lazaroclapp

Suppose that you are, say, a security researcher, running purely static analysis tools on the code from every git repo that you can crawl, specifically looking for malware or common bugs without running the code (simple example: you are grep-ing for AWS keys and other secrets that should never be committed to a repo). This would be unexpected and very dangerous behavior in that setting.

Sure, in theory, "unexpected and dangerous behavior" is par the course for security research and you isolate even data that you don't intend to execute if you suspect it is malicious. But, in practice, this is an easy mistake to make.

As another example, consider an automatic git mirror, or whatever the internal GitHub/GitLab/Bitbucket infra might do to move repos around, without intending to execute the code.

Depends where you live. California law renders those clauses null as long as the IP is generated outside of work, without use of employer equipment, facilities, internal knowledge or other IP already belonging to the employer. There are some potential issues if the side work "relates to the employer's business", so running any specific plan through a real lawyer is a good idea at some point. But, as far as I have heard, doing this is not uncommon when the side-project does not compete with the employer in any way.

IANAL. For specifics, see § 2870: https://leginfo.legislature.ca.gov/faces/codes_displaySectio...

Presumably some other jurisdictions have similar laws, and that is a factor in your job search if you are planning to work on anything on the side: pick a location with laws that allow this. Failing that, you can negotiate to retain IP on existing side-projects when you join a company, as an amendment to your contract.

As We May Think[1], anyone? Or self-driving cars, which go back to at least 1984 in CMU, and yet are still "[near] future tech" now. Neural Nets were a half-century old idea[2] before they became actually useful...

I mean, the question is not "Is Bitcoin as implemented by following the original whitepaper going to be the future of mankind?" It is whether or not there is something big in that whole area (blockchains, decentralized tokens of exchange, PoW/PoS/etc) and, if so, how big?

Of course, for a lot of people, the question is "By, say 2025, is my BTC going to make me rich or is it is not even going to be worth the bits it is encoded in?" Equally hard question to answer, but much less interesting.

The current cycle of blockchain furor could all end up badly (I hope it doesn't, but who knows), and yet that won't mean the tech has no future. Now, it could be like VR/AR/AGI, which are always the future, of course ;)

[1] https://www.theatlantic.com/magazine/archive/1945/07/as-we-m...

[2] McCulloch, Warren; Walter Pitts (1943). "A Logical Calculus of Ideas Immanent in Nervous Activity". Bulletin of Mathematical Biophysics

Sure, but it sometimes is useful to remember that those fictions are indeed fictions, and can be changed. Doesn't mean they are not useful fictions. Doesn't mean they should be changed. Saying they are meaningless because they are fictions is, of course, absurd. Civilization is built pretty much exclusively of useful fictions. But is good to remember we can change the set of fictions we collectively believe in.

Think about rights and legal codes. When the law supposedly comes from god, like it did in many ancient societies, it makes no sense to ask whether it is just or unjust, as it can't be changed except by an act of god. When you recognize that law is human made, that doesn't mean it holds no power, but it means humans can change it, and unjust laws can be repealed when enough humans agree they are unjust. So is with nationality. Is not a fact of nature, is a distinction we agree on because it serves a purpose. Is that purpose necessary? Is it just? Is there a viable path towards changing it? Maybe, maybe not. But acknowledging it is made up allows us to at least ask those questions.

Unfortunately, I don't believe they were.

> If the government is worried about trojans, malware, etc., then they can easily hire an auditor to audit the code and vouch for its authenticity.

Not that I disagree with the general idea of democratizing this sort of big government contract, but, well, this is a much bigger hurdle than you are making it sound like. Audits can be good at finding unintentional flaws, but a skilled adversary can often create code that looks safe, but in fact, isn't. Consider the underhanded C contest: http://www.underhanded-c.org/

On a personal note: I once worked on a large research project for detecting malicious behavior on Android apps, where the idea was to produce tooling to find underhanded/undocumented behavior automatically. The project had a red team. By the final rounds, we were getting code from them where the malicious functionality was extremely hard to find via either tooling or manual inspection. Keep in mind these were simple programs, rarely over 10k lines of code, written in Java which is a remarkably transparent language to read, and that we were allowed to ban features like reflection or raise the alarm on anything that looked like intentionally obfuscated code. Additionally, we knew each of those programs had malware in them. Reporting 'clean' was often just saying 'you win, we give up, couldn't find it after staring at this 2k lines file for a week'.

In theory, when working with a large contractor, you can put controls on how the software is built, not just the final code, and you can hold them accountable for backdoors discovered long after the fact. Now, not saying this always works that way, but it might still be better than accepting a system built by someone you only know from their Github handle and who might or might not live within your jurisdiction. The state of the art in software verification would need to change a great deal before that is a good idea.

> Annotations are just metadata, and managing semantics of that metadata is pushed to the programmer: to configure a static analyzer to act on them, to figure out the differences between different backends, make sure it's enabled in the build, write/install IDE plugins, etc.

Sure, but keep in mind switching to a new language also entails a huge investment in tooling. There is definitely a higher cost in switching your build infrastructure, tools and IDE plugins to support a new language (nevermind porting an existing codebase) than the few configuration lines it takes to add an annotation processor. At a certain scale, the tools you need might not have even been built for Kotlin, while they have existed for years for Java.

> For many people, this has already happened with Java.

Yes. And, for many others, it hasn't.

Look, I am not arguing that we should all be writing Java until the heat-death of the universe. Whether it is Kotlin or not, I am sure better ways to do things will pop up. But there are good reasons to start even many kinds of new projects in Java today: maturity/efficiency of the compiler, tooling support (including static analyzers, since nullability type systems are not the only feature you'd ever want to bolt onto a language), etc. Over time those reasons will be less, but even then, existing Java codebases will remain, and it will still be worth making them safer. Is not like C, C++ or even Fortran codebases are not around anymore.

Note that at least one of the features described, (static) Null-Safety, can be achieved in Java via annotation processors. For example, by a tool such as NullAway (https://github.com/uber/NullAway). Yes, adding '@Nullable' is more verbose than '?' (thus is the Java way :) ). But there are plenty of projects were it still makes sense to use Java over Kotlin. This is particularly true for existing codebases, where adding annotations is certainly easier than rewriting everything in a different language.

Disclaimer: I am a contributor to NullAway. There are plenty of other nullability static analysis tools for Java worth considering (Checker Framework, Eradicate, etc). NullAway's main strengths are a focus on performance and the idea that you should be able to use it as part of every (local) build of your code.

In all fairness, at scale. it takes one incompetent recruiter out of literally hundreds, or one badly managed case from an otherwise very competent recruiter, out of thousands a day, to get something like this to happen. Any large enough system will have component-level faults.

Sure, it is Facebook, they know how to build systems that are tolerant to faulty components. If they cared about preventing this, they could send resumes to multiple recruiters and proceed based on some sort of consensus. But that's the kicker, turns out their recruitment organization is already a fault tolerant system. The particular fault tolerance mode here is that they don't care about a certain rate of false negatives, no matter how egregious in hindsight, as long as they have few false positives. Sucks at a human level, but in some ways it probably is the optimal system based on what the objective function is for a large company.

The fun thing there is that other than photovoltaics, maybe (I don't personally understand them well enough to say for sure), the other two alternatives you are mentioning are also "nuclear -> heat -> mechanical force -> electricity" chains :)

Is just that some of the infrastructure is pre-existing.

Not completely untrue. But if the model is a paid subscription the same pressures apply: doesn't matter why the user keeps paying their subscription, so long as they pay. Incentives are almost never perfectly aligned between information providers and information consumers. .

Guess the point is: All else being equal, someone with a relevant degree will have an easier time being a successful entrepreneur (and, not less important: a reasonable backup plan) than someone fresh out of high school. Likely they will have a better network too. And this is all assuming that entrepreneurship is really the goal, which, lets face it, for most people is an unreasonable trade-off of safety, personal time, health and comfort for nebulous "freedom" and a very unlikely chance at striking gold.

Sounds like a post-scarcity utopia to me, depending on how large the set of "all businesses" is and what we do with the surplus in production :)

Would be willing to bet you less than 1% of Amazon shoppers worldwide know who Jeff Bezos is...

I mean, China is not small either. In terms of doable, there is still a higher density of wealth per square mile in the U.S., even if the population density is less. But at any rate, you don't need to have the entire country be one high speed rail system. You could connect the West Coast from San Diego to Seattle, including L.A., S.F. and Las Vegas. You could do the same for the East coast. And you could have a Houston, Dallas, Austin circuit, among others. No need to do S.F. to NYC for passenger transport.

Others are giving better replies to this than I can. I will just note two things:

1) This is a particular case where making immigration difficult to the people involved directly results in less jobs for Americans, as observed above. Yet that's still what is being done. It is clear from it that, for some people, the desire to reduce immigration is not just related to job security. This doesn't mean there aren't legitimate concerns, just that it doesn't seem to me that the explicit legitimate concerns are the only issue here.

2) The particular cohort of H1-B developers I am more familiar with compete with American grads for equal jobs and equal salary/RSUs, and are nobody's 'cheaper replacement'. Now, I am not saying that what you describe doesn't happen. But you know what would help there? Making it easier for people in H1-B's to change employers or even stay unemployed (even on their own money, without benefits) for a few months in the U.S. searching for a job if their employer is exploitative!

There is a sort of issue 2.1. here that I will acknowledge: yes, having more skilled people come in increases supply and lowers prices for labor, slightly. But most of the jobs in question are at companies that target a global market, this means not making use of a global labor pool is both ideologically suspect and a bad long term plan. Talented people in other places will still compete with you, and now you don't even get their taxes or the effect their talent creates in the available job opportunities in your area. If, say, you keep all the Amazon jobs for Americans but end up buying all your stuff from Alibaba the world over, was that a good outcome for you?

> Are we really extracting from a talent pool of 7 billion?

No. Or rather we are doing it badly. But we don't do any better if we geographically segregate people who otherwise might want to work together. It is an orthogonal (albeit incredibly important) problem. As I said, all of our countries should be investing more in education, in addition to having humane and sensible immigration policies and a reasonable social safety net. But in any case, there are more skilled people in the whole world right now than in the U.S. alone, by construction...

The U.S. should be doing their very best to have the strongest possible education system for all its citizens (and non-citizens living in the country long term). As should any reasonable country. But the fact remains that, unless you are counting with excellent execution in that regard from the U.S. and abysmal negligence from the rest of the world, you simply can't extract the same talent from a population of 400 million than from one of 7 billion. The U.S. benefits enormously from immigration, in ways many don't even perceive. If the flow of minds into the country is ever truly stopped, no amount of improvement in the internal education pipeline will be enough to maintain the U.S. dominant position in science and technology.

Now, you might be ok with a broader geographical distribution of this type of talent, or argue that it will happen eventually no matter what. I hear you, on both counts. But, as a non-U.S. citizen, I am actually pretty surprised that the country would chose to forgo the advantage it enjoys by being a preferred immigration destination for so many skilled people...

It also seems to be done due to nothing but rank xenophobia. I mean, what is the excuse here? "They are stealing our jobs!"? This is literally a visa where the requirement is to create jobs for American citizens, and most of these tech firms will do so by exporting goods mostly to foreign markets (the market for most tech startups is not over 50% local to the U.S.) and/or creating local technology and expertise. Hell, once profitable, you can and should tax these companies to help provide for that very same education you want for American citizens! As well as UBI for those whose jobs are being displaced by automation. Startup visas are as win-win as it possibly gets.

Final point: The party and particular administration that seems to be most against immigration also seems to be the one most against science or robust public education. The foreseeable end result is grim, even if these policies last only 4 years: a "lost half-decade" in which the best domestic talent is under-nourished and the best foreign talent goes elsewhere.

To be fair, naively and given the use case you described, that sounds to me like in this particular instance they are trying to ensure that the encryption being used is "secure enough" for the govt. rather than "not too secure". It just so happens that the bureaucracy's definition of "secure enough" is a keyword whitelist that happens to have 'RSA' there and not 'PGP'.

I am not sure "it seems like no one else could have done it" applies to Nobel Prize type discoveries or Moon Landing like feats of engineering, much less to software companies.

Don't get me wrong, I don't mean to say that many employees at companies like Google are not brilliant or not extremely effective in their work, but "no one else could have done it" is a useless test that relies on mythologizing people. The way I figure out, the people getting rich (as employees) are those that: a) took the risk to get in early enough, b) performed their jobs competently enough to stay long term and to give the company a chance to succeed, c) got lucky enough in that all the imponderable external factors also resulted in that particular company succeeding. That doesn't mean they weren't "instrumental", in the sense of being the people who actually happened to get the work done. But that's different from "irreplaceable".

With the caveat that for anyone actually looking for a nuanced article, that headline is far more likely to cause them to dismiss it than to click through. But I suppose there will always be other information sources targeting that demographic, with titles along the lines of "Emergent incentive structures for labor participation of middle class teens in labor over-supplied developed economies"[1], or something of the sort.

[1] Entirely fictitious title, was too millennial and lazy to find a proper article studying this ;)

Working on border security because you want to keep armed groups out is perfectly reasonable and admirable, working on border security because you want to keep poor and terrified people fleeing armed groups out is pretty detestable. Unfortunately, I don't believe the current U.S. administration makes that distinction (and it is very arguable whether the U.S. military abroad, or even the U.N. peace-keepers do, but that's another story).

When the institutional reaction to a reporter fleeing death threats from agents of his government, by voluntarily surrendering at your border and asking for asylum, is to lock him up, then I can see reasons to criticize those working to empower said institutions (https://www.washingtonpost.com/news/worldviews/wp/2017/04/07...).

That's a valid point, I think, but I am not sure the line is as clear as you make it out to be. What is your definition of 'directly' here? I can think of ways in which e.g. hunting endangered species, owning weapons or eating meat affect others. Note that, of those: I revile one, I am undecided on one and I personally do another, but in all three cases I can think of ways they affect me when others do each of those things. Sure, they affect me in a way that is perhaps different than being the target of murder or slavery would, I'll definitely agree with you on that. But it is a leap from there to saying that those are matters society should not be involved in.

Consider nuclear proliferation: in theory it does not affect people 'directly', until it does (note that any logic about increased potential risk applies to gun ownership too, at a different scale). Now consider pollution: affects people directly, but in a diffuse degree. Vaccinations? (I was born in a country where a specific set of those are mandatory, I approve of that [1]). There is a limit to how much a man is an island.

I am a firm believer in having a right to privacy; a strong, fundamental, constitutional right. I would consider forms of deflection or civil disobedience in a society that aligned itself too strongly against that right. But that doesn't mean is not ultimately a matter of societal values of societal construction.

[1] Obviously they are mandatory to those with a healthy immune system who can be vaccinated, and a number of other caveats, but still, the state makes it its business whether or not you vaccinate your kids, and we are better off for it...

Hell, a few countries will provide tuition free education for foreign nationals too. The challenge is that Americans interested in that will have to prepare the corresponding entrance exams instead or in addition to SATs and have sufficient language proficiency.

I knew students back in Mexico preparing for their Abitur exams for Germany at the end of high school (in all fairness, they were coming from bilingual private high school, which is a extreme luxury in Mexico, but still way below what college tuition in the U.S. looks like at most research universities...).

But there are things we do ban other people from doing (e.g. murder or owning slaves, to pick uncontroversial examples). There are some principles that are personal, but also some that are agreed on collectively, as a society or civilization.

Of course, then nobody "leaves us alone" on these things, but we agree by majority on first principles and then argue from those to collectively decide what is allowed and what isn't (i.e. allowed from the people and allowed from the government). Free speech and privacy are examples of such principles. So you can definitely have a social contract where mass surveillance is unacceptable, but rules on not hunting endangered species or owning certain type of weapons can exist[1]. I don't think May should be prevented from arguing for surveillance, but by the same token, people also have a right to oppose her on it.

Yes, this opens us to the possibility of losing the debate on encryption, at particular times and historical periods. Whereas having the iron clad rule that all can do as they please does not. But the later rule, applied in extremis, makes civilization impossible. Because again, we do want to ban people from doing certain things, that is what civilization means. The point that we need to argue is that banning people from having privacy causes more harm to what makes us human than a few horrific crimes do.

The anarchist posture is... complex. But the (absolute) libertarian posture is hypocritical. It wants a very particular set of rules to apply and be enforced by the state (e.g. private property), whereas decrying rules and state enforcement in general.

[1] And U.S. gun-owning folks agree on having rules against owning some kinds of weapons, I would think. At the very least I have never heard one argue for their god given right to own an ICBM on 2nd amendment grounds... is just that we disagree on the type of weapons that should be controlled.

You could eventually make UBI a constitutional right. At that point the government controls it in the way they 'control' your right to free speech or to life. In material terms government coercion could deprive you of either, but it would be considered extremely illegitimate for the government to do it. If you want a 'positive right' example, in most countries the government would be considered to be failing its duties if it failed to provide free elementary public education for all citizens, and the logistics of that are more complicated to both provide and verify than a simple cash transfer.

I see it going in much the same way current governments in stable countries don't suddenly show up at your door saying you owe them 95% in tax. Refusing or delaying to pay your UBI would amount to that, an illegal tax.

Cloud isn't less secure than on-prem if you are your average software startup or non-tech company, which, for many reasons, is unlikely to go all out on on-prem security. Commodity cloud should be less secure than on-prem, if you are fucking Booz Allen...

> Do you have any evidence such a market exists?

Yes. I have evidence there is a market for this, consisting of 1 or more persons, willing to pay at least $0.00.

Not every OS needs a 1-2 billion users install base.

Well, it is technically possible he is at the national average income (not the median wage) and lives in a place where rent is way more affordable than the cities most of HN lives in. U.S. GDP per capita is $55,836.79. That is $44,558 after taxes in Knoxville, TN (I am picking a city, but it could be more extreme, he could work remotely from a rural area in the U.S. or from, say, Belize). This means 25% towards rent is $1163. So, in Knoxville, Zillow says that is a 3 bedroom home.

More realistically, that same amount is a small studio in e.g. Austin, TX.

Now, the trick is that the average income might be $55,836.79, but the median personal income is ~$41,520 [1]

[1] https://en.wikipedia.org/wiki/Personal_income_in_the_United_...

That the wealth of a more educated society compounds, likely in super-additive fashion. Basically, the idea is that a society full of educated people is wealthier as a whole and thus in your own interest. In the short term, it is easier to be well off if people around you are well off than if not (e.g. is way easier to be an entrepreneur or to find a well paying job if you are surrounded by other educated people). In the long term, your society gets richer and, since countries that have public education also have things like public healthcare and social security, a richer country is also very directly in your benefit when you are nearing retirement.

Note that the U.S. already buys this argument when it comes to primary and secondary education. It only seems to mostly ignore it when it comes to the university or trade school level.

The U.S. gets by without public higher education, but that might be in significant part for two reasons: accumulated private wealth in a large middle class that got rich from globalization with one of the few intact industrial bases in the post-war environment (now dwindling), immigration of educated workers from all over the world (brain drain from other countries).

Also, note that many countries with public higher education see it as a system where each individual "pays it forward" for the education of the next generation, at a moment in their lives where they have significant more economic safety than they would in their late teens. Simply put: "I'll pay for the education of the next generation, because the previous generation paid for mine". This is something which the U.S. does within families anyways, but some other countries do collectively, resulting, again, in compounded gains from a more educated society and cheaper education costs due to collective bargaining. Things like fancy dorms and millionaire school administrators are hard to justify when they are paid out of the paystub of your average nurse and construction worker...

Don't get me wrong, I did my undergrad in a (developing) country with public higher education and my graduate studies in the U.S. (on school support). There are definitely benefits to the U.S. system if you have the money or are in the top percentile for talent/luck. But overall, for the majority, the lack of a strong free public education option is a huge disadvantage, it seems to me, even after six years here, that this is one of those things where the U.S. does well despite of it, rather than because of it. Like private healthcare and lack of public transportation.