g_sch

Speak for yourself. At least 80% of my messages run over Signal these days. And I communicate with a wide variety of people, not just techies.

I think a major contributor to this was that Signal got normalized early as the venue for a large group chat started by some friends who moved to my neighborhood years ago. Over time this chat became a sort of neighborhood forum where people advertised open rooms, traded goods and services, and exchanged news and gossip. And because it was on Signal, everyone installed Signal.

I know I'm in somewhat of a strange bubble, but I just want to underscore that this kind of world is possible. The adoption fight hasn't been lost yet, especially since some cracks are starting to show in the incumbents' moats these days.

I suppose it does function as an engagement hack, but I like ephemeral messaging like this because it is low-stakes and I often don't care strongly whether any individual sees my post or not. If I did care, I'd simply send them a message directly! So at least in this sense, the short timeframe is a feature that defines the medium for me.

Of course, you could allow customization of the time interval, but that adds another layer of complexity, and other platforms that use stories have already pretty much standardized on a timeframe of 24h, so it's easier for platform newcomers to understand.

Seems unlikely, given that this story was told from the perspective of someone mining in the pre-ASIC era. I suppose they could have invested in ASICs early on, but they started as a broke student and the reason the story is fun is because they made it work on a shoestring. "And then I bought $200,000 worth of ASICs in an overseas datacenter" doesn't have the same effect.

What kind of technical analysis would you be looking for? Reading the post, it seems like their analysis came down to (1) fundamental values, i.e. not including insecure communications within an app when they've built their brand around being secure, and (2) UX confusion resulting in additional SMS costs and/or inadvertent data leakage. The former is a straightforward question of product strategy. Are you looking for e.g. some numbers from their UX research? This doesn't seem to ultimately be a decision about underlying technology.

Exactly. Unions fundamentally exist in order to prevent owners and investors from harvesting all the profits (and from pushing off the consequences of losses to the workers alone). If companies were equally owned and operated by their workers, unions wouldn't have a purpose for existing.

You've piqued my curiosity - what happens when you drain your pool in Houston?

Watching the video, they mention that in order for the red team to reach their goal (downloading Google Glass schematics), they had to pivot from the users they compromised with the plasma globe (who were not working on the Glass project) to users on the Glass team. They seemingly did that using an image attached to an email that executed its payload when the email was opened. They didn't elaborate what the payload did, but mentioned that it "captured the user's fingerprint" and enabled them to use that to access the Glass schematics.

Although it sounds much less exciting, this sounds like a much more serious exploit than a compromised USB plasma globe - embedded in an image and requiring minimal user interaction to execute. I wonder whether they identified a novel 0day in a common image parser or something.

My reading of the post is that they determined the "1,900 users" figure by the number of users who had requested a code during the duration of the Twilio incident, as the attacker could have accessed their SMS messages at any point during the compromise:

> During the window when an attacker had access to Twilio’s customer support systems it was possible for them to attempt to register the phone numbers they accessed to another device using the SMS verification code. The attacker no longer has this access, and the attack has been shut down by Twilio.

This info gives us an interesting opportunity to estimate the rate at which Signal is adding new users. They've been very tight-lipped (understandably) about their usage stats but anecdotally they seem to be an increasingly common presence on my friends' phones, even the non-techies.

As far as I can tell, Signal uses Twilio only to send SMS for phone number verification. Verification happens when a user registers a new number or changes the number on their existing account.

The rate at which Signal is adding new users could be calculated by:

1900 * (proportion of new registrants among SMS recipients) / (length of Twilio incident)

You could probably make some common-sense assumptions about the first variable. But I can't find any publicly available info on when Twilio was first compromised. Their press release only mentions that they discovered the intrusion on August 4, which is presumably close to the end date of the incident. Does anyone know what the estimated start of the incident might be?

It comes up in the news precisely because it's such an unusual occurrence. Lawfare by attrition is an extremely common tactic. Having more resources than your opponent can massively tilt the scales in your favor.

Is pumped hydro really able to scale to a significant level where it can provide enough energy storage for a national (or even state/regional) grid? I was always under the impression that pumped hydro was indeed awesome, very cost-effective, etc. but could only be developed in places with very specific geographies. After all, you have to somehow place two reservoirs near each other with a significant elevation difference. Isn't this the limit that governs pumped hydro as a storage technology?

I think this is good advice but it also shows why using TOTP as a default 2FA mechanism (instead of SMS) is a tough sell. How many people are set up to store a TOTP seed in a location other than their authenticator app? How many people even know what a TOTP seed is? I would wager that the vast majority of non-HN readers think of TOTP as a QR code that you scan into an authenticator app, if they are even familiar with authenticator apps.

SMS, for all its security shortcomings, is at least something that the vast majority of people understand already.

That's an interesting choice of analogy. Just a few weeks ago there was a popular submission here reporting how 90% of nurses are considering leaving their profession in the next year due to burnout and poor working conditions [0]. It's true that doctors receive more training, but without nurses (hell, even with any fewer nurses than we have now) our health system would completely collapse.

[0] https://news.ycombinator.com/item?id=31180646

What is it about Mars that would cause those same problems to collapse into mere engineering problems over there?

Aren't you just suggesting a very simple CAPTCHA challenge? This is an area that has seen an arms race for over a decade of platforms coming up with increasingly complex "human-intelligence" challenges, and botmasters coming up with increasingly ingenious ways to bypass them (including, sometimes, using real human intelligence)

It never ceases to amaze me how many people consider some problems here on earth to be hopelessly intractable, but simultaneously consider a livable human colony on Mars to be not only achievable, but also not subject to the same supposedly intractable problems of today.

I can't buy this. He very clearly seems to relish public attention for its own sake. Otherwise we'd have to accept that his hyping of random crypto tokens (e.g. DOGE) is somehow indirectly connected to saving the world or advancing humanity.

I'm having a little trouble understanding the motivation for this move. Did Bandcamp have a poor revenue/profit outlook and were they looking to scale? Was this just an exit for founders? I was under the impression that they had a relatively stable and profitable business, and strongly valued their branding and positioning as independent.

I always figured this was a performance issue related to sharding in distributed systems. Deep pagination is an expensive operation so most search clusters limit the number of visible results by default. That, in addition to an assumption that results beyond a certain number are unlikely to be useful - how many times have you found something on page 10 vs just reformulated your search query? - means that most applications just leave the default limit in place.

Returning a count of results, however (especially if it doesn't need to be precise), is a lot less expensive. Hence why Google is happy to give you the 22,000,000 number.

It's weird to see this article reference the Justin Keller open letter and pretend that its intended purpose was to call attention to the problem of unhoused people with mental health issues in SF. As if his "heretical" act that attracted public anger was to point out an obvious injustice.

The actual text of the letter[0] argued that people who can't afford homes or who have mental health issues _don't deserve to live in the Bay Area_, and that he _does_ deserve it, because he has money. This is literally spelled out in his letter, not obliquely implied. It's this part of his opinion that got him in public hot water.

[0] https://justink.svbtle.com/open-letter-to-mayor-ed-lee-and-g...

Perhaps surprisingly, whether picket lines are lawful is often a matter of legal contention when there's a strike. Company owners argue that they are obstructive (which is at least partially the point), and courts often grant injunctions or restraining orders placing limits on the size, location, or even existence of picket lines.

A coal company in Alabama recently won a restraining order that fully prohibited a picket line at their mine: https://www.msn.com/en-us/news/us/judge-issues-restraining-o...

The way the article cites "The Tyranny of Structurelessness" is slightly off base. The essay argues that lack of structure is not an effective way to dismantle hierarchies, because it merely masks them instead of dismantling them. It does not go as far to claim that hierarchies and power structures are inevitable (although many people citing it claim that it's making this argument).

Although I guess you could argue that the text itself is less important than the impression it made on people who read it...

Anecdotally I've noticed that nearly all progress bars on major apps/sites are fake these days. Instagram and Facebook also have "progress indicators" (usually used for uploads) that just show asymptotic progress regardless of whether anything is happening.

I know it's a minor issue because rendering an accurate progress bar is a hard problem, but in my view this is just another example of how behavioralism leads to a generalized erosion of trust in the interfaces and technologies people use. It may be true that, in an A/B test, users who see the fake progress bar are happier or more patient. But at some point, people are going to realize they're being lied to, and they're going to wonder what else you're lying to them about.

This is why I think the stories of "[$App] listens to your conversations" / "[$App] charges you extra when your phone battery is low" etc. remain so persistent, even when there's sometimes little or no evidence to back them up. If designers have decided that a little psychological manipulation is okay, why wouldn't they be manipulating us elsewhere too?

This strikes me as pretty optimistic given that exactly this kind of carbon dodge has been going on for years (e.g. Europe and the US importing goods from East Asia and other countries running on dirtier fuels)

It took a second for me to make this connection, but the Charlie Munger in this article is the same Charlie Munger who designed that windowless dorm at UCSB that made the news a few days back. [0] I wonder if he applied the same principles to designing that building.

[0] https://www.independent.com/2021/10/28/architect-resigns-in-...

I talk about it (especially when asked) because I firmly believe I am overpaid relative to the value I (and most tech workers) provide to society. Much of my social circle isn't in the tech industry, and many of them work in nonprofit jobs, the social sector, journalism, or do varying kinds of gig work. I'm actually pretty confident that, given some practice, a little education, and a good grasp of the jargon, many of them could do what I do and make 2-3x what they are making now, but because of the way the career ladder works, it's not a practical option for them.

I try to stress that the reason I make so much money has very little to do with how "qualified" or "smart" I am, but much more with how our society has decided to allocate money and prestige.

Markets aren't going to fix everything. You know what else desalination requires a lot of? Energy, which currently comes largely from nonrenewable carbon-intensive fuel sources. Can we simply spend more money to bring renewable energy sources online? It's unclear, because in addition to being pretty expensive, it raises questions of resource extraction (lithium for batteries, rare earth minerals for wind turbines) and land use (wind and solar farms take up a lot of space). And while we're spending all that money, we're presumably deciding not to spend it on other stuff, like other types of critical infrastructure or social programs.

At some point it becomes simpler to address this problem at the starting point rather than assuming the market will automatically fix any downstream issues.

Do you really think so? Both parties have assiduously avoided making any material legislative moves to address any issues raised by the BLM movement. Democrats have been more eager to make symbolic gestures (renaming things, removing statues, kneeling in the Rotunda wearing kente cloth) but I can't think of one substantive bill that was passed because the BLM movement championed it.

Can anyone make heads or tails of the chart with the survey numbers? I'm having a hard time understanding how "Engaged/Disengaged" maps to the question they ask ("To what extent are you currently looking for a different job than the one you have now?"), why "Not Engaged" (which would presumably be a superset of the "Actively Disengaged" group) has lower numbers than "Actively Disengaged", and why no combinations seem to sum to anywhere near 100%. Extremely confusing all around!

It looks like they're only trying to claw back a small portion of the overall award to SpaceX ($111m out of $885m), so on its own, this doesn't look like a move to kneecap SpaceX. At least not on the scale of what we see with AWS vs. Azure on the JEDI contract.