hannob

They don't, and they can't cheat physical realities either.

Plants only filter out very small amounts of CO2 from the air over relatively long timeframes. That's why crop-based biofuels require such enormous amounts of space.

Yeah, but there's a plausible explanation for this: Likely, people who get vaccinated also are more likely to do other things to improve their health.

It looks like the shingles vaccine has positive effects that prevent dementia. (Well, that's in the title.)

This study was possible due to a "natural experiment" where one country gave people from a very specific birth date the vaccine (so people born right before and right after that date were very similar, except for the vaccine).

It's not clear why this is the case. It might be that the virus the vaccine supresses plays a role in dementia development, or it might be that the vaccine causes an immune response that has other indirect positive impacts.

I found the intro very confusing, tbh.

Particularly the "no increased risk of all-cause mortality". I mean, if we assume the vaccines worked, we'd certainly expect a decreased risk of all-case mortality (because "all-case mortality" certainly includes "covid mortality"). Reading "no increase" seems to imply "it doesn't change anything". Yeah, technically, the sentence does not say that ("no increase" can mean "no decrease" or "no change").

You have to read further below to get what should be the real message on all-cause-mortality: "Vaccinated individuals had [...] a 25% lower risk of all-cause mortality". I think that should've been in the first 1-2 sentences.

Counterpoint: XML is a horrible format.

Why? Answer this question: how can you use XML in a way that does not create horrible security vulnerabilities?

I know the answer, but it is extremely nontrivial, and highly dependent on which programming language, library, and sometimes even which library function you use. The fact that there's no easy way to use XML without creating a security footgun is reason enough to avoid it.

Oh, great, they found another way to power energy-hungry chatbots with inefficient fossil fuels.

While true, it is completely unrelated in this context.

This comes up on a regular basis in the discussion around hydrogen, sometimes it's also known as turquoise hydrogen. The claims made here are very misleading, let me quickly explain why.

The idea here is that you make hydrogen from fossil methane by splitting it into hydrogen and carbon. Now, the claim is that you now have "clean" or "climate neutral" hydrogen. But it's made from fossil gas, and there's carbon. If you would now bury that carbon or do something else that guarantees that carbon never ends up in the atmosphere, ok, you might claim that. (Still with caveats: your fossil gas production has upstream emissions you need to account for.)

But that is not economically feasible. So the idea is: sell that carbon as a co-product. But now, that carbon will in almost all cases eventually still end up as CO2 emissions. But these pitches never talk about that. Claiming that hydrogen is "climate neutral" is, then, more an accounting trick. If you are honest, you would have to do something like associate half of the eventual emissions to it.

I wrote about it in more detail before: https://industrydecarbonization.com/news/the-problem-with-tu...

It's actually relatively simple.

Adding dependencies comes with advantages and downsides. You need to strike a balance between them. External libraries can help implement things that you better don't implement yourself, so the answer is certainly not "no dependencies". But there are downsides and risks, and the risks grow with the number of dependencies.

In the world of NPM, people think those simple truths don't apply to them and the downsides and risks of dependencies can be ignored. Then you end up with thousands of transitive dependencies.

They're wrong and learn it the hard way now.

This does not appear to be particularly surprising (?).

I think it is widely recognized that exercise and an active lifestyle can lower the risk of type 2 diabetes.

Remembering my cannabis consumption days, being under the influence of cannabis is not exactly a state that encourages an "active lifestyle".

For the people wondering why this does not show up as revoked in their browser: I believe the way the current revocation systems work is that browsers compile centralized lists of revoked certificates, but they do not contain all revoked certs, but only ones that indicate some form of security issue.

Certificates can be revoked with various revocation reasons, however, it looks this one has no specific revocation reason listed in the CRL. For a certificate that was revoked with a reason of "Key Compromise", things would be different, and most browsers would probably reject it.

They started shipping installers with de-facto-malware, but at a time when they were already on a downward slope. It was many years after "sourceforge was the default place to host FOSS".

> I think GitHub added the “pull request” as a really useful add on to git and that really made it take off.

I'm pretty sure the term "pull request" existed before GitHub. (Meaning writing an email saying "I have changes in my copy of repo that I want you to merge into the main repo".) But GitHub put an UI around it, and they may've been the first to do that.

> But that comes at the cost of speed

That is mostly a myth.

I mean... technically, yes. But the cost is so marginal that you will have a hard time even measuring it unless you generate gigabytes of data.

For pretty much all common use cases like generation of ids, tokens, etc., you can use a secure random number generator and it will not impact your performance in any meaningful way.

It seems like there's a very plausible mechanism for reverse causation here. If you're already having health problems, you are more likely to follow a dietary pattern that is said to promote health. That this translates to a correlation to heightened cardiovascular risk seems unsurprising.

Having seen too many "this randomness function was never meant to be used for security, but people use it for security anyway" vulnerabilities in the past:

Can we PLEASEPLEASEPLEASE have this secure by default from the beginning?

> We hold an ACME account key on your behalf with the CA, but we cannot use it impersonate your domain or decrypt traffic.

That makes no sense whatsoever. If you have an ACME account key for my domain, of course you can use it to impersonate my domain. You just need to create another certificate. (Which I could detect, but if I know how to do that, I'm probably not going to need your service anyway.)

> As far as I understand, the key material for any post quantum algorithm is much, much larger compared to non-quantum algorithms

This is somewhat correct, but needs some nuance.

First, the problem is bigger with signatures, which is why nobody is happy with the current post quantum signature schemes and people are working on better pq signature schemes for the future. But signatures aren't an urgent issue, as there is no "decrypt later" scenario for signatures.

For encryption, the overhead exists, but it isn't too bad. We are already deploying pqcrypto, and nobody seems to have an issue with it. Use a current OpenSSH and you use mlkem. Use a current browser with a server using modern libraries and you also use mlkem. I haven't heard anyone complaining that the Internet got so much slower in recent years due to pqcrypto key exchanges.

Compared to the overall traffic we use commonly these days, the few extra kb during the handshake (everything else is not affected) doesn't matter much.

> 3) Syngas fills in that last 2-5%

Just one note, I believe what you mean is some form of gas made from renewables, most likely hydrogen.

"Syngas" is a term that has a relatively specific meaning in the chemical industry, notably it is a gas mixture of mostly Carbon Monoxide and Hydrogen. I do not think that this is what you mean.

That brings back some memories...

Back in the 90s, there was a whole scene around exe/com compression and protection tools. ("Protection" in the sense that people figured out if they compress their executables, that also mean you cannot simply modify strings in them any more, and that was expanded to all kinds of anti-debugging protection. However, it never lasted long until the next unpacker was able to break it.)

I never acquired the skills to write such tools myself, but I wrote a detection tool and ran a mailing list.

Or in other wors, in case you were around at that time: I'm the author of chkexe and ran the exe mailing list.

> The Germans in this article all appear to be aligned to either BSW (populist far-left, pro-Russia, anti-US)

Picturing BSW as far-left, while not uncommon, strikes me always as very strange. While it's a bit unclear where to put them with their wild mixture of populism, the only reason they are by some seen as leftwing is because of the history of their founder. She was previously a member of the left party, but for many years, even while she still was a member of that party, has not held any views that could count as far-left.

The only reason some still put her in the far-left camp is that she was, looooong ago, a member of the communist platform in the PDS, the predecessor of the left party in Germany.

Okay, maybe this is a stupid question, but: what is an agentic browser? You seem to assume that everyone knows what that means.

Is this a common and well-defined term that people use? I've never heard it.

It would appear to me from the context that it means something like "web browser with AI stuff tackled on".

It's a company selling this "enhanced protection". You need it, because otherwise, they wouldn't make money.

The whole thing looks like a PR stunt for an Infosec product. Just that they somehow convinced the EU to fund it.

"AI Responses May Include Mistakes" is really the one, single most important thing I want to shout into the whole AI debate.

It also should be the central issue - together with the energy/climate impacts - in every debate about AI ethics or AI safety. It's those two things that will harm us most if this hype continues unchecked.

This is a justification that was made up after Git came under increasing criticism for its poor choise of a hash function after the shattered attack. It was already known that SHA-1 is weak before Git was invented.

The problem is... it doesn't line up with the facts.

Git has been using SHA-1 hashes for signatures since very early on. It also has claims in its documentation about "cryptographic security". It does not rigorously define what "cryptographic security" means, but plausibly, it should mean using a secure hash function without known weaknesses.

> The standard approach is be liberal in what you accept and be specific in what you emit.

What you're paraphrasing here is the so-called "robustness principle", also known as "Poestel's law". It is an idea from the ancient history of the 1980s and 09s Internet. Today, it's widely understood that it is a misguided idea that has led to protocol ossification and countless security issues.

> Some people don't want to be forced to run a bunch of stuff they > don't understand on the server, and I agree with them.

Honest question:

* Do you understand OS syscalls in detail?

* Do you understand how your BIOS initializes your hardware?

* Do you understand how modern filesystems work?

* Do you understand the finer details of HTTP or TCP?

Because... I don't. But I know enough about them that I'm quite convinced each of them is a lot more difficult to understand than ACME. And all of them and a lot more stuff are required if you want to run a web server.

> Several people in the comments seem to be blaming Github for taking this step for no apparent reason.

I mean...

* Github is owned by Microsoft.

* The reason for this are AI crawlers.

* The reason AI crawlers exist in masses is an absurd hype around LLM+AI technology.

* The reason for that is... ChatGPT?

* The main investor of ChatGPT happens to be...?

> the only power generation that has a completely closed fuel life cycle

What exactly are you talking about? It does not sound like it describes the way nuclear power, uranium mining, and nuclear waste storage works.

I mean, it's not as if Libreoffice was created yesterday. Its predecessor OpenOffice is now 25 years old. Your question becomes: Why did you choose the expensive version where you never know what it will cost next year in the first place?