HNHacker News
TopNewBestAskShowJobs

jlokier

6,144 karma · joined October 23, 2018

Mail: jamie@jlokier.co.uk LinkedIn: https://linkedin.com/in/jlokier

Knowledgable & helpful person, available for hire :-)

I'm looking for more work, ideally on a consulting / freelance / part-time basis.

LinkedIn is better than email to make first contact if you'd like to talk, whether for work or just chat about something you liked here on HN! (I often miss interesting one-off mails among the deluge, and don't check it every day.)

I work 80% time at a funded stealth startup as hands-on tech lead, with zero-knowledge (ZK) cryptography, Bluetooth low energy (BLE), and peer-to-peer distributed systems, linking physical devices as well as the usual web stack. Can't say more, but it is intended to become open source. This a really fun and challenging project, with a great team! (It's not on my LinkedIn - stealth).

With my remaining 20% I am currently available and looking for software dev and/or tech leadership and/or business strategy consulting.

I'm versatile but develop mostly low-level or "system" software in C, C++, Go, Rust and Nim, with Linux as my main OS (but MacOS and Windows also). I have about 30 years professional dev experience over a wide range of systems, from embedded to supercomputers, Linux kernel, database engines, as well as GUIs, the web, and even games. Good at performance optimisation, debugging. Also good math & physics.

I've worked as an Ethereum core dev (EVM), so I know that environment well, especially improving EVM database speed, which is a critical factor! Currently my rabbit holes are ZK cryptography speed optimisation, and a novel fast database engine (neither B-tree nor LSM-tree, but with characteristics of both).

(ZK = zero-knowlege cryptography).

submissionscomments
jlokier··on Are we the baddies?
> I never understand why people make comments like this

It's intentional, because the location has nothing to do with the actual point. Stating it invites people to focus on the location too much instead of the actual point, or to say things like "oh that's just your country / town, we can assume that's anomalous".

Which would be missing the point entirely.

If you're interested in the location you can find out. It's no secret, though I would advise against trusting people's locations on LinkedIn, they are often not where the person currently works or lives.

But I'm not interested in stating it. For the point I was making, the specific location, or even the country, detracts from that.

You've traveled in 50+ countries. Just from that, you're an extreme economic and social outlier. You are almost certainly taking journeys that are systematically different from those taken by the majority of people, and the price brackets and journey routes you're comparing between services are different than those used by other people. It may well be that the comparison works out differently as a result.

Not to disregard your experience. You've plenty. But you are very unusual, and it's impossible to travel that much without taking journeys that other people never or very rarely take.

I would not be surprised if the "obvious foreigner" premium is there for taxis, even if you're experienced. I'd find it unlikely that you became so intimately familiar with all 50+ countries as to get the true "favour for a friend" fare in all 50+ including those where that's more common, and that you took the same journeys as locals do in all of them.

On the other side (and on the original topic), Uber has reason to optimise for traveller cohorts. If Uber wanted to seem cheaper than local taxis to people in your cohort, to a greater extent than for other people, they could probably do that, and it would make economic sense if their algorithm statistically optimises for that. Profit-maximising algorithms with "personalised" pricing default-optimise for trade with wealthier customers who use their services more often, for journeys associated with other spending, such as to/from travel hubs and hotels, and for separating out cohorts in subtle ways that maximise the inability of cohort members to detect the separation.

jlokier··on Are we the baddies?
> Taxis are almost always twice or sometimes (airport) 3x the price.

Not where I live. Here, Uber is 50-100% more* than the price of a local taxi, at all times of day. Uber is also at least 30% more expensive than hailing a black cab.

So even though I have the app, after optimistically checking the Uber price, I invariably choose to book a taxi instead.

The shorter arrival times shown in the Uber app are sometimes tempting, but after waiting nearly 30 minutes for a car that Uber continuously said was 4 minutes or less away, with their location moving around (so not stuck in traffic) and driver repeatedly changing, I don't take the time seriously any more.

I just wanted to correct the impression that's often put out that Uber is cheaper (or faster) for the customer. It's evidently true in some places. But where i live, other than when they ran a 50% discount for the first few months after arriving in town, I've never seen Uber be anything other than the most expensive option.

It's not due to lack of drivers: I've been told most drivers at the biggest local firm switched to Uber as soon as they arrived in town, and that's backed up by seeing Uber-marked cars everywhere.

jlokier··on Opening up ‘Zero-Knowledge Proof’ technology
The trick is called the Fiat-Shamir transform, and you're right, it does require more questions to get an equivalent security level, precisely because you can try a large number of random non-solutions without anyone catching you doing it.

But the number of questions you need to compensate grows only a little.

For example, interactively if you ask for Merkle tree proof that selected leaf values have a particular property, you only have to ask for about k leaves to get probability 1-(2^-k) that you'd catch a dishonest prover who had committed a Merkle root with less than half the leaves having the property.

Non-interactively, a dishonest prover could secretly grind attempts, say 2^g times, and then you'd have a lower probability of catching them, approximately 1-(2^(g-k)). But g can't be all that large, so you can increase k to compensate without making the proof much larger.

You.can also require certain hashes to have a fixed prefix, like Bitcoin mining, forcing every prover to have to grind 2^p times. This reduces the effective g that a dishonest prover can achieve, allowing k to be smaller for the same security, so allowing the non-interactive proof to be smaller. At the cost of honest provers having to grind.

jlokier··on Next month, saved passwords will no longer be in Microsoft’s Authenticator app
I have a Macbook and an Android phone, as do many people.

Can I still have a seamless experience with passkeys, or have they made that difficult? Do I need to remember to reject the dialog offering to save keys on Keychain and learn to use a 3rd party passkey service?

What am I supposed to about all the passkeys that will be needed at my multiple jobs, which I access from my own Macbook and phone? Can I use a single service, ideally open source, or do I need to use several "passkey sharing & backup managers", one for each entity and one more for my personal keys?

jlokier··on Firefox 120 to Firefox 141 Web Browser Benchmarks
I find it's worse with Chromium than Firefox. After an update, new tabs don't load properly and links fail, until I manually restart it. In the past I've joined Google Meet meetings in Chromium and found the audio not working because I'd forgotten to restart the browser since the last update.
jlokier··on Cloudflare to introduce pay-per-crawl for AI bots
Especially when it asks you to do it again, and again, until you realise you're never going to be allowed to see the page.

I've had that happen a few times with sites behind Cloudflare.

jlokier··on I Switched from Flutter and Rust to Rust and Egui
In a HTML table, unless given a fixed width, the width of each column depends on the natural widths of all the columns, and those widths depend on the content of every cell in the column, and those cell natural widths depend on word-wrapped layout as well as other layout of content in each cell, including nested tables recursively.

In other words, with default styling you have to calculate natural widths of every cell in the whole table before you can begjn layout out even the first cell of the table.

There are style settings you can use which change this, and allow layout of early cells or rows to complete without depending on later cells.

(Also the height of each row can depend on the height of the content of every cell in the row. But that's local to each row so it's a relatively small dependency.)

jlokier··on Journalists wary of travelling to US due to Palantir surveillance
> why should only private actors have that data?

I'm not sure if you consider governments and police to be private actors?

I spoke with a sophisticated ANPR city-wide tracking vendor recently at a conference. From their video showing the system following vehicles in real-time, with detailed movement tracking, speed measurement, lane position, estimating model, age, demographic etc. when they couldn't see the registration plate, from all sorts of vantage points, it looked to me like they would know where basically everyone who drives is at all times as they moved around.

So, as a privacy advocate, I asked them about tracking and knowing where every driver is all the time, and they assured me: "It's ok. We send all this data immediatel;y to the police. The police are responsible for keeping the data safe. They only use it when they decide it's appropriate."

I was there interested in privacy and traffic monitoring, but there was almost nobody to speak with who seemed to think about privacy, except in a checkbox sort of way, e.g. "when you're in public there's no legal right to privacy" and "our systems are fully compliant with data protection".

jlokier··on AOSP project is coming to an end
Fwiw, I've had a similar screen issue (turned green or magenta and glitchy, parts of the screen image disappearing, until one day it turned black) happen with two Samsung phones.
jlokier··on Tell HN: Help restore the tax deduction for software dev in the US (Section 174)
Not when it comes to capital assets. The full cost of a large capital asset is generally not allowed to be treated as an expense for tax purposes.

It's technically correct that tax is levied on "net income", but that's an accounting term which means something different from "money_in - money_out" when there are capital assets.

One justification for this is, although you spent the cost, you received equivalent value in the form of the asset itself.

This means if it costs $100k in salary to make software this year, and you get $30k in income from the software this year, your bank balance will lose $70k (which is expected) and you'll have negative income in the ordinary way of thinking, but you'll be charged income tax (which is new) despite losing money, as if you gained (almost) $30k instead of losing $70k.

Your tax accounts will show an increase in net assets, despite the decrease in your bank balance, because they will show the software as being "worth" (almost) $100k, regardless of what it's really worth right now.

This is particularly hard if you're a small company or (non-VC-funded) startup that's already stretching to cover the cost of speculative software development. Being charged income tax even while you're losing money developing software (in the ordinary way of thinking about money) is what's new in the tax code. It makes it harder than before to do speculative developments, making some kinds of development non-viable that were viable before.

jlokier··on Atari Means Business with the Mega ST
Wow, there are a lot of C compilers for Atari ST!

I was astonished to find about 22 distinct C compilers, including their own libraries, assemblers, linkers etc. for the Atari ST and its successors. That's not counting separate versions, just distinct products from different vendors.

From what I can see now looking at archive sites, there was a huge amount of activity in developer tools on the ST back in the day. Much more than I thought at the time. It might have been a serious contender for the dominant architecture (along with the m68k CPU), if IBM PC-compatibles and x86 hadn't won.

Recently I looked for Atari ST C compilers, out of curiosity to test portability of a C program I'm working on.

I've been testing C code for diverse Unix systems.

As I used to own an Atari 520ST (with 1MB RAM beautifully piggy-backed and hand-soldered on the existing RAM chips :-), it seemed like a good idea to peek at C on an ST emulator. I didn't use C when I had a real Atari ST (no C books in my local library), so I expected to find one or two C compilers, not 22!

jlokier··on Progressive JSON
Round trips for parallel requests work fine over HTTP/2. (As long as there aren't vast numbers of tiny requests, for example every cell in a spreadsheet).

However, sequentially-dependent requests are about as slow with HTTP/2 as HTTP/1.1. For example, if your client side, after loading the page, requests data to fill a form component, and then that data indicates a map location, so your client side requests a map image with pins, and then the pin data has a link to site-of-interest bubble content, and you will be automatically expanding the nearest one, so your client side requests requests the bubble content, and the bubble data has a link to an image, so the client requests the image...

Then over HTTP/2 you can either have 1 x round trip time (server knows the request hierarchy all the way up to the page it sends with SSR) or 5 x round trip time (client side only).

When round trip times are on the order of 1 second or more (as they often are for me on mobile), >1s versus >5s is a very noticable difference in user experience.

With lower latency links of 100ms per RTT, the UX difference between 100ms and 500ms is not a problem but it does feel different. If you're on <10ms RTT, then 5 sequential round trips are hardly noticable, thought it depends more on client-side processing time affecting back-to-back delays.

jlokier··on Progressive JSON
2ms to generate, 1 second for basic text to appear and 20 more seconds to receive the whole page on my phone in the centre of town, due to poor service.

Compared with waiting on a blank page for ages, sometimes it's nice to see text content if it's useful, and to be able to click navigation links early. It's much better than pages which look like they have finished loading but important buttons and drop-downs are broken without any visible indication because there's JS still loading in the background. I'm also not fond of pages where you can select options and enter data, and then a few seconds after you've entered data, all the fields reset as background loading completes.

All the above are things I've experienced in the last week.

jlokier··on Worlds first petahertz transistor at ambient conditions
Since you asked, yes, optical flip-flops have been around for decades.

That said, you don't need flip-flops or latches to calculate SHA-256 for mining Bitcoins. You only need them at the edges of the circuit, to use the results. But you can do that with electronics at the edge, if you want to avoid stateful logic in the all-optical part.

jlokier··on Show HN: Samchika – A Java Library for Fast, Multithreaded File Processing
Last time I measured on Linux (a few years ago), with NVMe, mmap + calling out to a thread pool to async-page-touch (so the main thread didn't block) was faster than io_uring (from the main thread) for random access reads.
jlokier··on Apple violated antitrust ruling, judge finds
Sure you can. The services just need to agree protocols. The tech & cryptography part is not difficult these days. We've had guaranteed E2E for email since PGP in 1991, though not many people cared enough to use it.

None of the services you listed do it, but that's because they don't want to, not because it can't be done. It's a business decision problem, not a technical problem.

jlokier··on Google Play sees 47% decline in apps since start of last year
Actually, F-Droid has quite strict requirements on the apps it will accept, and it enforces them.

Low-effort spammy apps with ads and in-app purchases are unlikely to be accepted.

Standard Android in-app purchases, efficient notifications, or ads which use Google services, won't be accepted at all, though FLOSS versions of those things are ok in principle.

From https://f-droid.org/docs/Inclusion_Policy/ :

> All applications in the repository must be Free, Libre and Open Source Software (FLOSS) – for example, released under a GPL or Apache license.

> Every effort is made to verify that this is actually the case, both by visual inspection of the source, and by building the application from the published source.

> We cannot build apps using Google’s proprietary “Play Services”.

> We cannot build apps using proprietary tracking/analytic dependencies like Crashlytics and Firebase.

> We cannot build apps using proprietary ad libraries.

> The source code for the application must be maintained in a publicly accessible Version Control System which we have support for

> The original app author has been notified (and does not oppose the inclusion).

jlokier··on Mark Zuckerberg Says Social Media Is Over
> one of the reasons WhatsApp has done so well is that they basically supported every platform under the sun

Not really. There's still no iPad version.

My friend installed Whatsapp from the App Store for their iPad, to find it didn't behave quite as expected, and didn't match their phone and desktop experience.

That turned out to be because it was an app from some random third party with its own features. It used Whatsapp in the name, and had a similar logo.

When my friend realised they were unexpectedly using a third party app, from a provider they'd never heard of, they were worried they'd accidentally given away access to their account full of sensitive messages to someone they didn't trust.

I was surprised my cautious friend would install the wrong app by mistake, as the Apple app store is normally good for well known services.

While scrolling through Whatsapp apps, it took me a while to realise the top search result, which my friend had installed, wasn't actually from Whatsapp (but looked similar). Even though the logo was a little different, I assumed that was just a quirk. It's just so unexpected to find that what you get on iPad isn't the real thing, when searching for Whatsapp gets you the real thing if you're looking from an iPad or Mac.

jlokier··on Getting forked by Microsoft
Linux in Android is GPLv2 not GPLv3. The v2-v3 difference is a big deal to some.

Linux developers made an intentional decision to stick with GPLv2 and to remove the "or later version" option, so you can't include it into GPLv3 projects as you can with most other GPLv2 software.

GPLv3 avoidance is why Apple ships ancient versions of Rsync, Bash and Make on its current OSes instead of the current versions, and replaced Samba with its own inferior SMB service.

jlokier··on Why fastDOOM is fast
The gprof profiler was used long before 1993. It dates back to 1982.

I did game engine dev professionally in 1994 (and non-professionally before that). We profiled both time and memory use, using GCC and gprof for function-level profiling, recording memory allocation statistics by type and pool (and measuring allocation time), microbenchmarking the time spent sending commands to blitters and coprocessors, visually measuring the time in different phases of the frame rendering loop to 10-100 microsecond granularity by toggling border or palette registers, measuring time spent sorting display lists, time in collision detection, etc.

You might regard most of those as not what you mean by profiling, but the GCC/gprof stuff certainly counts, as it provides a detailed profile after a run, showing hot functions and call stacks to investigate.

It's true that most of the time, we just changed the code, ran the game again and just looked at the frame rate or even just how fluid it felt, though :-)

jlokier··on How to add a directory to your PATH
The compact one-liners below are similar but avoid adding duplicate items to PATH, so are fine to call in various init scripts.

In Bash:

  path_append() { local p; for p; do [[ :"$PATH": =~ :"$p": ]] || PATH+=:$p; done; }
  path_prepend() { local p; for p; do [[ :"$PATH": =~ :"$p": ]] || PATH=$p:$PATH; done; }
In portable POSIX shell:

  path_append() { for p; do case :"$PATH": in *:"$p":*) ;; *) export PATH="$PATH:$p" ;; esac; done; }
  path_prepend() { for p; do case :"$PATH": in *:"$p":*) ;; *) export PATH="$p:$PATH" ;; esac; done; }
jlokier··on Show HN: I got laid off from Meta and created a minor hit on Steam
> once you can get a startup off its feet, the VC money from seeds easily makes up for that downtime

The depends a lot on the startup. Many startups don't take VC money.

Of those that do, in my experience as first non-founder employee, the founders were paid very little compared with employees, on the hope of future success with their equity instead, even after the startup got decent pre-seed and seed investment. Both rounds of investment were enough to pay some key employees well, but not to pay everyone well for long enough. So the founders felt they has to continue with low pay for themselves.

jlokier··on 5G networks meet consumer needs as mobile data growth slows
If I want to download a multi-hundred-gigabyte anything, I switch to my mobile and turn on it's Wi-Fi hotspot. It's a really noticable speed improvement, with the caveat that speed varies a lot according to location and time of day.

My phone, a mid-range Android from 3 years ago, usually downloads over 4G much faster than any of the wired or fibre networks I have access too, including the supposedly newly installed dual fibre links at work, or the "superfast broadband" zone at my local library. It's also much faster than the 4G router at home.

I've downloaded terabytes over my phone, including LLM weights, and my provider's "unlimited" data plan seems fine with it. (They say 3TB/month in the small print.)

jlokier··on Waydroid – Android in a Linux container
I just heard of it from this thread and took a look. It looks great! I'd love to get one, but from the FAQ:

> "The only apps that won’t work are ones that require the full Google Play Store and all it’s requirements. This includes some banking apps"

Sigh. It looks like I'd have to carry two phones.

Banking and credit card apps are essential daily apps for me. I can't even log in to some of my accounts on a desktop browser without their phone app to authenticate, and quite often individual payments require phone app confirmation. Unfortunately I'm not in a position to switch accounts for a freer user experience.

Separately from finance, I also have to use the Google suite for my main job, and I've had to use Discord for another job. I guess those can run in a browser with reduced functionality, though. Not so for the banking/credit card apps, unfortunately.

This isn't a complaint about Waydroid or FLX1. I appreciate the work and creativity! I've long dreamed of owning (and building) a completely FLOSS phone, and seen how much work is involved. I owned two Nokia N900s back in the day.

But times have changed, and I wish and hope a way can be found to run the apps or protocols daily life seems to require now, on top of (or side by side with) a base FLOSS system.

jlokier··on F-strings for C++26 proposal [pdf]
Ouch, but thanks. I learned something today - something I'd long forgotten. I like your example, it shows the point well. (Though, there are circumstances when a compiler can unroll such a loop and infer a compile-time constant, it wouldn't qualify as a constant expression at the language level.)

It's been so long since I used C++ for serious work that we weren't using C++11, so neither auto nor range-for were available. It would be uncommon to see "const type = " with a non-reference type and a non-constant initialiser.

Even with your example, some styles avoid "const auto item", using either "auto item" or "const auto& item" instead, because the "const" matters when taking a reference, not so much with a copy.

But I appreciate your point applies to const variables with non-constant initialisers in general, in the language.

There was once a big deal in literature about const in C++ being the "better" alternative to how #define is commonly used with C for constant values, and it seemed applicable to the thread as a key distinction between C and C++, which the parent commenter seemed to have conflated by mistake.

But I'd forgotten about const (non-reference) variables accepting non-constant initialisers, and as I hadn't used C++ seriously in a while, and the language is always changing, I checked in with a couple of C++ tutorials before writing. Unfortunately those tutorials were misleading or too simple, as both tutoruals said nothing about "const type x = " (non-reference/pointer) being uwed in any other way than for defining compile-time constants.

It's bit embarrssing, as I read other parts of the C++ standard quite often despite not using it much these days. (I'm into compiler guts, atomics, memory models, code analysis, portability issues, etc.). Yet I had forgotten this part of the language.

So, thanks for sending me down a learning & reminder rabbit-hole and correcting my error :-)

jlokier··on F-strings for C++26 proposal [pdf]
const is different in C++ from const in C. const variables in C++ are proper compile-time constants. In C they are not (the nearest equivalents are #define and enum values).

So in C++ "const x = EXPR" would make sense to request compile-time evaluation, but in C it wouldn't.

jlokier··on Everyone knows your location: tracking myself down through in-app ads
Where I live, which is not in the USA, I'm confident my doctor's office doesn't sell their contact list - or at least, not without statistical anonymisation and aggregation for research purposes.

They probably outsource processing the data and storing it to other entities, but that will be under contracts which govern how the data may be used and handled. I assume that's not what "sell the data" means in this conversation.

It would be such an egregious violation of local data protection law to sell patient personal details for unrestricted commercial use, including their contact info, and it would make the political news where I live if they were found out.

jlokier··on Disappointed with the TVs at CES 2025
At last, thanks!

A name for that strange time I was in a room of ~15 people chaired by me, who unanimously decided that PHP should be used for the website, made by volunteers. Yet when I asked individuals afterwards, none of them had wanted PHP, and only one or two ever used PHP.

They chose it because they incorrectly thought that's what most people wanted, and they preferred to go along with their perception of group view so readily that nobody revealed their own tech preferences, despite a long discussion.

It wasn't a compromise, because that would start with people knowing each others' preferences, then compromising.

It was more like a bad default based on incorrect beliefs about each other.

The strangest part, for me, was realising that this happened despite meeting for a good hour discussing alternative options, with several professional webdevs in the group. The groupthink effect is powerful!

The effect of the group decision was not what people in the group had hoped for. Instead of producing an attractive common interest, it resulted in few volunteers, because everyone picked a tech choice they were not interested in working with themselves, assuming it would be of more interest to others.

jlokier··on Back to basics: Why we chose long-polling over websockets
To get reliable message delivery, you have to do that when using WebSockets or SSE too, because those also disconnect or time out depending on upstream network conditions outside the client's control, and will lose messages during reconnection if you don't have a sender-side retransmt queue.

However, queued messages don't have to be kept for a very long time, usually. Because every connection method suffers from this problem, you wouldn't usually architect a system with no resync or reset strategy in the client when reconnection takes so long that it isn't useful to stream every individual message since the last connection.

The client and/or server have a resync timeout, and the server's queue is limited to that timeout, plus margin for various delays.

Once there's a resync strategy implemented, it is often reasonable for rhe server to be able to force a resync early, so it can flush messages queues according to other criteria than a strict timeout. For example memory pressure or server restarts.

jlokier··on Passkey technology is elegant, but it's most definitely not usable security
I have about 1000 accounts in my password manager. 100 passkeys to replace them is not enough. I wouldn't feel comfortable with that as a hard limit, if it's to replace all passwords.

Many of those 1000 are obsolete (old accounts I'll never use again), but many are not. At least 30 are things I use every week, most of them financial or tech admin, i.e. not social media. I'm confident (though not certain) that I login to more than 100 accounts over a typical year, and there are accounts that I sometimes login to more than a year since the previous time, glad that I recorded the credential.

← PreviousPage 7 of 34Next →