HNHacker News
TopNewBestAskShowJobs

eftychis

1,709 karma · joined March 25, 2016

Cryptographer, Software Engineer, Security Researcher

Contact at crypto@eftychis.org.

submissionscomments
eftychis··on You are never taught how to build quality software
As sibling comment `@wellpast` commented, but to extend it with my point of view.

We can roughly say we can have three out of: (high) quality, (low) time, (low) communication complexity, and (low) money. (time is a dependent here.)

People are trying to apply factory processes and structures to a team sport, an engineering discipline. You do not teach or build a basketball team by breaking down each attack phase into steps and checkmarks.

You try to minimize communication and make the team work as one. It is a team and individual building, not a process building exercise. You make a plan, and follow the Moltke's the Elder conclusion:

"no plan of operations extends with any certainty beyond the first contact with the main hostile force."

(Or paraphrased as you have heard: No plan survives contact with the enemy.)

All (types of) Engineers know this. But software engineering is "special." And it is not a "move fast and break things issue." That is part of all engineering or team playing too.

It is the type of business mentality, that because a plan did not go exactly as expected we need to add more process. Whatever that process may be. Because if "I as a manager add a process, then the next failed plan, I am covered, and I will blame the individuals."

Process has a place to ensure things happen in a legal and moral framework. And minimize adverse circumstances -- e.g. we bet all the hedge fund money accidentally when running tests.

Process is used differently in most startups and corporations with not the team in mind.

eftychis··on A study of Google's code review tooling (Critique)
You can do that in Github, but for some reason a lot of reviewers are not familiar or bother doing that. Fixing nits that way or giving a suggestion improves turnaround speed greatly and builds a relationship between reviewer and proposer and the final product/commit(s).
eftychis··on Hacking Google Bard – From Prompt Injection to Data Exfiltration
The question is not why this data exfiltration works.

But why do we think giving a random token sampler, we dug out through the haystack, special access rights, which seems to work most of the time, would always work?

eftychis··on Appeals court denies judicial immunity to judge who personally searched home
Why barefoot exactly? Something is missing here. When you execute a search it is not like you go around removing shoes. Then again usually that search and seizure is legal and not executed by the "judge..."
eftychis··on Rob Pike’s Rules of Programming (1989)
Are these quotes the reason we end up with bloated rarely optimized or respectful for memory, CPU, or other resources software systems nowadays?

https://www.techradar.com/news/move-over-chrome-macos-monter...

https://www.tomsguide.com/news/google-chrome-reportedly-dest...

A great majority using these quotes act like no engineering design work is allowed whatsoever.

I have seen that mentality permeate everything even hitting concurrency decisions for obvious things. (E.g. We need to respond to HTTP requests while doing stuff in the background, and accessing IO and run multiple server state syncing but let us have purely synchronous, single threaded code and we will figure it all out later. That went well.)

And for some reason there is a subgroup that thinks security architecture is "optimizations."

It depends on the product but when you have https://news.ycombinator.com/item?id=38029479 or https://news.ycombinator.com/item?id=38076636 it is not over-engineering: it is management and business forcing poor product.

eftychis··on Facing 110 years in prison, Sam Bankman-Fried "can't recall" what he did at FTX
What was the strategy for him testifying?
eftychis··on I accidentally saved my company half a million dollars
No good deed goes unpunished.

A part of me finds I might know you. Another part states: this story is way too common.

eftychis··on Google Brain founder says big tech is lying about AI danger
Nukes are not cheap. It is cheaper to firebomb. I would love if the reason nukes were not used was that of empathy or humanitarian. It is strictly money, optics, psychological and practicality.

You don't want your troops to have to deal with the results of a nuked area. You want to use the psychological terror to dissuade someone to invade you, while you are invading them or others. See Russia's take.

Or you are a regime and want to stay in power. Having them keeps you in power; using them or crossing the suggestion to use them line will cause international retaliation and your removal. (See Iraq.)

eftychis··on Early Europeans ate seaweed for thousands of years
And still do? It is still eaten in the Mediterranean. (e.g. salad.)

Is the article supposed to be surprising or just keeping us updated on the oldest findings? It seems it thinks the former.

eftychis··on Three Arrows Capital co-founder Zhu arrested in Singapore airport
Thank you for the clarification follow-up.
eftychis··on Three Arrows Capital co-founder Zhu arrested in Singapore airport
History of economics disagrees with the last -- hopeful I will assume -- statement. The world was and is full of scammers and fraudsters.

Also respectfully I am not sure I get the zero interest rates arguments. There seems to be a subgroup of HN community that believes low interest rates (below some arbitrary threshold?) to be immoral. Maybe there is a Crime, scams and ponzi schemes correlation study over hundreds of years I am unaware of? Japan is keeping negative rates and they are not known for that, to give the country everyone knows counterexample.

Besides that the main borrowers are countries themselves. And with US, Europe and China paths right now, amidst a global war tension, something will have to give long term to make ends meet. Usually it is currency devaluation and a fundamental systemic change.

eftychis··on Removing garbage collection from the Rust language (2013)
I (also like sibling comments) respectfully disagree.

Rust is aimed and focused as a safe C or a sane C++ substitute, and is meant to intermingle with both. It is not an application "high" level language. You can use it as such, which is great. For anything you would use C or C++ you can use Rust instead. As a cryptographer I find that great.

Regardless of all the lack of latency or other control -- beyond fine tuning -- a garbage collected language makes critical memory choices we want to make instead. There are times we want to swap or use our own memory allocator, never mind having to add a garbage collector in the mix. (There is a good number of languages that scratch that itch, and you can likely link and use your C/Rust code with them.)

As far as async: also respectfully disagree. Async is sugar for here is a Future<..>. If you want to poll it locally you can. You can scope it also. If you want to use a cross thread work stealing algorithm you can. But you need like memory management to consciously make these design decisions. This is similarly why a lot of things are not built in in C.

eftychis··on Doctor GPT: A Large Language Model That Can Pass the US Medical Licensing Exam
Not legal advice. You almost certainly need legal advice on this topic.

> DoctorGPT is a Large Language Model that can pass the US Medical Licensing Exam. This is an open-source project with a mission to provide everyone their own private doctor

I can think of the top of my head a number of issues, depending on which country or state you are in. If you are in California U.S.A. for example... Given that this references USMLE (U.S. Medical License Exam) Regardless, a AS IS warranty is in order and HUGE banner that this is not meant to be a doctor in any way shape or form. Which you kind of claim it is. And that is a problem.

[And change the name to not state in any way doctor in there. ]

eftychis··on California allows robo-taxis to expand and emergency responders aren't happy
Impounding is what they would do for regular joe's car. So why not for these "full" self driving ones?

Is someone simply telling them to be "lenient?" First responders already deal with a lot of bullshit. Especially in San Francisco and Lo Angeles right now. Adding more to the least is peachy...

eftychis··on US offices are sitting empty – business owners will have to adapt
Well the space is not limited anymore, as the commenters suggest. The natural progression is for rents to go lower.

The problem is that would mean that the valuation of the real estate would need to change, which would imply debt repayment, and given higher interest rates: default or finance under onerous terms or being cash rich already.

At the end (as the Fed expects): defaults => lower real estate value ^ rents => cheaper food options.

And that is where usually executive is going to come in to save Government Supported Real Estate (GSE), and throw a wrench to Feds approach.

tl;dr: the government supports this situation it will come to make it worse once again /s.

eftychis··on Why is DNS still hard to learn?
tl;dr: suggestion: DNS is really hard to unlearn.

I do not agree with the implied sentiment of the article. And thus with some of the comments (from "both" sides) of the arguments presented here in the comments.

Hard is not defined, but is implied to be "harder than you believe it is."

That is a general characteristic of perhaps most topics worth pursuing in our field: computer science/engineering. (Defining it in this closed field space on purpose for brevity.) And especially in distributed systems, which DNS in some way falls under.

Further you have business interests, which have affected and will affect DNS -- we like it or not. And have added on top of it.

A number of individuals then use hard as "it is intractable" [to learn].

Is DNS harder to learn than BGP routing: I think not.

Does one need to spend a decade focusing on using and debugging DNS. I would argue not.

Does one need more time to dive into BGP than DNS to do state of the art work: I would argue yes.

DNS is simply not the hard and hot scientific problem people go around tackling from a research perspective.

It is a federated business (and political perhaps) problem at this point.

I do agree there is a lot of caching involved, which creates a ton of coherence and invalidation issues. That does not make the topic hard, it makes DNS problematic. (The other word I would use, and that I think Ms. Evans [the author] implies perhaps.) I agree totally with that.

I also think it is a point of approach the learning path to it for the average scientist here. A lot of people are introduced to DNS (or email to that extend) as: here is the sketch idea, we make sure it works, trusts us, and there is this single deified entity that makes sure it works, and it is not patched with other branches "constantly." All of the aforementioned sentence of course is a lie. But a lot of engineers learn that. (I was lucky to not have that introduction.) And then it comes time to debug a DNS issue -- when they actually realize it is a DNS issue.

So I would recommend a revised blog title to: DNS is really hard to unlearn.

eftychis··on Big Tobacco knew radioactive Po210 in cigarettes posed cancer risk, kept quiet
Agreed. Of course it is not easy. It is a job. But it is worth it.
eftychis··on Big Tobacco knew radioactive Po210 in cigarettes posed cancer risk, kept quiet
The rich: that is why (one of the whys) their votes matter.
eftychis··on Big Tobacco knew radioactive Po210 in cigarettes posed cancer risk, kept quiet
Maybe, say maybe let us get forward some legislation, adding criminal liability to the executives ignoring such things, explicitly.

Because if Purdue taught anything to the U.S. is that their voters do not care. We should prove them wrong I suggest. (Related to the events.)

If you think your vote doesn't count: congratulations, the entities you complain about convinced you wrong, and are doing their job. Demonstrate, create groups and demand things from your representative, pick someone from the group you have to run against your representative. There is no democracy otherwise. Time we start caring.

These might be called rights on each constitution, but that is a misnomer: they are jobs each citizen needs to do. Sorry, but that is the truth in the end.

Disclaimer: Above message is for the residents of every democratic country.

eftychis··on Why don't we get our drinking water by taking salt out seawater? (2008)
Fun fact: A good number of Greek islands end up using desalination.

E.g. https://www.nationalgeographic.com/science/article/partner-c....

And this is not by choice: Greece has to deal with extreme volatility in resource consumption throughout the year. Add to that it has ~6000 islands (around 200 being inhabited year round -- 227 as I google). And the tourist island/islet focus changes throughout the years. With this context, there can be no "I will create a pipeline of fresh water" or any other project like that really.

eftychis··on An annual physical exam costs $400 USD on average in the USA
Annual physical in the U.S. is one's chance to get a "relatively free" doctor visit for an issue they have.

The conclusion that if you are healthy there is a higher chance to have a false positive is misleading.

a) that is true by definition: they have asserted the patients are healthy already; b) statement assumes that in the U.S. people go to the doctor at the same rate as they go in other countries; and thus have a chance to test themselves / do checkups necessary to their particular family/individual risk profile;

So drawing the directive that annual physicals are to be discarded is hypocritical. And to be substituted with "questionnaires" is .. [well I don't really have words.] They are stretching for a conclusion to remove the ~free annual requirement.

(cc from your linked blog study/recommendation): > Second, they acknowledge that if the annual visit is to be discarded, primary care doctors will need to find a more proactive way to monitor their patients' attention to preventive care. They suggest that waiting for patients to keep their annual visits to review this is too "passive" an approach, and encourage practices to shift to "active engagement" of their patients. Ways to do this might include: online risk assessments, waiting-room questionnaires, and a review of preventive care at any visit to the doctor.

eftychis··on An annual physical exam costs $400 USD on average in the USA
That is [an] incorrect conclusion to make.

In other developed (or even developing) countries, going to a doctor if you feel anything is not a financial question. You just go. Also annual bloodwork -- without needing to even do a doctor visit -- is sometimes a thing.

You can go to the specialist you think you need. Got a heart/chest issue: you go to the specialist and do not worry if it is covered or how to pay them.

Disclaimer: lived/live for years in both Europe and U.S. I also have a glimpse of how the japanese system works and South America a bit too. These things are not comparable. You would think North Americas are a different "world far far away."

tl;dr: I find the average in the U.S. surprising. Then I look at the median life expectancy.

eftychis··on Refusing to teach kids math will not improve equity
To be fair to the above poster: probability and statistics definitely does need calculus and other math beyond an introductory level. And you see that gap when you read social sciences work applying statistics and making rudimentary, and requiring insight otherwise, mistakes.

Beyond introductory level both probability and statistics have a lot of "counterintuitive" pre-probability and statistics results, that also explain a lot of the misconceptions the public faces in not understanding the notions.

Probability and statistics are topics that our democracies would be better of if people understood them: then they would understand perhaps topics like polling, and we wouldn't perhaps have misuse of the topics in Court like Sally Clark's case: https://en.wikipedia.org/wiki/Sally_Clark

[But I guess we would have to drop lotteries as a taxation system also. [/s]]

eftychis··on Refusing to teach kids math will not improve equity
Essentially what I am saying is suppose the politicians' reasoning, that @currymj suspects and offered above, and I agree with them is the likely one, was to be true.

Then the word calculus (and university admission perhaps with other goals in life) can be treated as variable(s). There is no inherent reason the set of deduction rules are dependent on the choice of topic. Let us denote the reasoning for brevity as a proposition p(s, g) with s\in Subjects g \in Goals:

Start substituting other subjects in there. Their reasoning goes that for an s \in Subjects to be in AcceptedSubjects \subset Subjects it must hold that:

p(s,g):=\(For the majority of students), \exists g \in Goals: p'(s,g). Where p(s,g) relaxes also the goal here -- doesn't have to be college admissions. Then start adding art, debates, writing and other topics I mentioned.

eftychis··on Refusing to teach kids math will not improve equity
Yes which makes other contemporary politics topics (cf. Puerto Rico statehood as a lighter one) more enlightening.
eftychis··on Refusing to teach kids math will not improve equity
Certainly, good point: 2003 UCLA LAW Review: https://www.uclalawreview.org/wp-content/uploads/2019/09/15_...

See first paragraph section C, page 11 (293) -- also citation, but didn't have time to link it here.

eftychis··on Refusing to teach kids math will not improve equity
To give a bit of context to all the sibling comments:

We are talking about a history where: a) A decision to not occupy a defeated country was made because they were impure/non-white (Mexico)... [I don't think I have encountered a similar historical example. I will spend some time looking/reviewing just in case I am forgetting some similar situation.] b) Called Germans and Finnish immigrants "non-white":

https://en.wikipedia.org/wiki/Definitions_of_whiteness_in_th....

Italians and Greeks faced the same treatment. Everything and everyone had to be assigned at some class/color. The wikipedia article goes even more in depth about the issue that also posed for Asians in the U.S. which is a whole lot different rabbit hole, and which I am still confused about.

c) Gun control and argumentation started because of racism. NRA actually did support gun control at one point: when the Black Panthers tried to exercise their right to bear arms. And when Reagan introduced the Mulford Act in response, evidence shows it was enforced based on race.

https://www.history.com/news/black-panthers-gun-control-nra-...

https://www.mintpressnews.com/the-mulford-act-and-americas-r...

And going way back: Black Codes were a big part of Jim Crow measure: everyone could have a gun; unless you were "black." (Or other undesirable.)

And to place the final nail: https://www.npr.org/2021/06/02/1002107670/historian-uncovers...

There is the claim that the 2nd amendment was enacted to ensure slaves wouldn't revolt. Not sure yet how much weight one should place to that claim; but the world history supports such considerations. [Review cf. Spartans for instance or the Japanese class system.]

eftychis··on Refusing to teach kids math will not improve equity
Good point with a little nit.

Usually in data science, you "mine" for features or combination of features. That is you collect as much as possible, then actual find the critical features e.g. to construct a random forest/decision tree/ ...

Here they are going as you point out the other way. And the more I study U.S. history (and politics) the more racist I find it.

eftychis··on Refusing to teach kids math will not improve equity
With that kind of thinking though we can reach logical results like:

- writing prose and composition is unnecessary, as at best one will write on slack and social media;

- doing pushups, calisthenics, or running is unnecessary: few jobs require that;

- learning about how the government works, civics or sociology or psychology should be skipped: all these are taken care by the employer that is not going to let you go vote anyways (still don't understand how/why it is not a mandatory holiday, but what do I know);

- debates should be banned: promotes arguing against cops and employers both having detrimental outcomes;

- art is for the rich and private schools: poor populous should not be dreaming;

I suggest -- my 2 humble cents -- the writers of this abomination take a class in logic. Unfortunately, that is math and requires fundamentals they don't want covered.

P.S. My grad school anecdote: our perception and experiences as "international" grad students of the math understanding of incoming undergrads was abysmal to put it lightly. I don't want to be in any future TA shoes.

eftychis··on The FBI has formed a national database to track swatting incidents
In Greece it is 3 years of studies to become a patrol police officer. To be a ranking officer it is 4 years and counts as a bachelor. There is also a 2 year special force which supposedly catches up to the same standard, that's a different discussion.

And all that to get on the street without a gun. To get a gun you need another half to one year of on the street training.

But the problem is the gun ho culture. Here are some on the news examples.

a) there is an armed robbery with an ak-47: US go in and start a gun fight, EU/Greece: tell everyone to let the robbers go and note the license plate, catching them a few hours later with no shots fired;

b) person wants to commit suicide by cop, everyone else has left the building: U.S. cops rush in blind, get shot and kill the guy; Greece: there is nothing really equivalent, cops just try to get a psychologist and stay away;

And if the cops shoot someone the public disagrees with, expect weeks of lynching and rioting.

c) mental I'll person with a gun: U.S.: full escalation and long gunfight; Greece: in front of the parliament: chat de-escalation no shot fired by anyone.

Comments are yours.

P.S. (And gun ownership has nothing to do with it. Where I am from there is practically WWII weaponry -- minus the tanks -- everywhere. People learn to shoot really young and keep it up.)

← PreviousPage 3 of 20Next →