I have a deep suspicion this will inevitably lead to head-in-the-sand as a service.
2,320 karma · joined February 18, 2012
PRNGs are complicated, and sometimes we don’t find out flaws in them until long after they are widely deployed – although test suites like U01 Big Crush and PractRand should really help that situation out. Part of the problem is that some people just keep doing what they’ve always done and don’t want to see that the building is on fire.
I took a Computational Physics class in 2011 that was still advocating Mersenne Twister as state of the art, despite the widely publicised flaws and much better generators being around at the time. Others were fine with just using a Linear Congruential Generator with decent constants. We did have one class that encouraged us to plot RANDU and see the pattern, but I recall the resolution was to use an LCG with better constants.
I spent a while looking into PRNGs then, particularly the test suites available then. At the time, I think two approaches stood out as being fast and suitably random: xorshift plus weyl function (apparently now used in CUDA toolkit) and AES with reduced rounds.
Sometimes it’s important to recognise that there are possibly people still doing science with Linear Congruential Generators, and we can do a lot better even if a PRNG doesn’t pass every test. These test suites are designed to catch PRNGs out. It’s an adversarial situation, where better tests lead to better generators that lead to better tests – and it’s worth pointing out that some tests are so sensitive that they will give false positives by chance alone.
> So, for simulations where predictability etc is not a concern, what's the state of the art? And since I'm into microcontrollers, what's a decent choice when you only got a 8-bit CPU and very limited space (both code and memory)?
I don’t think this is going to be the same generator as used in MCMC experiments, but I would imagine a xorshift generator could be implemented in 8 bits with a bit of thought or research.
This is also what Larry Wall proposes:
> [...] Pattern Matching, generally having to do with what we call "regular expressions", which are only marginally related to real regular expressions. Nevertheless, the term has grown with the capabilities of our pattern matching engines, so I'm not going to try to fight linguistic necessity here. I will, however, generally call them "regexes" (or "regexen", when I'm in an Anglo-Saxon mood).
Demonstrating the power of a regex engine by solving a problem like this is interesting and very clever, but it’s hopefully not used in production.
> As we used a lot of unsafe hacks (disabling dependency and file conflict checking, for instance) to get this to actually work, I wouldn’t recommend using this system for anything other than proving it’s possible.
No, they would never do anything like that:
https://greenwald.substack.com/p/article-on-joe-and-hunter-b...
It seems to me there has been a decline in the quality of editing by major publishers in recent years – though it may be that I have become better at noticing prose that would benefit from editing. Self-published stuff is normally worse, but it’s no surprise: hiring an editor would turn many self-published books from a modest profit to a heavy loss.
The thing is that writing can be bad in a multitude of ways, and a good editor can fix at least one of those — and, at the very least, help ensure that the ideas on paper are written according to the norms and conventions of the language.
I always thought that’s an important part of what an editor does. I've edited, typeset and generally helped develop a couple of books for a friend who self-publishes fiction. I look out for stuff like continuity errors right down to seemingly petty ones, such as a TV being turned off twice. Maybe some readers wouldn’t notice, but I do.
I first read over to get a feel for the book, then I discuss any high-level improvements — little things like suggesting re-ordering chapters to maintain suspense. Sometimes it means breaking bad news gently, such as song lyrics in a work of fiction not falling under the doctrine of fair dealing[0] and licensing fees that make an editor look cheap.
In the self-published space, achieving 9th decile in terms of cover art, editing or typesetting doesn’t seem like much of a challenge. It’s really nice to see a draft become a finished product and be a part of that.
[0] Fair dealing is like fair use but in the UK.
The school was relatively new, having allegedly been built around 2003 because Asda (then owned by Walmart) wanted to move a supermarket from one side of the road to the other.
According to folklore the developers paid for the design from US architects who specialise in prison architecture – which was believable because it looked and felt much like a small prison.
In many contexts, curl | sh is an alternative to adding some kind of additional repository to install a third party package — and in most package managers this is done as root anyway, with arbitrary pre-install and post-install scripts.
I’m not really sold on how curl | sh (with https) is any less secure than blindly following steps to add a repo.
I used to strongly dislike curl | sh, and if there’s some looming security risk beyond accidentally trusting bad actors who couldn’t be bothered to go to all the effort of setting up a repo then I’d genuinely like to know.
> The creation of jack-o'-lanterns from turnips (rutabaga) was a Halloween custom in Ireland and parts of Great Britain. Irish immigrants brought this tradition with them to the United States, and adapted it to use native pumpkins instead of turnips. In time, pumpkins came to be used instead of turnips to create jack-o'-lanterns in Ireland and Great Britain. [0]
[0]: https://en.wikipedia.org/wiki/Pizza_effect#Ireland
EDIT: There’s also more information in the article Wikipedia cites [1]
[1]: https://www.irishtimes.com/life-and-style/food-and-drink/hal...
This is because lenses effectively do a Fourier transform at the focal point. With the right setup, you can apply filters at the focal point and get pretty much exactly what you would expect. An example of such a setup is the 4F Correlator. [0]
Fourier optics is a whole subfield within optics, and it really is rather fascinating.
Exposure to Fourier optics really helped develop my intuition around the Fourier transform.
[0] https://en.wikipedia.org/wiki/Fourier_optics#4F_Correlator
This is a problem that bricks and mortar stores are also faced with – especially when the box has been resealed in a way that makes it look like it was never opened.
One is the playful way that explores the problem domain. This does not feel so much like work.
The other can take on a monotonous job at high intensity for days on end, satisfied there is no better way.
For a long time, it was almost always that my free time was in the former and my work in the latter. This resulted in a lot of unfinished personal projects and a deep dissatisfaction with work.
My most productive work has definitely a blend of the two, and there is a skill in knowing when to switch between.
I think it’s more like this: Governments the US doesn’t like very much are 'illegitimate' because 'not liberal democracies'; regimes the US does like are 'important allies' or otherwise not talked about.
The whole 'not democratic' thing is more like a type of post-hoc justification for what, to many, looks like blatant imperialism. It would appear it is successful at least some of the time.
> Cormorant is an original design for an extravagant display serif typeface inspired by the Garamond heritage, hand-drawn and produced by Catharsis Fonts. While traditional Garamond cuts make for exquisite reading at book sizes, they appear clumpy and inelegant at larger sizes. The design goal of Cormorant was to distill the æsthetic essence of Garamond, unfetter it from the limitations of metal printing, and allow it to bloom into its natural refined form at high definition.
In the comments, the font’s creator states:
> As for a text version of Cormorant, that's basically covered by EB Garamond already... and if that's of interest of you, I am developing a sans version of Garamond for use as a text font. It's called Eau de Garamond already in quite usable shape. You can find it on GitHub.
None of this is to make anyone feel silly: Cormorant is a nice free typeface, albeit difficult to read at those sizes – there are tradeoffs made to make it look better at heading sizes. Knowing all that, I even considered typesetting a paperback in Cormorant Garamond, and I was surprisingly pleased with the results. I don’t remember what we ultimately chose, but Cormorant Garamond was a strong contender. The author did want the type quite large on that book, though, to the point where other Garamonds looked a bit 'sludgy' – what the Cormorant designer calls 'clumpy and inelegant'.
As for the article’s author, they did seem to notice the relative lightness of the typeface and adjust the weight to 500:
> The font used here is Cormorant. To make it look a bit better on screen the default weight was increased from 400 to 500.
This looks about right, comparing the google fonts pages [1,2]; however, Cormorant wasn’t really designed to work well at those sizes.
[0] https://www.behance.net/gallery/28579883/Cormorant-an-open-s...
The more interesting situation is when such "enhanced photos" are used in prosecutions. I suspect that ML "forensics" techniques and questionable expert witnesses will be used to elevate hunches to guilty verdicts and raise (false) conviction rates.
When I read the items that are listed for Facebook, they do seem to comfortably warrant that red.
Add the not-too-far-fetched-seeming assumption that it’s fine to let the Internet define your environment variables, and it’s a plausible exploit.
This is why, as another commenter points out, defense in depth is so important.
There are multiple failings that don’t seem like a big deal taken in isolation:
- The PYTHONWARNINGS and whole Warning Filters system.
- The webbrowser module executing a given executable from an environment variable.
- The antigravity module running webbrowser.open() on import.
All of these sort of seem a bit like sacrificing good taste for convenience. But in combination, in a situation where you don’t control the environment variables, they do lead to arbitrary code execution.
In other words, it’s not all antigravity’s fault, but those side effects on import make this possible.
What cause would there be to import antigravity in a CGI service – or anything other than a terminal in which you could already execute arbitrary code?
I am struggling to understand, even with the proof of concept, how the situation could arise where an attacker could realistically exploit this, based largely on the uselessness of the antigravity module.
Having worked with it over years, the API stability is there. Backwards compatibility is given very strong emphasis, , even with early versions.
> Maturity for languages other than C++ can be a bit spotty.
The language support is a pain at times, especially as the more esoteric language support tends to be built with a specific use case in mind and may not use and implement all the features of the protocol in sometimes undocumented ways.
People can and do write implementations and contribute to existing ones. The C++ and its Javascript and Python bindings work well enough for many use cases. The Rust ones are also fine. There are probably others that have good support now, too.
> The RPC protocol is cool, but apparently most of it was never implemented. The C++ implementation only implements “level 1.”
The RPC protocol is perfectly usable, just not for the higher levels – which all do things not found in other RPC systems. Level 2 can be trivially implemented between client and server at the app level, as anything similar would need to be in any other RPC system. Level 3 sounds way beyond standard RPC needs.
This results in cool things like promise pipelining. It is very interesting how it can simplify interface design, and there are examples on the RPC page[0].
> In the matter of reforming things, as distinct from deforming them, there is one plain and simple principle; a principle which will probably be called a paradox. There exists in such a case a certain institution or law; let us say, for the sake of simplicity, a fence or gate erected across a road. The more modern type of reformer goes gaily up to it and says, “I don’t see the use of this; let us clear it away.” To which the more intelligent type of reformer will do well to answer: “If you don’t see the use of it, I certainly won’t let you clear it away. Go away and think. Then, when you can come back and tell me that you do see the use of it, I may allow you to destroy it. [0]
[0] https://en.wikipedia.org/wiki/Wikipedia:Chesterton's_fence
> Sign-in on Android devices running Android 2.3.7 or lower will not be allowed starting September 27
IIRC they were getting the same emails, like they were on a list. They were a magnet for this, particularly as high-energy physics was in the news a lot.
The people who seemed to get it worst were the particle-physics phenomenology people.
I would imagine they start out funny, but could after several years get tiring.