hannob

I have seen takes about the environmental footprint of unused data before, and I have severe doubts this is a relevant issue.

I mean, sure, there is some impact. Storage media has to be produced. But there's a reason storage is cheap, it's not a whole lot of resources going into it. And hard drives that are idle in some data center without being accessed don't consume a lot of electricity.

There are very real and concerning problems with the environmental impact of IT. But they are primarily found in other areas. Energy consumption is mostly a function of "how much you compute with data", not "how much data you have".

In other words: be concerned about so-called "AI", be concerned about Bitcoin. Don't worry about unused data too much.

> HN post detailing how we got it: https://news.ycombinator.com/item?id=43519522

I don't see any details there. Is there some link missing here, or is it the wrong link?

I'd be interested to read how your tool found it.

> The advantage of a quantum-based entropy sources are that they are often much > faster than other hardware based entropy source.

What kind of problem is solved by a fast, hardware-based entropy source? You only need a couple of bytes of entropy to initialize your RNG.

No, a Quantum RNG does not solve the issue that people use an API for insecure random numbers when they should use one for secure random numbers.

Every OS already has a secure RNG API. That's a solved problem.

Technically correct, but the RNGs you're mentioning are essentially RNGs build on public key cryptography. And I don't think they're widely used, simply because they're slow and have no advantage over faster ones (the Dual EC stuff was, as far as I know, the only thing that was somewhat widely used, and, very obviously, nobody should be using that).

His point was that he was working on a product that solves no actual problem.

Quantum RNGs are gimmicks that are sold as a solution to a security problem. But they don't solve any security problem. There are real security problems with RNGs, but none of them is solved by a Quantum RNG. They usually come down to implementation errors or not using a secure RNG.

> Forgive my ignorance on this but does his assertion that a CSPRNG is all you need after an initial truly random seed, hold up against theoretical quantum attacks?

Yes, if you mean by "theoretical quantum attacks" the stuff we could run if we had a scalable quantum computer. Those impact public key crypto. They do nothing to impact the security of RNGs.

I don't want to start any wars either, but I think people should make informed choices.

By choosing OpenOffice, you should be aware that you are at an increased risk for attacks. One of the consistent problems with OpenOffice over the past years has been that they have often not published security fixes for many months, sometimes critical ones, for vulnerabilities that were publicly known.

(Due to the shared codebase, obviously, many security issues affect both LO/OO, yet, with the difference that LO usually fixes them in a timely manner.)

This is missing the point.

To be clear, I'm not necessarily a fan of DMARC, particularly how it was introduced. But it is very obvious that spammers will eventually do everything to not be flagged as spammers.

What DMARC gives you is that it makes it less likely that your phishing mail will come from contact@yourbank.com. It will rather come from contact@y0urbank.com or some other domain.

How much of an improvement that is and how many people will notice is certainly debatable. But that's what DMARC can give you. Nothing more, nothing less.

They would have released less CO2 if they had regulated CO2 emissions.

As a counterpoint, I recommend this article: https://ketanjoshi.co/2024/08/12/texas-builds-clean-power-bu...

It looks into the numbers for the Texas renewable buildout, and there's a very important caveat: the amount of renewables you build is not the relevant metric. Emission reduction is. And Texas does not succeed there.

Ok, admittedly, that's more than I expected. And hey, if they found some use cases in the embedded world, fine.

Nevertheless, it's not exactly how it was pitched. This Microkernel thing always had a "Linux is doing it wrong, we're doing it better" story behind it. They wanted to be a replacement for a general-purpose OS. That cetainly hasn't happened.

L4 was popular at my university (Karlsruhe). While I never really looked into it in any detail, it always appeared to me like a project that is primarily interested in testing some theoretical ideas, but not in building anything that would be practically useful.

That was 20 years ago. As far as I can tell, this has not changed. (Quick googling tells me there appear to be some efforts to build an OS on it, but they all look more like proof of concepts, not like something with real-world use.)

I think it's clear that factoring works if you can build a scalable quantum computer. But:

1. It's a very lonely example.

2. It's not clear how big the market is for "you can break encryption from the past, but not current encryption, because once QCs arrive, everyone will obviously move away from QC-breakable encryption". And I'm not aware of any other reasons why factoring large numbers would be useful beyond breaking encryptions.

Within one technology, that'd be true. But not if you have the option to choose another technology that produces a lot less waste heat.

Oh, I remember that one.

At the time, the construction of new coal-fired power plants was a controversial topic in many locations in Germany. (Around 30 new coal power plants were planned at times. Some were stopped, but 10 of them were actually build, which is bad enough.) I also tried to raise awareness about this incident in Tennessee, trying to have a look at the environmental issues of coal on a more international level. But it didn't generate much interest.

Here's the relevant pull request: https://github.com/libexpat/libexpat/pull/973

> What am I missing here?

Climate change. Maybe you've heard of it?

(And it turns out things with LNG ships are much worse than previously believed. They not only emit CO2 - a bit less than traditional bunker fuel, but not much - they also emit methane, and in no small quantities. The LNG industry likes to pretend that these emissions are small and neglegible, but whenever someone goes out and actually measures them, they are substantial.)

I couldn't care less about Bitcoin's use of SHA-256, but based on experience:

First of all, it's quite unlikely that this is going to happen at all. There are no signs of significant weaknesses in SHA-256.

But if it's going to happen, in all likelyhood, you'll get preliminary results long before any actual breakage. (For both MD5 and SHA1, you had around a decade of warnings between "this looks insecure / broken in theory" and "we now have an actual collission".) Anyone paying attention and moving away from algorithms already known to be broken was unaffected by the MD5/SHA1 weaknesses.

Of course, there will be those who will wait until an actual breakage, and a few years more, before they act. (As we've seen particularly with MD5.)

Agriphotovoltaics is largely a solution for a non-existing problem.

It is always brought forward as an argument when the perceived landuse issue of solar is brought forward. But if you do any serious analysis, the landuse impact of even utility scale solar is so neglegible that it's not an issue to worry about.

If you want to talk about landuse impacts of renewable energy, there's really only one issue to focus on: bioenergy crops. It can be as bad as 30 times less space efficient than generating the same energy with solar photovoltaics.

Talk about using the same space to make food and bioenergy. Use agricultural land for food, and utilize the residuals as good as possible. Stop making biofuels out of food. And treat the space needed for utility-scale solar as what it is: tiny.

(P.S.: If people can make agriphotovoltaics work, I have no issue with that. Great. Even tiny impacts should be reduced if possible. But I have an issue with the way this is discussed, because it makes up a problem with photovoltaics that largely doesn't exist.)

Didn't know about that, will have to take a look.

I think I am the "inventor" of the first 64 and 32 byte intro competitions. (Just checked, we ran a 64 byte competition at the 0a000h 2002 and added 32 byte in 2003.) See https://0a000h.de/2002/ and https://0a000h.de/2003/ - releases are on scene.org

I don't know if this is technically a lie, but he said that he'll purchase electricity made from fusion power within the next couple of years.

I don't know if he believes that himself. But I can tell you with extreme high confidence that this is not going to happen, and it's not even close to anything remotely realistic.

"dramatically ramping up key sizes" is not done, because it's overly expensive, and not needed.

What people don't realize: key size recommendations are surprisingly stable over long timeframes, and have not changed for a very long time. In the early 2000s, some cryptographers started warning that 1024 bit RSA is no longer secure enough, and in the following years, recommendations have been updated to 2048 bit minimum. That's now been a stable recommendation for over 20 years, and there's not the slightest sign that 2048 bit can be broken any time soon.

The only real danger for RSA-2048 is quantum computers. But with quantum computers, increasing your RSA key sizes does not buy you much, you have to move to entirely different algorithms.

Iceland is already part of the EEA and through that, joined the EU Emission Trading System. Carbfix, the company doing the mineralization stuff, is already receiving quite substantial funding via the EU Innovation Fund, which distributes ETS income to innovative climate technology projects.

Before donating, you may want to consider that the guy operating this service is not just known for operating anonymous email (something I can sympathize with), but also for racist jokes.

The article doesn't really discuss the legality of this, which I'd be curious to hear the opinion of a lawyer.

In other cases, it's considered criminal if a company deliberately puts out false information about itself. E.g., if you lie about your companies products (like Theranos), it's pretty clear that this is not legal.

I don't see why it should be legal to lie about your job opportunities.

It's also how most empirical science operates.

If someone collects data and the study outcome is not preregistered, you can assume p-hacking. It would be implausible not to. And in most fields, preregistration is not common. (And even if there's preregistration, regularly people just switch their outcomes, and nobody cares.)

And to play the devil's advocate: psychology is probably doing better these days than most other fields, because it's been the posterchild example of the replication crisis.

What are you talking about?

The fix was released today, and FF says they received the report 25 hours before that: https://infosec.exchange/@attackanddefense/11328207943028074...

> $100 a ton is a round number close to estimates of what it costs to capture > carbon from an oil refinery or coal burning power plant

That's a wildly optimistic number, and almost certainly too low for the carbon sources yoU're naming. Equinor estimated over 600USD for gas burners at an LNG plant, under almost ideal conditions (existing nearby storage site, company with lots of experience): https://industrydecarbonization.com/news/is-carbon-capture-a...

Not really. While both relate to SHA-1, those are two quite different issues.

The Shattered attack was an actual demonstration of a long-known weakness in SHA-1 that allows creating practical collisions.

This one is more an exploration of the question whether a malicious actor can create a standard that looks good, but is actually weak. Those questions got quite a bit of attention in that time due to the Snowden leaks, and the realization that this actually happened at least in one case (Dual EC DRBG, which, technically, was already known before Snowden, but only got major attention afterwards).