grumdan

Another point is that Haskell and OCaml popularized features and styles that are making their way into mainstream languages (e.g. option types instead of null, immutability by default), and the compilers showed that they can be implemented efficiently.

> What's the difference? Why are phones such a security nightmare? At least in terms of encryption at rest on a cold device, isn't this a solved problem?

One horribly annoying decision of Android is that the encryption passphrase cannot be different from the unlock pin, leaving users with two choices:

- Have a long, secure password that actually makes Android's encryption worth a damn. They then have to enter this password every time they want to unlock their phone. I don't think many people go for this option.

- Have a short usable password so you can painlessly unlock your phone. However, then encryption only provides a marginal benefit

(- I decided to use a long password with fingerprint unlock as a compromise, which creates its own security problems.)

It seems that they ignore that a powered off devices could easily provide much stronger protection by allowing a separate encryption password. And if the device is powered on, limiting unlock attempts might be somewhat useful to frustrate attacks against short lock screen passwords.

In particular, this shows that it's not that it's not been measured. It's been measured and not found to be an incorrect explanation of what's happening.

As in, there are a handful of large projects the languages are used for. For Haskell, Facebook's spam detection system, Sigma[1], comes to mind, along with some use by banks (Standard Chartered); then there's a bunch of smaller places using Haskell (Wire, a secure messaging app, like Signal; Galois, a US defense contractor doing software verification and related things) plus some open-source tools like pandoc.

I know less about OCaml, but at least Jane Street is using it.

It's somewhat niche, but it's not like it's only used for hobby or toy applications.

[1] https://code.fb.com/security/fighting-spam-with-haskell/

This particular example can be encoded into the Haskell type system though. For example, there's a tensor library where all operations are (according to the description) checked for the correct dimensions by the type system. It seems to require a lot of type-level magic though, and that may disqualify it for "cleanly".

http://hackage.haskell.org/package/easytensor

Describing two well-engineered compilers of two relatively used languages as not impactful is quite a statement. In particular, given the good performance results they achieve, for languages that are quite far away from the normal execution model of the machine they produce code for.

In a similar vein, I'd love to see some form of reward for replication studies, which are also hard to publish, since they're not novel and exciting. However, due to this focus on novelty, we got plenty of unreproducible results: https://en.wikipedia.org/wiki/Replication_crisis

In my ideal world, a scientific result would not be taken as meaningful until it's been replicated at least once.

It does cement their power over you even further though. An individual project may not make an appreciable difference, but in aggregate, if lots of people make similar choices, it may have an impact.

Tree Style Tab for Firefox is incredibly helpful to me for this kind of usage:

https://addons.mozilla.org/en-GB/firefox/addon/tree-style-ta...

Whether it's because of their business model is an important question though, because it may tell us if we this has a good chance of being genuine and whether we can expect this to last. If it's in their financial interest to protect users' privacy, then I'm much more inclined to believe that they are actually trying to do that.

If they right now appear to care about privacy, but it's for some other reason, I'd expect financial motives to eventually overrule that.

The only thing I noticed in 10 years of zsh use is that `printf "%b\n"` can be used in bash but not in zsh to unescape C-style strings: E.g. `printf "%b\n" '\"abc\"'` ==> "abc"

Another idea is to make companies liable for data breaches. These may be unintentional, but we have similar laws for unintentional safety problems. If I sell you a hairdryer that explodes, I will be on the hook for that, even if I didn't intend for it to explode. Why shouldn't it be the same for security issues?

If I recall correctly, Bruce Schneier is a proponent of this idea.

I think this is still applicable advice for embedded DSLs too, since the grammar of the DSL will be made up of the ways in which you can compose the operations you provide, whether they are parsed by the host language's parser or your own.

Overall, I agree that it's important to think about how to make sure that operations compose in an unintuitive, expected way. I find this hard to figure out without thinking of it in terms of a grammar and semantics, whether it's embedded or not.

It seems like Google just treats fines due to antitrust lawsuits as the cost of doing business, and they're potentially making more money with such behavior than they are losing due to legal costs.

> Windows has better toolbar management, mouseovers & switching between apps. Also since Ubuntu moved back to Gnome, switching between Virtualbox VMs has been buggy (display driver issues no doubt)

I find both Mac and Windows' window managers much less pleasant than one of the many tiling window managers on Linux, since they automate away a ton of manual window management. That being said, I invested an unreasonable amount of time into configuring xmonad to behave in the way I want to, and the default window manager on, say, Ubuntu, is indeed pretty bad compared to Windows / Mac.

Amethyst, an xmonad-clone for Mac, works well enough, but still has bugs and is nowhere near as configurable as tiling WMs on Linux.

Sure, there are other concerns and bash is not an ideal language, but memory safety is responsible for quite a large number of security flaws, since its lack turns bugs into code execution vulnerabilities on a regular basis.

I don't really have an opinion on what language should have been picked instead, though OCaml may be a good candidate.

> They have a track record of labeling serious bugs as non-issues, ignoring them, or just not filing them as CVEs. Serious issues keep coming up.

Additionally, this is not likely to stop, since they took an init system that was (mostly) written in a memory-safe language (bash) and rewrote it in a memory-unsafe language (C++), thus enabling a whole class of systemic security issues that will keep popping up in the future over and over again as well. This is one of the design decisions behind systemd that irks me the most.

> Airlines have no choice, there's a limited capacity in the world for airplane construction, several thousands of orders on the books for the 737 and 320 waiting to be filled. What can an airline do? They can cut back some orders but not all orders.

In a world that had actually severe consequences for corporate negligence, regulators would force Boeing to let airlines cancel/change all orders, and compensate them for the 737 Max models they already shipped to them, as they cannot be flown safely. Boeing's behavior does not indicate that they are interested in properly fixing this problem as opposed to getting it certified via corporatism / the FAA allowing them to perform a big part of their own checks.

I find static types useful for gaining that understanding. It's very helpful to clear up confusion in my head to start prototyping by writing down type definitions and functions' type signatures without implementations before starting to write the actual code. Of course, this only works with a language where the type system is sufficiently painless and allows for such experimentation without a ton of boilerplate (i.e. the language is not Java).

> The kinds of bugs that get caught by a static type system are also caught by a good suite of automated tests, where every test is written before the production code that makes it pass.

To make matters worse, one would also have to write tests that cover every possible path through the function to ensure none of them change a value into a shape the rest of the code doesn't expected. This gets very tedious if it has to be done for every function.

A nicer, consistent interpretation would be to take sin^2(x) to mean sin(sin(x)) and keeping sin^{-1}(x) as an inverse.

> (Where is my cross-platform, OSX-Linux-Windows one-file text editor that just has smart indent and syntax highlighting for python?)

I know people are gonna protest this suggestion vociferously, but Emacs ticks all these boxes (except that it works for multiple files), with almost no configuration. Admittedly, getting auto-completion to work cross-platform for various languages is still quite tricky.

Just to give you a flavor of the way the main Vampire author does things: Until one or two years ago, not even a binary was freely available on the vampire website, and one had to contact them by email to ask for one; source code was definitely not distributed in any form.

It's still possible to simultaneously acknowledge the fact that we need to repeatedly convince people of space exploration being important while also disliking that this is necessary.

Possibly when we learn that a cat is called a cat. Without that, we may still learn to distinguish a cat from a dog, but I guess the label would be an internal one.

> Perhaps it doesn’t jive with some sensibilities, but it’s not their responsibility to cater to anyone’s sensibilities.

Whether or not someone or some organization is successful, for some definition of success, is a very different question of whether they are behaving morally. And yes, the public certainly can and should point out immoral actions by such institutions. There are countless examples of companies and governments that were successful with some policy that was widely regarded as immoral.

Well, there were documents part of the Snowden leaks that showed how some NSA agents used the agency's tools to spy on (former) romantic partners and such, and I think he said something along the lines of this kind of thing not being prosecuted much. Sure, it's still a different level than a political case like this one, but it does call the internal oversight at the NSA into question.

I would say that Scala can be called widespread and allows for such embedded DSLs.

I would see it the other way around: To me the real issue is that our minds have a tendency to create a lot of unnecessary stress for ourselves and make us focus on goals that are unlikely to produce any lasting happiness, like constantly striving for new achievements.

Meditation, at least some forms of it, are attacking this particular problem at the source and try to help people let go of these mental habits. I get the converse feeling that hobbies / meeting up with friends / putting a lot of effort into work are engaging, but they also feel like pleasant distractions instead of addressing what I see as the real underlying issue. This is highly subjective and depends on on what ones wants to do with one's life, but meditation certainly isn't a surrogate solution to me.

Fair enough, though the separation into categories possibly helps somewhat. If someone is reading r/some-topic-they-are-interested in, it wouldn't also show them stories about, say, cops shooting unarmed civilians in the back 67 times, in between the topic-specific content.

This is probably different on the main page though.