HNHacker News
TopNewBestAskShowJobs

cakoose

1,103 karma · joined August 22, 2011

Work: https://anrok.com

[ my public key: https://keybase.io/cakoose; my proof: https://keybase.io/cakoose/sigs/gNz7dqjDBzs5anzP30jhCtr5bcogtlGjKLP2yghDN9I ]

submissionscomments
cakoose··on Storing Passwords in a Highly Parallelized World
I think the parent was assuming a lovely world where all passwords would be large randomly-generated strings. In that case, salting is no better than just increasing the size of the randomly-generated string, right?
cakoose··on American parenting is killing the American marriage (2014)
I couldn't quite follow. Are you disagreeing with anything OP said?
cakoose··on [dead]
Oh, that makes sense, haha. While reading it I was like "why is this journalist so blindly positive about this new system?"
cakoose··on Monoculture
"No one particular project should be considered a 'distributed social network'"

What? Something can be a distributed without being interoperable.

This article is humorously unbalanced. Sounds like someone venting. Even the counterpoint section is called "Perceived Advantages", haha.

Clearly, interoperability (or the lack thereof) can be taken to extremes; the hard part is finding the right balance. There's nothing in this article that helps with that.

cakoose··on 10M events a month, free
But isn't volume-based pricing a good approximation of cost-based pricing? With the new setup, are low-volume customers paying extra to subsidize high-volume customers?
cakoose··on Technology Is Magic, Just Ask the Washington Post
I can sympathize with the Washington Post.

There are two common uses for the word "impossible" that are relevant here. Solving the halting problem is impossible in the absolute sense. We have a proof.

But think about the (mind-blowing) discovery of asymmetric encryption. Before that, many things would have reasonably described using the word "impossible" in the sense of "nobody has any idea how to do that."

Do we have a proof that "golden key" thing is impossible in an absolute sense? If so, then it needs to be explained to non-technical people in a way that conveys that. If it's just that nobody knows how, then it's not actually impossible.

I think maybe people are interpreting the article as saying "if Google and Apple wanted to, they could do it this year" and of course that's incorrect. But I read it as them just lamenting that nobody even seems to be trying.

And I think their read on the lack of motivation is accurate. The people saying it's a bad idea from a technological perspective probably also think it's bad policy -- they wouldn't trust the government with a golden key even if it were possible.

So all the Washington Post can do is try and convince people that it's good policy. And it's fine to disagree with that, but it's unfair to call them stupid for thinking that there could possibly be a solution to the problem.

cakoose··on Streaming encryption protocol based on libsodium's box primitive
Any idea how it compares to CurveCP [http://curvecp.org/] and Noise [https://github.com/trevp/noise/wiki]?
cakoose··on Reproducible Builds in Go
> Your method doesn't follow the same format as the rest of Go's syntax (eg comma delimited lists) which could break any 3rd party pre-parsers or other such tooling. So there's the potential break backwards compatibility there.

The new slicing syntax could have broken 3rd party pre-parsers or other tooling. Yet that change was considered backwards-compatible.

cakoose··on Reproducible Builds in Go
But it looks like Go has done similar things in the past. For example, the slicing operation gained an additional optional argument (https://golang.org/doc/go1.2#three_index). It's not exactly the same thing, but it seems roughly in the same league of difficulty.

Based on what I'm reading, versioning is a serious pain point. Sure, you always have to make sure the payoff is worth the additional complexity (universally, not just in Go) but the author seems to categorically disqualify this option by incorrectly saying that it would break backwards compatibility.

cakoose··on Reproducible Builds in Go
On slide 9 it says that enhancing the syntax for "import" would be a backwards-incompatible syntax change. Sure, old compilers wouldn't accept newer code, but newer compilers would accept old code without breaking the behavior.

Is Go's definition of "backwards compatible" different from the usual one?

cakoose··on Amazon Business
It's not just the behind-the-scenes stuff that's ugly. Whatever they used to render the text is much worse than what my browser does. And there's no mouse hover changes. And you can't copy/paste the text. Following best practices would have gotten them a long tail of benefits for free.

Sure, the page gets the message across, but I think even non-technical people are at least subliminally aware of the fact that there's something low-quality going on.

If some smaller website did this it wouldn't be as surprising. It's just that this seems like an amateur mistake from a company that we all assumed to have competence in web design.

cakoose··on Learning Haskell – A Racket programmer's foray into the land of Haskell
Ugh, that didn't go as planned.

1. Sorry to everyone about the "his". Like most people guessed, I explicitly tried not to use gender, but I slipped up.

2. I didn't mean to imply you were bad at programming. The only goal of my comment was "if you're thinking about learning Haskell, don't be scared off by point-free style". I thought that providing more background would help people understand the temptation, but I should have divorced it more from your decision to use point-free style.

(What's funny is that these were things I was aware of and tried to handle well, but still managed to screw up.)

cakoose··on Learning Haskell – A Racket programmer's foray into the land of Haskell
The author spends a lot of effort trying to make his functions point-free. For example, the author first writes:

    inexactMatches xs ys = matches xs ys - exactMatches xs ys
then decides it's not very "nice", and ends up with this:

    inexactMatches = pure2 (-) <**> matches <**> exactMatches
I can sympathize with this preference. When I first started learning Haskell, figuring out how to make something point-free was extremely satisfying. And it also increases DRY, which is generally a good thing.

But over time I realized I was overusing point-free style. It was fun to write, but harder to read. If I were actually writing "inexactMatches" for something real, I would strongly prefer the first over the second. From what I've read, I think many people take a similar path when learning Haskell.

That said, I think everyone has a different threshold. For example, I've heard many people say that a for loop is more clear than something like "map" or "fold". I would disagree with that, but maybe that's just because I've gotten used to "map" and "fold".

So maybe the author's brain is just able to handle point-free style better than mine can, but I do think this particular example if far enough on the spectrum that most Haskell programmers would prefer the first version (for real code).

So if you're considering learning Haskell, don't be scared away. You will have to start getting used to point-free style, but probably not to this extreme.

cakoose··on The load-balanced capture effect
Reminds me of the differential gear in cars and what happens when one wheel is up in the air with no traction.
cakoose··on From Node.js to Go
Two things. First, I think it's more about the initial reaction to Go, from someone coming from Rust (or Java, C#, C++, etc).

But even so, I agree the wheels analogy is too extreme. I'd maybe say that it's like hearing that a car uses two motors instead of a differential -- "weird, I thought we solved that problem a while ago..."

cakoose··on Google App Engine Java security sandbox bypasses
I agree. It's a fun quote and has humor value, but it's the exact wrong stance to take when thinking about security.

Stupidity is one of the most commonly used disguises for malice.

cakoose··on Fossil – Simple, high-reliability, distributed software configuration management
Fossil's bug tracker is not just a separate system bundled with Fossil. The bug database is integrated with the VCS for a reason. Edits to the bug database are tracked, branched, and merged the same way source code is.

For example, let's say you create a branch to work on a new bug fix. In that branch, you make the fix to the source code, and modify the bug status to "fixed". When you merge your branch back into trunk, both the code fix and bug status get merged atomically.

It definitely is possible to create a bug tracker that did these things but was still separate from the VCS. I remember seeing some early-stage bug trackers that stored all bug data as files in the repository (instead of in a separate database) and could be made to work with multiple VCS backends easily. However, since VCSes weren't designed for this, it was sort of of clunky to use.

Ideally, there would be some interface between VCS and bug tracker to make sure they're decoupled but still work well together, but nobody has figured out that interface yet. Until someone does, it's much simpler for Fossil to ignore the coupling issue for now and focus instead on making the best product they can.

cakoose··on Please grow your buffers exponentially
Let's say you start with a small array, then add N elements, one by one. When you run out of space in your underlying, you allocate a newer array, copy all the elements over, then free the old array.

If your new array is always a constant size bigger than the old one, then the total amount of work you do is O(n^2). If your new array is a constant factor bigger than the old one, the total amount of work you do is O(n).

This is ignoring memory allocator costs, which can change things a bit.

cakoose··on Holy War on Sites That Demand Pinboard Passwords
OAuth is basically two decoupled things: the request authentication format and the app authorization flow.

Request authentication in OAuth 2 is typically done by adding the HTTP header "Authorization: Bearer <access-token>" to every request. Pinboard does something similar but different. Sure, it would be nice if everyone used the same format, but it's so easy to stick a token in an HTTP request that I don't care if Pinboard uses its own format.

The app authorization flow is how a 3rd-party app gets an access token. (It's when the 3rd-party site redirects the user's browser to a Pinboard app approval page, where the they can click "allow", which tells Pinboard to give an access token to the 3rd-party site.)

Right now Pinboard just has you copy/paste a fixed token, which is fine, too. I think having an app authorization flow would make for a slightly better user experience.

The hardest part is designing an app authorization flow that is secure. Most of us are just not capable of doing that, so it's much safer to just use OAuth 2. As a side benefit, you can use existing OAuth 2 libraries, which will save you time on the server and on each client.

Yeah, the OAuth 2 spec is not written well. I had to jump back and forth a bunch trying to figure out exactly what the spec wanted me to do. But overall I think the benefits of using OAuth 2 for your app authorization flow outweight the annoyances.

cakoose··on Policy – A fork of the Scala compiler
Paul Phillips' 2013 rant/talk: https://www.youtube.com/watch?v=TS1lpKBMkgg
cakoose··on How I Start: Go
You're example is not a static typing issue. It's a feature of the library that the struct field doesn't have to have the same name as the form field.

I think the issue is more of a DRY thing, which could maybe be fixed with something like:

    type User struct {
        FirstName string  `form:lowercase_hyphenated`
        LastName  string  `form:lowercase_hyphenated`
    }
This hypothetical syntax would instruct the library to look for the form fields "first-name" and "last-name".
cakoose··on FlatBuffers: a memory efficient serialization library
Deeper in the site they have a benchmarks page[1] that has a short "why not Cap'n Proto":

"Cap'n'Proto promises to reduce Protocol Buffers much like FlatBuffers does, though with a more complicated binary encoding and less flexibility (no optional fields to allow deprecating fields or serializing with missing fields for which defaults exist). It currently also isn't fully cross-platform portable (lack of VS support)."

[1] http://google.github.io/flatbuffers/md__benchmarks.html

cakoose··on RPC over AMQP
You can make it so that finding a free slot is always O(1). Keep another array that is a stack of available slot indexes. When you need a free slot, pop off an index and use that slot. When you're done with a slot, push its index on the stack.
cakoose··on Go is freakin' fast, I think
These are excessively detailed numbers with very little context. What is the code doing? What's the performance of the equivalent implementation in another language (I'd be most interested in a typed language like Java)?

I realize you probably have more context in your head but for everyone else the body of the post adds very little to the title.

cakoose··on Hello Chrome and Firefox, meet serverless WebRTC
It's not severless. Jerks.
cakoose··on Why do C++ folks make things so complicated?
I think he's taking a widely-accepted idea -- that the C++ language is a complicated language -- and making the unfounded leap that most C++ code is just as complicated.

For starters, the standard C++ string type is reference-counted, something that leans more toward convenience and simplicity than maximum performance. Well-designed C++ libraries that don't need to push the performance envelope are often pleasant to use.

Maybe the author wants things to be even simpler, but he's gotta provide examples. Or at least describe what his ideal Top C++ would consist of. That's the hard part. Simply saying "we should make a simple version of C++ that still lets you do low-level stuff when you want" seems vacuous.

cakoose··on Why Events Are A Bad Idea (for high-concurrency servers)
This paper uses cooperatively scheduled threads (i.e. no preemption or concurrent execution of threads), which means you don't have to deal with synchronization.
← PreviousPage 8 of 8