SomeStupidPoint

It's not even about being thick skinned: it might not bother me at a personal level, but I'm not letting a team malfunction as baseline where some members make a habit of abusing other members and will absolutely make an issue of it until management does something.

Mostly because it's illegal for an employer to operate a business that way.

You're projecting your biases on what it takes to be a "professional athlete" versus a "professional gamer" -- both require serious amounts of on-going training to stay in top condition.

You can afford a football, but recognize that (for some) it's more fun to watch highly skilled professionals play; yet, you seem unable to understand how others might feel the same way about gaming.

I'm going to say that's probably "getting old" -- the inability to see how something is like something you already know, because it's new and strange to you.

I largely agree with the argument out of doing it for assimilation and soft power reasons, however --

In general, poor people don't pay private schools the full amount, and private schools even set their budgets such that they expect to be subsidizing X% of the students at the bottom from Y% at the top, adjusting their tuition up and then discounting it for some or even most students.

You can't directly charge rich people more, but it turns out they'll look the other way if you charge everyone else less because they're poor.

> There needs to be some crowd sourced way of doing this, so if you delete an element and I visit the site, the element is gone.

This is how adblockers work (sort of).

We could probably leverage the same tech used for adblockers to make UI blockers, which maintain lists of "bad" UI and remove their tags and scripts.

Of course, I find it easier to just not use those websites.

> Some veteran intelligence officials believe a lopsided focus on offensive cyberweapons and hacking tools has, for years, left American cyberdefense dangerously porous.

> “We have had a train wreck coming,” said Mike McConnell, the former N.S.A. director and national intelligence director. “We should have ratcheted up the defense parts significantly.”

Yes, I think many have said this for years. I'm glad someone high-up went on record.

I'm not against what the TAO does, but the NSA (and more broadly, the US government) has massively failed to develop defensive capabilities.

I hope the NSA will use this as a moment of introspection, and up their defensive work -- particularly opensource collaborations and research. (The IAD github page[0] is awesome in this regard; as are things like SELinux. On the research side, things like HoTT as a basis for verified software; which has some DoD funding, but would be so much more if NSA researchers collaborated.)

I get that attacking things is cool -- but we really need help defending the national infrastructure against constant assault. It's in rough shape. I hope the people at the NSA -- particularly those comissioned -- will reflect on why they're there, and take the stance that the safety of the nation is paramount. Then work towards that, as I know they're more than capable of.

[0] https://github.com/iadgov

> I know you're out there and you know something we don't. Record it. Share it. Teach us. Interview the people who are involved in it. You might not get another chance.

I don't do this on purpose.

Some things should only exist in a time and a place for those who were actually there. It should fade with them and disappear into the writhing mass that is history.

Stop being cultural vampires: create your own experiences instead of trying to live off ours.

Ed:

The above is probably more snarky than necessary, but in a real sense, the constant reinvention of culture due to its ephemeral nature is what keeps us memetically vibrant. The calcification of culture through constantly reinterpreting high fidelity images isn't good for us developmentally.

What took me a long time -- and is still a skill I'm developing -- is to both verify and "read" the math at the same time, to see the proof and the story at the same time.

At one level, you're observing a technical construction and trying to ensure that it's (mostly) sound; but at another level, you're trying to understand the broader picture of how it fits in, what the builder was trying to accomplish or what perspective of the world they're trying to share.

Mathematics is -- like any language -- just the articulation of an experience, of an insight, of an understanding. As you get further into mathematics (and possess more technical skills of your own), it becomes more important to see "Oh, he's trying to apply the machinery of homotopy to type theories as a means of discussing equivalence" than it is to get bogged down in the technical details. Often, the details are wrong in the first draft, but in a fixable way. (This is extremely common in major proofs.)

> There is a point where one starts to see "behind" the symbols. It's a strange sensation, as if one could understand the ideas in a non-verbal way

I think at some point, you have to compile mathematics to non-verbal ideas for computational reasons -- your verbal processing skills are simply too slow and too simple compared to other systems. Your visual and motor systems are way more powerful and (in the case of motor systems) operate in high dimensions. Much like GPUs in computers, if you can find a representation of a problem that works on a specialized system, you can often get a big computational boost; in mathematics, we have to push our understanding of self and experience to the limits to find more efficient representations of ideas, so we can operate on more interesting or complex ones.

I think most mathematicians work in extremely personal, non-portable internal representations, and then use the symbols as a way to create an external representation that the other mathematicians can compile into their own internal representations.

If you see mathematics as extremely high level code meant to be compiled to equivalent internal representations on thousands of slightly different compilers, I think the language starts to make more sense -- it's meant to be a reverse compilation target for machine code that's been under revision for ~3000 years, so of course it looks a little funky.

Ed:

I will say this --

One thing I've noticed as I've gotten older is that we do a really poor job of teaching students the story of mathematics -- the human motivations, the community, the long standing projects (some have gone on for hundreds of years; some are still ongoing).

I sincerely believe that for young kids (less than, say 10), it would be better for their development to teach skills 4 days a week and simply tell them part of the story on the 5th. It would make mathematics much more relatable and understandable.

At a technical level, that supposes the file you want to decrypt still exists in X years.

My actual thought was to have the secure enclave emit an encrypted copy of the key with a targeted key strength when presented with a request signed by Apple's key. It would require Apple's participation (or compromising Apple) but still require that the person spend a significant amount of money on the process.

By having it encrypt a key, you can make normal messages much stronger, such that you can't decrypt messages without the device in question (because the key can't be attacked directly, only the weakly encrypted version of the key when the secure enclave shares it). Further, because you can change how strong the SE emitted key is with each revision, you can have new phones always have a 10 year expected safety window (and even turn up the difficulty over time). In the case of a total compromise of Apple's storage, the attacker still has to spend significant funds to compromise any given phone -- so we'll only see targeted attacks. (That is, they might say, crack Bill Gates' phone, but are they really going to spend hundreds of thousands a pop to break the keys of random Starbucks workers? I'm honestly not super worried if Bill Gates has to spend a few thousand extra dollars every few years to protect his billions.)

But we're never going to get to discuss those kinds of scoping and cost-benefit tradeoffs if we don't engage in the process of shaping legislation in an open and honest way.

You may have rate monitoring on the decryption requests, watching the traffic flow to the servers fronting your encrypted store.

An attacker is forced to either exfiltrate the data slowly (so the surge isn't noticed) or alert ops monitoring that the decryption service is unusually active.

Defense in depth raises the difficulty in going unnoticed and raises the time it takes to succeed.

I don't like it either.

But as a practical matter, I think we will do more to protect privacy and security by engaging with the process and honestly addressing their concerns so we can strike a balance between conflicting societal needs than we'll do with hardline stances based on inaccuracies.

I think pretty rightly a lot of tech people got told off by the political process for misrepresenting what was possible and how technology worked in an effort to not have to obey social structures. I don't think most of us liked that (I sure didn't!), but we're not going to have everything our way (and especially not by lying or throwing tantrums). I mean, if I were a senator, I'd be thinking "So, they can secure a ledger with floating cryptographic difficulty when they want to make money, but a solution for national security is impossible? Yeah, fuck these guys." There just hasn't been the kind of open, honest discussion around the topic that would satisfy their concerns.

And the key to having some of it our way is explaining why that issue is paramount to have our way and honestly engaging in the process to make it happen. Politics is a game of compromise and negotiation -- the government is almost certainly not only willing to concede some of the things on the FBI wishlist if better alternatives are put forward, but actually is interested in doing so.

Everyone knows professional investigators ask for too much, but if no one else is putting forward honest suggestions -- what choice do politicians have?

Sincere question: how do you define "how secure it is" except "how long it will remain secure (under attack)"?

Edit:

You're also completely eliding that security is probabilistic -- they might just guess our key on the first try. We can only discuss it as the expected amount of computation to figure out our key on average. That expected amount has a gradient along keysize.

We can also require that the hardware issuer (eg, Apple) stores an encrypted copy of the key (throwing away the key used to encrypt the original key), such that it costs $1M (or other amount) to break the encryption and reveal the key.

There's no reason it shouldn't require expense and physical breaking to gain entry, just because it's digital (and I think that this scheme gains legal protection because of such features).

By actually discussing it, instead of hiding behind lies like "there are no security gradients", we can talk about systems where it would require X amount of compute effort to break an encrypted key held in escrow for Y years at Z expense to reveal the key. (I was actually thinking about using a hash chain to timelock the key, since we have a pretty good idea of how hard it is to sequentially hash.)

I don't think most of us are against the government being able to see individual, targeted encrypted drives -- I think we object to the ability to transparently compromise all systems.

> Key strength changes because we predict when a key will /cease being secure/.

Yes, we use keys up the gradient of security that key size represents as attacks become more powerful. The reason we don't use the more secure keys in the first place isn't that 2048b keys weren't always more secure than 1024b keys -- it's just that we didn't (for most purposes) need to be that secure, and so we choose an appropriate spot on the gradient for our cost-benefit analysis.

Pretending that's not a gradient of security is simply dishonest.

> That said most of the demands made by DoJ aren't for reduced key size, they're for variations of key /escrow/: literally breaking the security model of crypto entirely.

That's missing the plot for the details: the DoJ wants a method by which they can break into digital safes in a manner similar to physical safes. Their proposal is key escrow, but that's partly because technologists didn't suggest a better way when the DoJ simply asked to get it done with little guidance. So they made a specific ask. And it sucks -- because they're not technologists. Everyone knows it, but the DoJ isn't inclined to let people flat out refuse.

Pretending that there aren't technical solutions with transparent ruses -- like there aren't gradients of security -- are how we got to lawyers demanding technical features.

I don't disagree with you that we should use secure protocols, I'm just saying we need to hold ourselves accountable for honest and strong arguments, not ruses.

The one you end on -- that using ephemeral keys is fundamentally a stronger algorithm that doesn't work well with long term taps -- is a strong argument. Much better than things like "there aren't security gradients" -- partly because they're actually true.

That's... just not true.

And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies?

I mean -- "there is not a gradient"? ...what do you call changing key size?

Ed:

I'd like the people downvoting to explain how changing the keysize isn't a gradient of security. (Hint: You can't, because it is.)

We don't have even the moderate height cube walls between people -- you're just staring at them all day over screens.

I get pretty much constantly distracted if I'm looking at another desk instead of the wall: I have a very hard time ignoring people moving, so looking out into a room full of people means I'm constantly looking around and alert to the environment as people shift, have people stop by, etc. It's not the noise that gets me, even with headphones off, it's the constant motion in my field of view.

I see Wikileaks is still publishing "leaks" about US agencies in the week following major news on the Russian investigation, as they have more-or-less consistently since February.

I'm sure this time is just coincidence, too.

You're wrong in your broad, abstract argument in a really obvious and shallow way:

It doesn't explain why the predominant strategy of life at all scales is mutualism and synergy between scales and kinds of life.

In no particular order, your "technical" argument fails to explain: eukaryotic structure, multicellular life, the interplay of fungii and roots, forests (which are more than adjacent trees), and really just about anything we see in the natural world. (Ed: I've thought of another 5 or 6 examples if you want to protest those -- mutualism is pretty easy to pick out in nature.)

And that's because you've failed to account for localized regions of stability able to ratchet themselves to greater and geater levels of stability -- and these metastable systems are the model we see on every scale of existence. Life does this as well, which means that we always see stable collaborations outpace competition (and unfairness) on an asymptotic scale. You literally failed to account for how life does work in your argument.

So I still don't believe you're advancing either a genuine observation (ie, it doesn't match fact to say it's unfair in general) or a principled theory (ie, it doesn't actually seem an internally consistent model -- at least, if you believe in physics).

I think you're trying to build a post-hoc justification for the human system being as it is.

Americans are direct only about a certain set of things.

My Thai friends are much more direct discussing appearance, for instance. As an American, that was actually quite a shock visiting Thailand -- but you get used to it and adjust, and now it feels weird that there is this taboo in the US.

Americans are more open and direct than Japan, but I don't know that I'd say they're particularly open and direct -- about the only thing I'd say Americans are uniquely is boisterous. But that's probably still only among the developed world.

I think primates are innately fairer than modern society is, though they're not totally fair. I don't think we even want things to be totally fair (I don't for instance)... Just fairer.

If you poll people, almost everyone thinks things should be more fair -- to the point that some are nearing violence over the issue. I think it's quite unnatural for things to be this unfair, and requires elaborate orchestration to keep it so.

I also don't think the idea was a principled attempt to model the situation -- I think it was a post-hoc justification for why it should be as we see, and not an actual attempt to explain why things as they are. Nobody raises "well, it's just natural" for why we shouldn't try to stop heart attacks (and particularly, I've never heard it for why we shouldn't try to reduce the number of heart attacks, as it was used here about unfairness) -- only things like equality, gay marriage, etc. Which happen to all be things that align with the speakers' beliefs (either for or against; I've heard it both ways).

Do you argue that hospitals shouldn't provide emergency treatment to people with heart attacks on the same grounds?

I'm also going to call bullshit on your entropy argument: the accumulations of wealth we see are unnatural, and a product of artificial social choices about policing. Your entire argument is nonsense post-hoc rationalization about what's "natural".

In a natural setting, things would be fairer because we'd have already murdered a bunch of rich people.

In stark contrast to your claims, it's the inequality and present social order that's artificial and unnatural.

I mostly just want to thank you for a detailed reply -- you clearly know more about this than I do and I've learned a bit.

In the interest of science, do you have some $35 bottles you'd recommend as better? It seems more productive to get a suggestion and try it than argue all night. (:

I'll cop to it: I mostly drink OOLA for the gin and only occasionally buy the whiskey.

OOLA is the only one that springs to mind -- but I could be mistaken, I'm partly relying on their marketing. (Which I mention in hopes you will correct me if I am.)

Edit:

Dry Fly used to be smaller and ship some of their stuff from the other side of the state over, so I also count them. Again, please correct me if I'm wrong!

Consistently, my experience with market consolidation has been lower quality products for more money so I can susidize the wealth of merger consultants.

If consolidation has such a prior, why would I expect beer consolidation to end differently?

Similarly, I disagree about whiskey: distilleries from my state consistently provide a better and cheaper product than large firms, and are basically dead to me when they sell these days, after a few bad experiences.

Well, in a sample size of 1, it doesn't make a huge amount of sense to discuss correlation -- the two facts both happened, and so have 100% correlation on that sample size. (But this is a basically useless statistic for making any inferences.)

The question was if we expect, given that it happened together here, we'd see it happen together more than random distribution would predict -- that is, that we see personality differences align with a split in limb control.

Since they're both changes in the manner in which one interacts with the world, and my experience of the world changes in subtle ways when I, eg, use my left hand for certain tasks or sit in certain postures, I just find it unlikely that the alignment of limb control and personality are unrelated.

> because the only thing people measure or care about as a meaningful indicator of improvement is increased profits.

This hasn't been my experience of large corporations, at all. Tons of things are measured besides profit, tons of other things are considered, and whole careers are staked on contentious debates over strategy.

Again, you seem to be treating Disney as a singular entity -- but it's probably more accurate to view it something like Europe: a squabbling mash of fiefdoms that happen to be loosely forced together, which occasionally go to war with each other, and have some sort of overarching body screaming at them that most fiefdoms half-ignore or drag their feet on implementing the directives of. (This really describes most large corporations -- which isn't surprising, considering that corporations emerged from that period of Europe.)

> I'm not sure you intended this but the wording of this pretty offensive

The implication was that it was laughably naive, yes. (I actually laughed when I read it.) Because viewing a corporation as a singular entity is a naive view: corporations aren't people, don't behave like people, and have internal conflicts that would send actual people to the mental hospital. You also seem to have a really strawman view of how executives operate, how corporate decisions are made, etc. It's like the comic book version of dramatized court decisions.

What we see here reeks of that model failing -- a snap decision made by a department VP which didn't align with the overall plan, immediately axed when the CEO + senior execs heard of it. I'd guess that there's probably a destroyed career, but Disney isn't interested in airing their dirty laundry, so we won't hear about it.

That actually happens a lot -- corporations firing staff for things the public thinks they should be fired for, because the corporate executives are actually of the same opinion about the (former) employees being incompetent in how they handled an issue. They usually just don't air it (and delay it a few months), because training the public to seek the blood of your staff when offended is absolutely insane.

> that is my point: if something is actively producing profit, the plan is to increase profits.

The company I work for likes to decrease short term profits for long term ecosystem health, because a vibrant system is fundamentally more valuable than extracting the maximum wealth in a straightforward way. I don't think we're alone or even particularly unusual in that belief -- though no corporation (including us) lives up to that ideal fully, either.

Corporations aren't angels, but they're not devils either. They're more like forests -- kind of dumb, not particularly coherent, capable of reshaping entire landscapes.

> They absolutely do have a single, coherent plan, just as all businesses do: make money

Do you mind if I quote you on this?

My team has had a stressful time on our project and I think our manager could use a good laugh.

There isn't a coherent plan to make money -- or even accepting that as the primary goal -- at many or even most large companies, because people have different ideas of how you make money (particularly over anything more than 12 months).

My point was that one (S)VP that was tasked with handling a broad part of the business and blew a call badly, misusing broad authority over PR to retaliate over unfavorable coverage. This became public on Friday and PR had a statement ready on Tuesday. The timing makes me suspect that senior executives caught wind of it Friday evening/over the weekend and shut it down Monday. However, they stalled a day to get their PR ducks in a row, since they didn't see an immediate mass reaction on Monday.

Their one-day delayed PR release on an immediate (business-week) shutdown of that behavior came out concurrently with other PR releases and ended up looking reactive.

(Pure conjecture, but it smells like this.)

I doubt Disney backed down in a weekend if all of the senior executives were in agreement about strategy -- this sounds like the head of PR was given rope and decided he liked nooses.

I think it's perfectly possible to compete with Facebook business to business (if you have SNAP levels of funding, at least).

You just can't beat them at being Facebook.

This assume Disney has a single, coherent plan.

This sounds like a VP did something stupid and probably spent all of today getting reamed by CEO + SVPs.

Ecuador is about 66th percentile by economy size, with a GDP of about $100bil.

So Ecuador is producing $100bil in value, which is similar to the total volume of transactions on the Bitcoin network.

So using less energy, Ecuador produces more economic value than Bitcoin can even move.

That sounds like Bitcoin is wildly inefficient, in that it can't transmit stored value for less than that value costs to generate in power:

It would be more efficient to use the power to create more wealth than transmit it with Bitcoin!