korethr

Two thoughts.

The first: For the past several months, I've been feeling the effects of supply chain disruptions in my normal purchases of consumer goods. Employment and production fell through the floor while demand in various things went through the roof. From that alone, I'd say we're approaching, if not already in the early stages of not enough hands on deck.

The second: I am probably misuing the word, but for lack of knowing a better one, I'd say there is a hysteresis between policy and other inputs which shape employment and production levels, and how acutely the positive and negative effects of employment and production levels are felt by the population, and the shape of this hysteresis curve is not well understood or characterized. That is to say, economic policy could be set such that production in fact will not meet or exceed demand, but the economy will not reach that state for a while, and we'll have a period where things seem to be just fine, until all of a sudden, holy shit, they're not, what the hell happened. So when inflation has been relatively steady over the past several years, and now over the past months we find ourselves in an increasing rise, perhaps we should start paying attention now, while policy inputs that are less likely to overshoot us into deflation are still an option.

Sure, but is it not possible that a hardware acceleration, if not also proven correct, could subtly undermine an otherwise valid software implementation?

I do not assert that this is the case generally, nor particularly here -- I would be quite happy to be wrong about this. But if there's one thing I've taken from my admittedly minor study of crypto is that the most trivial of details can be critically important, and failure to get a detail exactly correct can compromise an entire algorithm and anything built thereupon.

I would love to see hardware acceleration for ed25519, just like there's been hardware acceleration for AES. It could help drive adoption of an algorithm that is less fiddly and easy to get wrong than RSA, and maybe in another 15 years, I'd be able to purchase IT equipment that supports ed25519 and not just hardware accelerated RSA and AES.

This is neat. The ever-present admonition against rolling one's own crypto lurks in the back of my mind, though. It is not my intent here to impugn Bunnie's competence, though I do wonder if he's run the design or implementation past any cryptographers to try to verify that the design or implementation are sound, and don't subtly break critical assumptions vital to the security of the algorithm.

Some ideas, based on some of the ideas kicked around in this thread: What about something like compulsory licensing?

Copyright has something like this[1]. One can acquire a license to distribute a copyrighted song in some circumstances if you pay the mandatory fee.

So how would this work with patents? First, let's cover the non-practicing entity, or NPE. Patent trolls are the most well known and hated NPEs but they're not only ones. You can have a small time inventor who's successfully invented a thing, designed and built a prototype, but hit a wall when it comes to the capital-intensive requirements of moving on to actual production. As much as I might want to stick it to patent trolls, I don't want to catch original inventors in the blast radius. So it can't be something that just punishes all NPEs, but just the parasitic subsets.

So Bob discovers novel and efficient way to frobnicate foobars, and gets a patent on it. But he never takes it to production. Let's say materials science isn't quite at the point necessary that the materials needed for the frobnicating foobar can be readily had cost-effectively at scale. So he sits on it.

Some years later, after some improvements in materials science, it's now feasible to build frobnicating foobars at scale. And Bazcorp, a company that's in the foobar business learns of Bob's patent, gets a compulsory license to manufacture it, and starts building and selling frobnicating foobars. Bob gets money for the frobnicating foobars now on the market, Bazcorp gets to sell frobnicating foobars, and people get to buy frobnicating foobars. Sounds win-win to me.

Now, how keep patent trolls from perverting this? Make it so the fee schedule for a compulsory license is lower if the entity holding the patent gets more than, say...10% of their annual revenue from license fees. Make it so the liscencing fee schedule goes lower the older the patent is. You could combine this with annual fees to renew the patent, escalating each renewal period that the invention in the patent is not being produced, making it more and more expensive to hold a patent on a thing and not be building the invention covered. Then add a multiplier upon the renewal schedule if the patent holder gets more than 10% of their revenue on patent licensing.

So Troll, Goblin & Associates, LLP, seeing the hot market for frobnicating foobars, does some research and discovers building them is covered by a patent they hold on the quux process. Said patent is 10 years old now, and has cost some coin to hold on to, so it will require quite a lot of money to turn a profit on it. So, TG&A goes to Bazcorp and demands one million dollars per unit. Bazcorp calls TG&A's bluff and files for the compulsory license of $0.10 per unit. Now, with the volume of frobnicating foobars that Bazcorp is moving, TG&A still gets a not-insignificant sum of money, but not enough to break even on the purchase of the patent and fees to renew it. Too bad, so sad, such is the risk of TG&A's non-creating, parasitic business model.

Another idea: What about something like jury duty as assistant patent examiners? The patent office could reach out and compel persons skilled in the relevant sciences to assist with patent review and be remunerated for said assistance. Then, you might actually get some qualified eyes upon patent applications that could spot prior art or obvious things and reject said bogus applications.

1. https://www.copyright.gov/circs/circ73.pdf

You're right that creative accounting games could be played to try to keep money made on the patent from being considered profit. While harder, I suspect creative accounting could be used to done to make it look like there was no revenue on e-ink screens despite millions of devices containing them had been sold.

No, we'll tell you there's a mass exodus out of Texas and California, because that's the majority of out-of-state plates on the road in the metro area. And also the majority of out-of-state plates on vehicles that have gone into the ditch or median when it snows.

Denver sucks now. Kindly find somewhere else to go, y'all have been sending my rent through the damned roof, and companies insist on paying pre-boom salaries.

A Nintendo Entertainment System has been mounted in the chassis of a toaster for the deliciously absurd aesthetic thereof.

Okay, that's just neat.

The wannabe electronic engineer in me cringes at all those wires connecting the 72-pin edge connector on the NES mobo to the 72-pin slot connector that receives the cartridge. At the signal speeds involved, any stray inductance and capacitance from such a setup probably doesn't matter. But, IMO, it would still be better to more directly connect the edge connector to the perf board, and then use the perf board itself for a shorter and more consistent wiring scheme. Or better yet, now that you know the spacing, draw up a mask and etch your own board. Such will reduce the likelihood of frustrating intermittent electrical gremlins in the future.

This sounds great from a tenant's perspective, too. I can't speak for all renters, but speaking for myself, I have have been frustrated by all the little points of friction named in this article.

However, I should not have had to go to the company's webpage, find no hint of the tenant side of this transaction, get no answer from the chat box, do some google searches, end up back at the blog, and go digging through the blog in order to find apartment.app to be the other half with all the magical UI improvements described in the OP. Afterward, of course I found the link in the footer of the company's main page.

UI suggestion. Make it easier for prospective tenants (we are your product, after all) who land on the landlord side to find the renter's side, and vice versa.

IMO, there is no greater sin in business than to leave a prospect who has learned of your prodcut/service and wishes to do business with you bereft of someone who will shut up and take his money.

A thought occurs to me just now: Why not also use that 40-60% waste heat to drive district cooling during the hot season? There's the absorption refrigeration cycle[1], which requires only a a heat input to drive the cycle to pump heat from the cold side to the hot side. Is the difference between the coefficient of performance between the more common vapor-compression cycle and the absorption cycle such that it is more cost effective to use the generated electricity to pump heat out of conditioned spaces during the hot season?

1. https://en.wikipedia.org/wiki/Absorption_refrigerator

I can't upvote this enough. I have worked IT long enough to see some impressive creativity by users to defeat security policies getting in the way of doing their jobs.

I have argued that the raison d'etre of security policy is to ensure the existence and continuity of an environment in which work can get done. I've been told about the importance of the C.I.A triad and other things as though they were refutations of my point, often in tones of voice implying an attitude that this not-security|compliance-tech-is-incapable-of-knowing-what-he's-talking-about-and-therefore-can-be-ignored. I counter-argue that C.I.A et. al. are not refutations of my thesis, but in fact support it. If you can't ensure the confidentiality, integrity, and availability of information or systems for yourself or your customers, you do not, and/or will not, have an environment in which work can get done.

So, for the love of getting shit done, stop masturbating with broad and blind application of checklists, and take the time to sit down, really look at what you're trying to do and why, and develop actually useful risk models. And then develop security policies against those risk models. Yes checklists and various standards are useful tools that can help you cover a lot of common stuff, but are not the whole picture.

Why not try to combine it with some right-to-repair-friendly stuff? If, after the cessation of support, you release any and all source code and documentation needed for any person competent in the relevant sciences and arts to maintain the device and repair any CVEs, you're off the hook for liability.

I had played around with the idea of requiring support for 3/5/7/10/whatever years after the cessation of sale, kind of like how car manufacturers are required to offer parts support for 10 years after sale, but I can see that causing enough overhead that many tech devices simply would never get made.

Snail mail can be a hassle, but on the flip side, with snail mail, you can send in the request via certified mail with a requested return receipt. This creates a legal record of when they received your request. Thus, if they don't act on it in a timely fashion, you can prove it. It is only tangentially related, but in Patio11's article on handling bogus entries on one's credit report[1], there's this wonderful line: 'I was sending “certified mail, return receipt requested”, which is Dangerous Professional for “Do you like paper trails? I like paper trails. I particularly like paper trails where the United States Federal Government attests to the exact minute your firm learned the contents of this letter.”' While not quite the same situation, I suspect such admissible-in-court-as-evidence[2] traceability of communication is of equal use here.

1. https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

2. This is my intuition talking here -- I am not a lawyer. If you have legal questions, talk to one. But, IMO it would be utterly bizarre if USPS record of when a specific piece of mail was received were not admissible as proof of claiming that company got your request.

Just reading that, my skin crawls and I can feel the nucleation of an icy fear in the back of my mind. Not just no, but Hell Fucking No.

I argue that those genuinely arguing for such a system fail to realize just how quickly it can and will be weaponized against themselves.

> https://twitter.com/yorecomputer/status/1408482184089026567

Ahh, the contrast between the box art and what's implied by the marketing copy, and the actual gameplay screenshots.

ISTR that in the mid-90s, there was this notion that with games finally becoming truly 3d on 5th-gen videogame consoles, they'd be realistic enough to match the cover art, and that would be the end of that eternally recurring disappointment. Well, come 5th- and 6th-gen systems, the disappointment of the contrast between the cover art and the actual gameplay footage was then replaced by the contrast between the FMV and regular gameplay footage.

No real point to that mini-rant, just the image above reminded me of its base complaint.

> https://twitter.com/robmanuel/status/1110143735860523009/pho...

I know these are made up titles, crafted with a light streak of smart-ass, but I actually want to play some of them, "The Final Cut: A Pink Floyd Text Adventure"? "Revenge of Rubic's Tetrahedron? I'm also midly curious what the difference in system reqs is between "Night Simulator" and "Advanced Night Simulator".

> The CPU and RAM in those machines were just incredibly slow by today's standards.

I have a few questions, interspersed with my musings on them.

Based on an initial misreading of the above as the RAM being slow, I mistook your statement to mean that memory latency on a similar order to today's computers was something that you had to fight with. Was it memory latency per-se that made achieving sufficient performance hard?

Per the article, the system had EDO memory, which I discover can deliver a word read in 3 cycles for the first word of a page, and two cycles for subsequent words in the same page -- or 1 cycle for all if it is fast enough. I don't know the details of a MIPS memory access cycle, but by comparison, the 68k takes at least 4 clock cycles to pull a word off the bus. Thus, ISTM that EDO memory could keep a 68k fully supplied with data without resorting to wait states. I would hope that a MIPS processor, being a more modern design, could pull a word off the bus in a singe clock cycle, but on the other hand, I could see Sony possibly using cheaper chips with a tRAC slower than the CPUs clock period to save money.

Or, was the issue less so memory latency per-se, and more a bus utilization problem? In the article, I see that the DMA controller leaves the CPU idle while other devices are using the bus unless the CPU is making use of the scratchpad.

Re-reading your statement, that the CPU and RAM were just slow in general compared to today, I find myself wondering, how did the power of your development workstations compare to the PS1? Were you guys using high-end workstations like NeXT or SGIs, or common PCs of the era, since per the article, the SDK and development board targeted Windows 3.1 and 95?

One can get cycle-accurate hardware emulations of 2nd (Atari), 3rd (NES) and 4th Generations (Genesis) video game consoles for FPGAs now days. I assume this is because the systems are quite simple by today's standards, even in their graphics ASICs, and even the less-simple bits have been around long enough that there's been plenty of opportunity for in-depth study.

Is something like that feasible for 5th Gen systems like the Playstation or have we crossed a threshold of complexity where if you want cycle accurate hardware, it's time to pony up the money to license the IC data from Sony and to have custom chips manufactured?

I'm mildly surprised cookie consent banners are only at 20%, given how often I come across banners who's only option is "Yes, I consent"

> I am seeing this, too. Oftentimes, ostensibly in the interest of protecting children from harm, we try to control their behavior with increasingly disproportionate ultimatums, to the point where the authority's response is vastly more harmful than the situation itself.

And IMO, perversely, this incentivizes behavior problems. Kids sooner or later (and often sooner in the case of smarter kids) catch onto when adults are making disproportionate ultimatums, or when the reasoning behind a ruling is disconnected from objective reality. What does this teach a kid? Adults are liars, don't know what they're talking about, are undeserving of respect, are not to be obeyed if the consequences of such are bearable, are to be subverted whenever possible, etc.

I mean, there's going to be a degree of disrespect and disobedience when a kid enters adolescence and they start to try to assert their independence as they approach adulthood. But learning the above attitude as a child is going to make adolescent behavior so much worse.

I don't think the phrase you quote is intended as a dismissal of the data. It comes across as an acknowledgement of the data's limitations, and a caution about what kind of conclusions can be drawn. During my statistics course in college, one of the first sections of the course covered sampling, and the various ways sampling can be done badly, thereby biasing the sample, and thereby leading to conclusions about the sampled population that don't reflect the reality of that population.

Cautioning against that failure mode strikes me as intellectually honest, not anti-science.

Oh absolutely. The collapse in the market for office real-estate would have to get particularly bad for the owners of those properties go for that option. The owners of these properties are in the business to make money. If nobody wants their property for offices anymore, they will have to find some new use for their property that they can profit from. The condos/studios/lofts/whatever resulting from a conversion would indeed need to command high rates to make such a conversion worth it. Like I said, the housing created by such an option would be an expensive luxury probably only affordable by the upper-middle and upper classes.

However, given the (IMO probable) positive effects for less-than-rich, I would not protest such an outcome.

If there is a collapse in the market for office real estate, given the shortage of housing in various US markets, I would not be sad if some of these large office buildings were converted to mixed residential & commercial use. Yeah, being able to live in the same building as where you work and just take elevator or stairs to your employer's office would be an expensive luxury option that probably only upper-middle and upper classes could afford. But, it would take some pressure off less fancy housing options like regular apartments, duplexes, and single-family houses. It wouldn't address the problem of investment corps snatching up any and all residential real-estate they can in the face of other fiscal policies. But, when in your local market, a 1500 sq ft 1960s construction house with little-to-no insulation, yard filled with sun-scorched weeds, and in need of 10s of thousands of dollars repairs to the building envelope goes for half a million dollars cash sight unseen in less than a week after it goes on the market, any policy change that improves the supply and demand equilibrium helps those who just want to live in the available housing supply.

> On the oscilloscope, I assume the front and back porch is clearly visible on the left and right hand side.

Not quite.

The front porch is actually the black level on the right hand side (I know, this confused me at first, too), at the end of the line, when the signal drops back to the black level. The sync pulse is the lower-than-black bit in the middle. The back porch is the portion thereafter, containing the fuzzy bit. Collectively these are called the horizontal blanking interval.

The fuzzy bit is the color burst. Color TV was a hack on the original B&W design. To put color information into the signal without making a whole new signal that existing sets couldn't decode, the color information is ̶p̶h̶a̶s̶e̶-̶m̶o̶d̶u̶l̶a̶t̶e̶d̶ quadrature-modulated upon the luma signal. You need a phase reference to decode that information, and that's what the color burst is there for. If this were a color demo, rather than the nice, neat square waves, we'd see the rest of the signal line looking similarly fuzzy. Wikipedia has a nice diagram[1].

Why is the sync pulse below the black level? Well, consider the original B&W signal. The brightness of any portion of the picture was controlled by how strong the cathode was emitting when it swept across that portion of the screen. The intensity of the picture tube's cathode is controlled directly by voltage level of the video signal[2] during the active display period (the portion of the line not part of the horizontal blanking interval). So great, we've come to the end of a line, shut off the cathode after it has swept one line across the display tube, and need to reposition it to sweep another line. Why can't we just keep the signal at the black level instead of dipping below black? Well, analog signals and circuits can be kinda fiddly. Components drift or go bad. People think they know better than the warning of no user-serviceable parts. So it's entirely possible that due to a bad or misconfigured circuit, the cathode could actually not be quite off when fed a signal at the black level. In one of those cases, if the cathode were still on during retrace, the user would see slanting lines drawn across the picture, and might rightly get annoyed at this. So, to ensure that, no really, the cathode is actually off for reals during retrace, the signal is pulled below the black level so there will be no retrace lines drawn on the picture on any sets where the brightness levels are iffy for whatever reason.[3]

1. https://en.wikipedia.org/wiki/Analog_television#Structure_of....

2. You could demonstrate this by raising/lowering the level of the square wave from/to the black/white level on the signal in this demo, and get a neat gradient effect.

3. On some sets, you actually can still force the cathode on during retrace and see the retrace lines by cranking the brightness all the way up. Probably not the best thing for the life of the tube, though.

Edit: update with corrections in anyfoo's reply, below. Also added the link to the Wikipedia diagram I had originally intended to include.

More Edit: Added an explanation of why the sync pulse is below the black level (blacker-than-black), because even though parent didn't ask, I'm pretty sure someone else is wondering (I know I used to).

Somewhat off topic from the main thread of the article, but I have always wondered about the multiple privilege levels. What's the expected/intended use for them? The only thing I think of is separating out hardware drivers (assuming ring 1 can still directly read/write I/O ports or memory addresses mapped to hardware) so they can't crash the kernel should the drivers or hardware turn out to be faulty. But I don't think I've ever heard of such a design being used in practice. It seems everyone throws their driver code into ring 0 with the rest of the kernel, and if the driver or hardware faults and takes the kernel with it, too bad, so sad. Ground R̅E̅S̅E̅T̅ and start over.

What I find myself wondering is why? It seems like a good idea on paper, at least. Is it just a hangover from other CPU architectures that only had privileged/unprivileged modes, and programmers just ended up sticking with what they were already familiar and comfortable with? Was there some painful gotcha about multiple privilege modes that made them impractical to use, like the time overhead of switching privilege levels made it impossible to meet some hardware deadline? Silicon-level bugs? Something else?

I'd guess it's because the majority of corporate IT actually is not as secure as most companies think. In my own professional experience, and conversing with peers and friends who work infosec, the security profile of most companies is a hard exterior shell, with a deliciously juicy squishy center. These companies might think they're super secure. After all, they just bought a fancy new Data-loss-prevention appliance, and just passed a SOC2 audit, so this means they're secure, right? Nevermind that this expensive appliance is effecively MITM-ing all TLS within the company, and is running an unsupported version of Tomcat for its web-UI that must be on a publicly reachable IP in order for the service to work. Nevermind that mid-level IT were ordered to not mention to the auditor the different ways various security controls could be trivially bypassed by a high school student, not if they wanted to keep their jobs. Nevermind that Sales throws an absolute fit to the CEO every time IT tries to remove their exception to the password complexity requirements, forcing them to use a different password than incrementing the number at the end of "P@ssword57". Nevermind that IT was told to stop trying to set up network ACLs in Azure because restricting traffic between network segments is interfering with Dev's delivery velocity. I could keep going forever with examples from my own career or synthesized from my peer's war stories.

But with a hard shell and squishy center security posture, all it takes is one security event, and you're pwned. All it takes is one salesman to click on a phishing email, one data entry drone to get hit by a drive-by ad while watching YouTube during lunch break, one Internet-facing server to miss a security patch, etc. Once with a foothold, these ransomware gangs move with speed and thoroughness that comes of lots of practice. Depending on the size of the enterprise, and how well it is or is not segmented, compromise can spread from patient zero in days, if not hours.

It's not all doom and gloom. Seeing these events happen, or having the near-death experience of surviving a ransomware attack is (at least temporarily) lighting a fire under companies' asses to get their shit together, and start keeping their support contracts current. Detection and response tools are getting better. I know of a managed EDR solution that kills all connections except the control connection back to their security center and clears out the routing table so no new connections can be made. Then they call you.

But for every company that is taking steps to secure themselves against the current threat landscape, there are plenty more that are failing to do so, whether out of naivety or complacence.

This is a phenomenon that happens in real-world analog signals, too. In this Xiph.org video in which Monty explains various bit about analog and digital signals[1], in a section starting at 17:20, he demonstrates how the Gibbs phenomenon happens in band-limited signals.

1. https://www.xiph.org/video/vid2.shtml

> You definitely do not warp around willy-nilly unless you want a planet full of photon missiles and quasar cannons dropped on your head.

Oh, god. Don't remind me. I'm there, happily minding my own business, trading between ports in adjacent systems, and in warps a volcanic class planet with a level 6 citadel. Fucking death stars.

You wanna blast me, a hapless newb who stumbled into your territory, out of the sky, fine. But running the interdictor generator is just being mean about it. :P

Well, this a nostalgic article for me.

I first started dialing into bulletin boards as a tween, on a 386 (and later a 486) cobbled together from bits scrounged from garage sales and the e-waste from the various businesses of my parent's friends or friends of friends. I eventually came into an 8-bit ISA modem, and upon recognizing what it was, added it into my computer, and snuck a telephone cable from an open jack into my room. I found the BBS listings in a local computer magazine and and started dialing out, exploring my area code. To be honest, I don't recall how I got the terminal program I initially used; I just recall that it was bare-bones and kinda janky. As a kid, you bet your sweet ass I went straight for the games section if there was one. And there I discovered TW:2002 and Legend Of the Red Dragon.

The sysop of one of the boards I dialed into noticed I was connecting at 2400bps at a time when 28.8k and 33.6 were commonplace. He pulled me into sysop chat to ask what was up and I explained my situation with my computer being cobbled together from scrap. He offered to send me a newer modem as well as some terminal software that didn't suck, and so I gave him my mailing address. I don't recall if I got my parents' permission to do so. In either case, a week or so later package showed up in the mail with a 16-bit ISA 14.4k modem and a floppy disk with a terminal program that indeed didn't suck. And with connection speeds that didn't cause a full screen of ANSI art take minutes to load, line by painful line, TradeWars became much more playable.

I logged many hours in TW:2002 through middle school and early high school. The holy grail I heard about, but initially couldn't play, were those really fancy BBSes that had multiple lines and the latest version that let you play against other players at the same time. Those were fancier operations where you had to pay monies for your dial-in time, which was not a particularly feasible thing when you're not even old enough to have a job, much less a bank account. It until wasn't towards the end of high school when I found a few sites offering connections over telnet that I got to experience multi-player play. And promptly learned just how bad of a player I'd been all that time.

A back-burnered project still intend to get to is to set up a retro system to run a multi-line (or maybe even network connected!) BBS, with all the various classic games of that era, including TW:2002.

On that first example, "prepone" might not officially be a word, yet, but I encourage them to keep at it. Its construction follows the same structure as its intended antonym, even back to the etymology of "postpone". Unlike some of my English teachers in elementary school, the lexicographers at Oxford are not a bunch of solely prescriptivist assholes. Get the word into common enough usage that there are multiple sources for the editors of the OED to cite, and you just might get "prepone" added to the next edition. The story about an argument with Tolkien over the correct spelling of the plural of "dwarf" notwithstanding, I think included-in-the-Oxford is a standard few can argue with for an English word being officially real.

When Chrome was new and shiny, I used it for a time. Then, the first time I found myself needing to kill Chrome because it was completely locked up, I found myself staring at a wall of chrome processes in the task list, not knowing which one I needed to kill. At the time, I thought the idea of a separate process for each tab was silly. Though, with Firefox moving towards this model, I guess the engineers at Google were prescient in the correctness of that tradeoff.

I do use a lot of tabs, so I fear I'm going to find myself facing the same problem I faced with Chrome: a site misbehaves and locks things up, crap, which process do I kill? A way of tracking which tab maps to which process would be nice, so the next time I trip over a badly-coded page, I don't have to kill everything just to get my browser to respond again. Lazyweb question to y'all: is there a feature in Chrome or Firefox that can do this (mapping tab/page -> process), or have I just stumbled upon a side-project idea?