SomeStupidPoint

It was something like 1500 years between the discovery of squareroot 2 and squareroot -1.

If you view mathematics as the exploration of progressively stranger objects, that there's such a gap between discovering two roots should make us cautious of discounting things after a 100 year search.

We don't know what we don't know.

> Because, like any other successful scientific hypothesis, the P≠NP hypothesis has passed severe tests that it had no good reason to pass were it false.

Is this the crux of the post?

That seems like an extremely crap reason to believe a mathematical theorem. What am I missing?

I also don't find his heuristic convincing -- to the point his description is making me question if P=NP is actually possible after all: a close complex border that seems to yield increasing numbers of "close calls" sounds exactly like the situation where there's a lurking, sparse class of "touches" that we haven't thought of, particularly when under 100 years of research has been put into the topic.

> Vulnerabilities happen from wrong function calls, yes, but also through using the wrong types of calls for the particular purpose.

Which is detectable through static analysis of the type signatures -- at least to the point of ensuring that a threat assessment document includes a section on what they did there.

That's my point -- why doesn't my IDE auto-generate a template threat assessment report to share with security as part of my code review process? ...why does it rely on me understanding the possible threats, rather than clearly expressing what data I use and letting security set flags on what I should watch?

That sounds like a lack of tooling -- because there's not a technical reason.

Because the profits from serving the malware are concentrated while the harm is diffuse.

Is that just a general feeling, or are there specific issues you have with Amazon?

Ex: Maybe a particular page has too many ads/has ads at all/etc. Or maybe a particular service doesn't really do what you would like.

Disclosure: Work at Amazon, not on anything customer facing.

Anecdata will vary, but my experience has been those bugs get filed, marked "not important", and PMs have no way to sift the security impactful dozen out of hundreds to thousands of small defects in a large product's backlog. (And sometimes that backlog gets deleted, disappearing knowledge of those bugs.)

I'm hoping we'll eventually be able to flag bugs with the types involved, and let systems automatically look for combinations that have a set of types that could be dangerous.

My point was that it's not enough to focus on good intentions -- or culture -- you have to talk about mechanisms and technologies if you want a reliable system. Because the parts, humans in this case, are highly unreliable in isolation.

> Create a culture of writing and deploying secure code.

How?

That may sound glib, but this is really just asking everyone to try, right? I would guess that the vast majority of security mistakes stem from ignorance not apathy, and that most coders are trying. Relying on people trying clearly isn't working because there's simply too much to know and it requires too constant of attention.

I think we actually do need better tooling, in terms of things like using type systems to flag sensitive data and automatically suggesting a threat modeling report include that item.

The suggestion that people spend a lot of effort all the time is clearly not going to work -- why can't we ease that barrier by focusing on better tooling so security becomes a natural part of the process, enforced by actual mechanisms?

It's also irrelevant: nominally pro-Clinton ads can be used to generate net Trump support, and we'd have to have a way more involved discussion of PSYOPs to see if the two statements were in conflict.

Of course, green account with pro-Trump talking points of questionable content might very well be a propaganda account.

Dont DARPA and other US gov research groups have a pretty long track record of successful projects?

Computers, nukes, ICs, space, internet, self-driving cars, etc.

They seem to be some of the most well used research money -- precisely the government mandating progress.

I just assumed the test was that if you can decode that mess, clearly you're a bot.

> 1-2 people

If you're less than 3-5 people and have no money, you're looking for a technical co-founder, not an employee.

I've done say, 1 day a week of dev on the weekend while having a dayjob to get a project started for a share of equity because I liked the project. (So have others I know.)

Just have realistic asks in terms of time/equity trade so people can balance their risk by having other work as well.

I have such a name -- doesn't particularly bother me.

I understand how people can feel that way though, but my question is -- why is that feeling anything but obsessing over a vanity metric, and actually a useful mechanism for author evaluation?

> If the answer is that contributions to scientific papers can be very fuzzy, e.g. it is hard to determine which contribution is more important than others, then I agree alphabetical order makes sense. But is it really so in most of the papers?

I'm probably biased from being in industry, but even when people contribute unequal code to a module or writing in a report, we just list the authors alphabetically because it's obnoxious to do anything with the list otherwise and it stops a huge amount of politicking when the first three out of ten authors contribute equal amounts. At the end of the day, stable collaborations will outpace individual contributors -- so we should focus on what allows us to openly collaborate and tears down barriers to doing that.

But from my point of view, we have a lot of the same incentives between industry and academia:

1. If you want to get promoted, you need projects associated with you and to get noticed.

2. There needs to be some method to decide who gets what amount of bonuses.

3. Funding allocation is tied to past successes.

...and probably some more I'm forgetting.

So I think my experience isn't totally irrelevant -- you get enough signal out of the distribution of the person's name that the loss of whatever from not getting "first" information is eclipsed by the gains from less politics (and if you have a lot of documents, easier parsing).

Again, perhaps it's the industry talking, but I'd rather hire an author that contributed the third most to a large number of papers than someone who contributed first most to a few. One of them seems to be a "force multiplier" in that they're keeping several other ICs moving (and contributing on all those efforts), while one guy just seems a specialist in a particular work.

I don't think removing the "first" signal harms my ability to find those "force multipliers", because they'll still have the same markers (as they weren't showing up first under the other system anyway).

So perhaps I simply have different uses for the rankings than people who feel differently?

Your position is a reasonable one, and it's beyond debating it on the internet to decide which one would be more practical -- it would depend on the situation, how much money you had, and how damaged you thought the system was. People could certainly disagree on their assessment.

I tend to think that wrench throwing is more effective for systemic problems than discussing it. The assembly line is doing damage while you discuss the problem.

That said, I'm also biased here: the lawsuits idea hits two of my pet peeves, in that it also forces debate around the issue of the justice system being chronically understaffed and underfunded.

Filing that volume of lawsuits would effectively DDOS the courts (which is why they're going to hold you in contempt no matter how legal it was), but even doing due process on your contesting of that would likely drown the justice system to the point it forced a national debate over how it was operated.

That's a resonant issue with the arbitration one, since the forced arbitration is a symptom of that deeper funding issue -- we don't invest in efficient civic infrastructure, so corporations built their own.

tl;dr: Two birds, one stone; forcing instead of discussing; debating the underlying issue, not just a symptom.

You state your opinion, but don't justify it -- could you share why you think it is important we list first author by contribution? What does this accomplish?

Obviously not everyone agrees (or you wouldn't have felt the need to post), so why not share why you think you're right, so we can discuss the issue?

Edit:

Well, we've proven that people feel very strongly about this, but I'm no closer to understanding why people care so much about it. (ie, what they think it accomplishes.)

C'est la Internet, I suppose.

> To intimidate Ken White?

Also, if I were trying to intimidate people who read a lot of Ken White's opinions, I wouldn't try to do it by filing questionable legal things about Ken White, thereby forcing him (as you say, a former USDA with a wide network) to enter into legal proceedings with me and inviting him to discuss my actions to his audience.

To a first approximation, that seems like it has a high likelihood of backfiring.

Except they have to get all of those millions of lawsuits dismissed individually by advancing that argument and failing in even a single of those cases through a novel argument on the part of plaintiff, sympathetic judge, etc could open an avalanche of lawsuits against the firms.

It also would force the courts dismissing the lawsuits to grapple with the sheer scale of criminality that the dismissals are being used to hide -- it's easy to hide it when you shut down a handful of lawsuits and the vast majority of your victims remain silent, but are judges going to be so accepting of mandatory arbitration when they've already, personally, dismissed thousands of suits because of arbitration clauses that are about the exact same kind of fraud perpetrated by the exact same people and have thousands more left on their docket? How many times do you believe that a judge can see the exact same crime happen from the same perpetrator and just go "Ho, hum, nothing to see here!" Sometimes, the key is just to be really noisy and annoying so they can't ignore the issue.

The act of filing the suits, particularly in a concerted bulk effort, and forcing the government to address and dismiss each individual suit is an effective form of speech and protest.

Your argument is shallow excuses for defeatism, which in turn excuses not actually trying.

Edit:

It also introduces a novel argument of "Uh, so this court has dismissed over 10,000 lawsuits about this exact issue -- clearly we're being abused by a corporation and petitioning the state for assistance. [Argument why the state is obligated to assist.]"

It forces the court to explicitly address the argument that the arbitration system is being coupled with a power imbalance to enable criminal action against entire states of people by documenting the scale via dismissals -- which are public record and can be used as evidence in subsequent cases.

It's pretty easy to make a bag of garbage; it's non-trivial to make 100M bags of garbage.

Even if they're making CRUD apps, making tons of high-availability CRUD apps that work against dozens of services your team doesn't own that can serve huge fractions of the globe requires non-trivial coordination and skill. (Not that all those companies do is CRUD apps, but even if.)

I'm not sure it's as jard as those companies make it out to be -- but it's not "just CRUD apps", it's the logistics of CRUD apps spanning the globe.

Source: work at one of those companies.

You didn't even suggest that:

OP is claiming some locations are hidden, not their main office.

The main office is well marked giant office complex next to the public cryptographic museum.

> It doesn't satisfactorily make the case that targeting the audience rather than the topic-related websites doesn't work or make sense.

I've been saying this needs investigating for a long time. From my understanding of things like triggers, priming, threshold for action, etc -- you're probably doing yourself a disservice having out of context advertising.

When you advertise in context, you get constructive interference between the context and your message, leading to a more powerful effect -- your buyer was ready to hear what you wanted to sell; when you advertise out of context, you get destructive interference between the context and your message, leading to muddled or even negative effects -- advertising roast beef on a porn site is probably bad for all three parties! (No matter how much the person viewing porn likes roast beef.)

"Targeted" rather than topic based advertising ignores basic facets of human psychology (eg, that we're very context based animals) in order to pump up ad stock and sell more volume of a diluted product -- because all of the "targeting" is fundamentally a worse replacement for the signal shown by visiting a topical website. It's about inventory fluffing, not efficiency.

That said, the article didn't do the best job supporting that point.

People managed for a long time not being able to communicate between distant settlements faster than months or years, either having to go in person or send something on paper -- I think we'll be able to manage 20 minutes delay on them receiving video chat.

That whole block is located just off of the core part of downtown Seattle (3 blocks from city hall and muni tower; 1 from Smith Tower), but currently filled with little shops in a small building. A coffee shop next door moved across the street to expand and switch from a short building to a slightly taller, somewhat newer one.

Downtown Seattle has pushed about as far North as it can, and is starting to expand South (past the government and banking towers) as well. Most of these shops are just going to shuffle into new spaces or be replaced by other little shops in new spaces. It's unfortunate, because the neighborhood is old, but there's limits to how much poorly developed land we can hold in the core of downtown. I expect everything from downtown to the stadiums is going to become towers just like SLU did -- because the core of the city needs the space. We'll probably keep a touristy section along the water (just like now) and the core of Pioneer Square, Smith Tower itself, etc. But these kinds of small shops need to move or find a business model that fits with the new density.

I might feel differently if it were a park than a bookshop -- but I don't really feel that bad that a small, niche store got pushed out of the core of downtown so the property could develop.

Not going to discuss specific stories for confidentiality reasons, but when I was a security guard, bad clients only had two things to say:

When things are fine: "Why are you in the way, doing X?"

When things aren't fine: "Why didn't you do something?"

Nevermind if the X they explicitly tell you not to do is related to stopping bad thing.

Despite having better internals, none of my smart phones have felt as well designed as the original Droid, that had the sliding keyboard, solid metal case, and bevel that did a lot to stop fall damage. My current phone even has a similar size screen to it -- the only feature difference is that my current phone is thinner and every other feature is worse.

If anyone knows a smartphone with that style of physical keyboard, rugged style, and good battery please tell me.

I'll trash my cheap, thin piece of plastic and buy one instantly!

I'm actually not sure what you're getting at -- the logic you just presented is "the primes and evens are the same set of numbers because both contain 2".

Assuming you mean the and not a, they're still not the same, as equivalent algorithms need not be identical. Example: 5-3 and 1+1 both compute the result 2, making them equivalent but non-identical algorithms.

There's a way to transform any subtractive recipe for a number into an additive recipe so they're equivalent classes, but addition and subtraction aren't identical as operations.

Yes, and?

Deals can be mutually beneficial -- my point is exactly that allowing them to partially cash out while remaining in control leads to stability and earlier cashing out, both of which help the public.

The suggestion I replied to was bad for everyone, because it forcibly negates a deal that's good for everyone.

That seems... worse.

It'll force companies that are still growing with a powerful CEO to stay private (or possibly just be destroyed, if they're already public) because of CEO churn.

The effect of that will be that 'in' parties will get to participate in the growth, while the greater market (eg, retirement funds) get cut out of that. The effect will be that the rich get richer, while the public subsidizes their gains by buying in only at the very tail. (Essentially, just pushed down the line even further than now.)

I think America actually is powerful because corporations aren't democratic. It allows the US to function as a macro-democratic republic (where the public controls the rules of the game) but micro-feudalistic society (where you have fiefs implementing those rules). Kings are efficient; republics are stable. So our infrastructure is republican, while our 'features' are feudalistic. If you believe in capitalism, this allows for efficient distribution of resources.

What I think the US does wrong is not lubricate the transition between fiefdoms. Social safety nets lubricate transitions so that inefficient (poorly managed, badly conceived, etc) fiefdoms collapse quickly but the people who are involved aren't harmed and can smoothly transition into other ones of their choosing. That's the creative destruction of capitalism, optimized.

So from my view, it's not that the problem is how corporations are managed, it's that America won't invest in her ideals -- at a societal level. So of course they don't work.

Disclaimer: Work at publicly traded corp; views are mine, not employers.

> as an introvert

What you describe has nothing to do with being introverted.

You don't need an upperbound as long as your function is sufficiently slow growing.

Example:

Log(years) doesn't have a bound, but is unlikely to cause problems over any reasonable time scale.

These kind of waves do, but not all gravitational waves do. (You can think of the class these are as "normal", smooth waves.)

Sufficiently "foamy" ones should act like waves passing through material and cause interference based losses while sufficiently strange waves will travel faster than light, a la the hypothetical warp drive using negative mass.