Znafon

Yes, isVowel regardless of its implementation has all its input of fixed size, both the array and the one element to look for.

In that case, wouldn't any implementation be O(1) regardless of whether they use an array, linked list, hashtable, heap, stack, whatever?

Maybe we should only talk about properly defined algorithms whose inputs have been formally defined, but since we are talking complexity, I assumed something will grow.

It is either the array, or `char`. The set of vowels is finished for a given language but its size can change between languages and `char` will always be less than 256 (or some other fixed value).

Since isVowel is a closure it's not crazy to consider the array as part of the input.

You say "the only useful interpretation would be to consider this function O(1)" but it is possible to read this as an example and that n relates to the size of the array and in that case saying it is O(n) makes sense.

Since this is not a formal discussion of complexity and n has not been defined, I think it's fairer to interpret the post in a way where it makes sense .

I've never seen Landau's notation with two variables, I don't think it exists. At best you could say it is O(n)*O(1) which is formally equivalent to O(n).

This is pedantic, you are purposely using an unreasonable interpretation of "it's actually O(n)".

Any function taking just a char would be O(1) since it only has 256 values n can take, discussing their complexity would be meaningless making it obvious that someone talking about the complexity of includes() is talking about the size of the array.

The goal of computer science is to get insight about the performance of programs, not being pedantic and reduce the problem to the absurd that have an obvious answer, in this context the meaning of O(n) is perfectly clear.

Just have a form over HTTPS that store it somewhere in your Vault so that you can move it where appropriate later and add the instructions for power users that want to use PGP before sending it on the page.

It will be convenient and secure for everybody, and users wanting an extra level of security can use PGP.

None of the voters had their vote counted to another candidate here but the result is wrong.

This voting scheme is just broken.

It doesn't work: let's take 4 people and they vote for two choices "1" or "2".

I cheat when I give people their random numbers: A gets 5, B gets 5, C gets 7, D gets 11.

Now they all cast their vote: A -> 1 B -> 1 C -> 2 D -> 2

Let's tally the votes, the result for choice 1 is 5 and the result for choice 2 is 77.

A checks that its vote has been counted 5%5 == 0 so it's good. B checks that its vote has been counted 5%5 == 0 so it's good. C checks that its vote has been counted 77%7 == 0 so it's good. D checks that its vote has been counted 77%11 == 0 so it's good.

For everybody the result appears to be one vote for choice 1, 2 votes for choice 2 and 1 abstention, your scheme does not detect any wrongdoing here.

What is a unique, random, sequential prime and how do you actually vote?

> Computing intensive, no. Code that is doing a CPU intensive computation but makes no system calls will never release the GIL.

Any code that does not involve Python objects can release the GIL, no matter whether it makes system call or not.

For example, NumPy the most popular scientific computation package in Python, on which many other popular packages like Pandas are based, releases the GIL when doing operation on matrix. This is documented at https://numpy.org/doc/stable/reference/internals.code-explan...:

> If NPY_ALLOW_THREADS is defined during compilation, then as long as no object arrays are involved, the Python Global Interpreter Lock (GIL) is released prior to calling the loops. It is re-acquired if necessary to handle error conditions.

To do so it uses the same macro used by the socket module when doing system calls: https://github.com/numpy/numpy/blob/18a6e3e505ee416ddfc617f3...

The first one is not really ambiguous: if you work at a hedge fund and received satellite images from your employer trading using this information is insider trading because you were supposed to do your job and do it for your employer. If you are a day trader and bought the images yourself it's ok.

I agree that the second one seems ambiguous and could certainly result in a lawsuit in the shareholders are unhappy.

I don't think the third one is insider trading, the banker had a duty to keep this information confidential, not you and you did not colluded. This looks a bit like the loan to Kodak that got leaked in the press because they had forgot to embargoed it. While it certainly not good looking for employees of the company to trade on this information, what could possibly reproached to outsiders once this news is all over the Internet? Even after the initial tweet had been removed, the news was out their.

> doing that means the GIL doesn't get released so that thread will prevent any further network I/O while it's running, the same as would happen in an async framework if a worker did a lot of CPU work. So Python doesn't really let you realize the advantages of threads in this context.

I don't think that's true, the GIL get released for many computing intensive or IO bound tasks in Python, for example when reading from a socket the GIL gets released at https://github.com/python/cpython/blob/e822e37946f27c09953bb...

You are correct, async will only help for long-running network calls, which happens when calling another service or querying a database.

When doing a long computation the CPU is not idle so there is no free compute power to use for something else.

Finally, when doing IO calls in Python so GIL is usually released so the kernel can already schedule another thread while waiting for IO, so it is not sure that converting to async will yield improvement and should be benchmarked if you plan on converting an existing program.

You can do recursion in YAML, and it ends badly: https://en.wikipedia.org/wiki/Billion_laughs_attack#Variatio...

This is a very sensible approach. One pro of having the checks automated instead of just having the developers check carefully their changes is that onboarding a new developer is easier, you will spend less time on very small and specific details and you won't forget to tell some detail.

> I suppose guaranteed completion matters if you are running untrusted code, but wouldn't sandboxing solve that? Are there any other guarantees that sandboxing wouldn't solve?

There is more benefits than just that, by restricting the possibilities you know there won't be unbounded loops, analysis and code review is easier (and infrastructure teams are often seriously lagging in this regard), it can be easier to maintain, update and test.

In some cases, you can have a project where this is seriously limiting though because you have some very complex and specific thing you need to express. For this you can use CDK. I would say both approach are complementary, not exclusive.

In my experience I would say nearly all infrastructure projects can be expressed as Terraform rather easily, but YMMV.

> Why are so few configuration languages not backed by a real language?

In many cases, not having a full featured language is helpful as you have some additional guarantees that comes with a non Turing complete language like guaranteed completion.

In some cases though, you do need a full pledged programming language. For those cases, HashiCorp recently announced CDK support for Terraform: https://www.hashicorp.com/blog/cdk-for-terraform-enabling-py...

You would still have to do it with reproducible builds. It's only reproducible if you have the same code. If you change something there is no reasons to get the same result, a bit like you would expect with a hash, it is deterministic, but that's all.

SEEKING WORK Location: Remote or Paris, France

I'm a senior Python developer and DevOps with experience building higly available infrastructure, Python web application or machine learning project.

I'm an Open-Source contributor, work with HashiCorp to maintain https://github.com/terraform-providers/terraform-provider-co..., and contribute code and review PRs for the Python language.

I'm available for work in Paris and have experience working with remote teams.

Technologies: Terraform, Consul, Nomad, Vault, AWS, Python, Django, Flask, PostgreSQL, Redis, Numpy, Pandas.

Email: remi@lenstra.fr

The discrete logarithm is the inverse operation of exponentiation and modulo. Being able to find a discrete logarithm quickly would break RSA.

I'm sorry you had to go through this.

I'm not offended, I'm pointing out how the situation differs.

If doctors gives inaccurate information, it's an important problem that needs to be discussed.

> the doctors said his treatment was curative not palliative

In the present case, it seems like it was not the case: "At the time, Sean’s doctors told him he had at least a 50% chance of long-term survival if he underwent chemotherapy", while the alternative medicines gave false information: "Sean also relied on "thermographic scans" - heat images of the body" or "I’d use words like, 'oh no it’s the Herxheimer’s reaction'".

It seems to me like we are preaching for the same thing, which is to give the correct information to the patient and let him decide.

> What's the point of getting more months of life, if you can't do anything?

I sympathise with the way you feel, but here he did not refused treatment to better live the time he had left but chose "alternative medicines" instead. The discourse in those online communities is not that you should appreciate the time you have left but that they can heal you.

Those are two very different situations and while the outcome is sadly identical, they should not be conflated.

I think only tags should be signed, Torvalds has a good discussion about signing commits vs signing tags at http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-t...

They have a useful list of feature that you can look at: https://www.algolia.com/products/search/

It's basically a service that you can use so users can search objects in your database, a bit like Google but just for your website or application.

If you MITM and the user agent send an HTTP request for ec2.shop it does not matter whether the webserver supports HTTP or not, you can send a fake HTTP response either way.

> For many applications "slow" logouts are enough

Why? I understand it might be acceptable for the next "Uber for Cats" SaaS but if you protect an account that is actually important, not being able to revoke an access key is an issue.

> Keep validity of access tokens short.

But then you are actually spamming your authentication service and it even starts to blur the distinction between access token and refresh token.

I understand that there is many specific use cases where JWT makes sense like when you have to delegate authentication but for other case which shouldn't be recommending it, not being able to properly logout is not a security practice we should have in 2020 and later.

At least those are well known, no common web framework will save password in clear text, and there is comprehensive literature on how to use SQL and many well written ORMs that will make it very hard to shoot yourself in the foot.

For JWT, it's essentially promises of easy authentication process (rarely talking about the hard things like logout) spread like landmines over Medium and blogs, waiting to blow your foot and all your application with it.

Regarding 1, I don't think you need Enterprise to have HA, I'm pretty sure it comes with Vault OSS. You may be thinking about Vault Disaster Recovery which makes one cluster fail to another one, but HA is in OSS.

Don't DoH and DoT protect against this by having a chain of trust up to the root servers?

This is wrong for multiple reasons: they can check whether the password is offensive before hashing it and they wouldn't need your password to access your account anyway.

The first commit is from Oct 7 2015.

This would not solve the issue when the email is sent to a mailing list.