ("Máiréad" which is like a variation of Mary).

Here's my Translations of the Chapter titles. I'm pretty sure many of these have old-Irish style séimhiú (a dot above a consonant denotes what would now be a h after the consonant) in the originals that have not been translated by the OCR, so there are several missing h letters. If I weren't on a plane over Afghanistan, I'd download the PDF to check. Will update the repo when I can!

   Pláinéid na feaca Súil Duine riamh = A planet no person's eyes have ever seen
   An Radarc, tríd an gCiandracán = the view throughout the [Ciandracan] (this is a compound proper noun, "Cian" is "head" or "brain" and "racán" could be visor or rocket)
   An Turas go Manannán = the Trip to Manannán
   Manannán = Manannán (it's a noun, which is very similar to the Irish term for the Manx and the Isle of Mann). 
   Muintear Manannáin = the people of Manannán
   na 'Cráidmí' = the Craidmi (I think it's just a plural noun)
   An tÁrd-Máigistir = the high Magistrate, or possibly the supreme magistry
   An Priorún = the Priory
   Oidce sa Coill = The class/lesson/teaching in the woods/forest
   An tinneall = the fire
   Oidce tar Oidceanta = Lesson upon lesson
   Lug Lám-fada = the long-armed lug
   An Tróid leis na 'Cráidmí' = The war with the Craidmi
   Diogaltas = Revenge
   An téalod = not sure about this one

Grafton St buskers at their best are really really good, but there are also some very average buskers there every day too. New Orleans is a stand-out in the US where you can find world-class jazz bands playing on the streets.

Nashville has plenty in the evenings, and then you can find hot spots in some cities. I've seen regular buskers in Boston, Seattle, Sarasota, and Boulder - usually in pedestrianized touristy quarters.

Lesser known but possibly more relevant to most HN readers are Feynman's lectures on computation - https://theswissbay.ch/pdf/Gentoomen%20Library/Extra/Richard... . There's some really great explanations in there of computability, information theory, entropy, thermodynamics, and more. Very little of it is now out-dated.

I don't support this kind of detention, but the case reads like he overstayed his original conditions of entry.

According to the court order, he entered the US on the Visa Waiver Program in 2009. He may have a work permit now because anyone can file for an Employment Authorization Document (EAD) through an I-765 while they are applying for a green card through marriage, but there's no indication that he had work permits before that. I've encountered Irish people throughout the US in similar situations.

I am very petty about this one bug and have a very old axe to grind that this reminded me of! Way back in 2011 CloudFlare launched an incredibly poorly researched feature to just return CNAME records at a domain apex ... RFCs be damned.

https://blog.cloudflare.com/zone-apex-naked-domain-root-doma... , and I quote directly ... "Never one to let a RFC stand in the way of a solution to a real problem, we're happy to announce that CloudFlare allows you to set your zone apex to a CNAME."

The problem? CNAMEs are name level aliases, not record level, so this "feature" would break the caching of NS, MX, and SOA records that exist at domain apexes. Many of us warned them at the time that this would result in a non-deterministic issue. At EC2 and Route 53 we weren't supporting this just to be mean! If a user's DNS resolver got an MX query before an A query, things might work ... but the other way around, they might not. An absolute nightmare to deal with. But move fast and break things, so hey :)

In earnest though ... it's great to see how now CloudFare are handling CNAME chains and A record ordering issues in this kind of detail. I never would have thought of this implicit contract they've discovered, and it makes sense!

I've always considered that Tim Jennison quote to be a reference to C.P. Snow's "The Two Cultures" lecture. Steve Jobs' ambition for Apple to be "where the Liberal Arts and Technology meet" also seemed similarly influenced. If you haven't read Snow's lecture, it's well worth the quick read.

There is a great meditation in Zen and the Art of Motorcycle Maintenance about the differences between riding and driving. Being open to the elements, in and a part of nature, is visceral. Bubbled in a car, our surroundings are observed more than experienced. That's always resonated for me.

The transition to 7200 VXRs as core routers really hit a tipping point around 2000. They could handle millions of entries in the FiBs and really led to a relief in pressure. Subsequent devices had to match that.

On the IPv6 side; by 2002, nobody was really experimenting with A6 records any more, and EUI64 was needless. Both were parts of IPv6 designed to facilitate "easy" renumbering, so that single prefixes could be replaced with larger ones. But the ISPs weren't complaining any more about table size.

The Oscars, The Golden Globes, the Emmys, just a few!

I don't think it's nefarious but it is sabotage. There's long been an implicit assumption that optimization should be more important than safety.

Yes, languages do lack good mechanisms to mark variables or sections as needing constant-time operation ... but compiler maintainers could have taken the view that that means all code should be compiled that way. Now instead we're marking data and section as "secret" so that they can be left unoptimized. But why not the other way around?

I understand how we get here; speed and size are trivial to measure and they each result in real-world cost savings. I don't think any maintainer could withstand this pressure. But it's still deliberate.

I bought this latest Heaney book while I was in Ireland recently and it lives in my nightstand, along with the other Heaney books in the series (his letters, and his translations). They are an endless marvel and constantly make me ponder. Part of the attraction for me is that Heaney is simultaneously a peerless transcendent writer, but also is very everyday. He came from a working class, or maybe lower middle class, background and stuck to Belfast and Dublin and lived a relatively humble life. When I think of Yeats I can only see him in Tweed suits, visiting country estates with servants, and making posturing speeches in the Irish Senate. Yeats was an expert commentator, but removed from many of the experiences and lives he documented. Heaney really lived them. It's so much more relatable.

So they open the source ... how do I know that's what's running on the voting machine? There's really no good practical solution to this problem. What matters more is that there is a voter-verified paper audit trail and that this record is actually counted. At least by spot check risk-limiting audits, but ideally just count every vote manually to verify.

No, this absolutely is not how forward secrecy works in TLS. Forward secrecy protects against a break in the signature algorithm, but not in the key agreement algorithms.

Both the FFDH and ECDH key agreement algorithms are vulnerable to quantum crypt-analysis; someone capturing traffic today could later break that agreement and then decrypt the data. An attacker would have to capture the entire session up to the "point of interest" though.

This is why FFDH/ECDH are being augmented with Post-Quantum secure KEMs.