lcampbell

> Bread takes about 10 minutes

I've been using the newbie friendly NYT no knead bread[1] for years, and it's that easy. The only gotcha is that you have to prepare it the night before, but that isn't really a big deal in practice. Bread is surprisingly difficult to ruin, and fresh daily bread has been a huge boon for me in these new WFH times.

I highly recommend it.

[1] https://cooking.nytimes.com/recipes/11376-no-knead-bread

I've always thought of PDF as an opaque format. How do you search and/or browse your collection? Does the subject show up in grep [e: without being diligent with filenames]?

Eh, I've been running FreeBSD on my primary desktop for about a decade now (and have been running it on every server I can get my grubby hands on). It's equally painful for me to use any other OS because of similar workflow issues. We've all got a wide variety of tasks to complete and a good handful of specialized tools to complete them with -- use whatever works best. If you're doing server work, I recommend giving FreeBSD a trial run!

This sounded interesting and I had trouble looking up the details. For others, the Voter Action site is available on archive.org[1] and from there the court deposition for the Lopategui v. Vigil-Giron case and several other documents are available.

Searching for the aforementioned case turned up another case wherein Vigil-Giron (the NM secretary of state at the time?) and several others were indited for additional shenanigans[2].

--

[1] https://web.archive.org/web/20140831100709/http://voteractio...

[2] https://www.abqjournal.com/14230/updated-ex-secretary-of-sta...

Just pulled up their filings[1], and I'm almost certainly misreading it, but in Q3 2017:

  NA Retail Revenue: $25,446M
  NA Retail Profit:  $   112M
  AWS Revenue:       $ 4,584M
  AWS Profit:        $ 1,171M

Pedantically, it seems like AWS is not Amazon's primary source of revenue, but is the primary source of profit.

--

[1] https://www.sec.gov/Archives/edgar/data/1018724/000101872417...

I can't speak for GP, but I switched to Hacker's Keyboard[1] which doesn't support gesture typing. I'm pretty happy with it, though it's pretty barebones (it doesn't even turn on the phone's radio). Took a bit getting used to -- the recommendations are different and it felt like the key hitboxes weren't the same as gboard, but it felt pretty familiar after a couple of weeks.

[1] https://github.com/klausw/hackerskeyboard

FWIW, Netflix and Facebook each donated gold-tier (25-50k USD) this year[1]. I would be very surprised if none of those companies employ engineers submitting patches upstream -- obviously for some things it doesn't make sense (proprietary drivers for PS4 hardware, etc). A cursory search turned up this[2], for example.

[1] https://www.freebsdfoundation.org/donors/

[2] https://people.freebsd.org/~rrs/asiabsd_tls_improved.pdf

> This is not the correct comparison.

I think comparing the code quality of the AMT to that of another OS is a fair comparison, given that the current-gen AMT is running a modified version of MINIX[1].

[1] https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...

Looks like you can either set browser.tabs.remote.autostart=true to soft-enable it, or browser.tabs.remote.force-enable=true to force it on. The wiki[1] does not encourage the latter, but suggests the former may only be available for beta (and more frequent) builds.

[1] https://wiki.mozilla.org/Electrolysis#Testing

I don't disagree with the spirit of your comment, only the primary example.

Most of the dynamically-sized containers I end up needing are one of vector, map, set, or list. For the latter three, there's <sys/tree.h> and <sys/queue.h> on most BSDs which provide intrusive macro-based implementations. Sure, they're a bit more clunky to use than e.g., std::map, but I'm neither concerned with their speed nor their reliability (insofar as their implementation).

Naturally, when you need to reach for a less-common data structure (e.g., a bloom filter or B+ tree) you'll have to look elsewhere, but feels like the same situation as if you were using C++'s STL.

> Most newer languages have built-in syntax for "iterate over collection". C++ does not.

Huh? C++11 includes a range for:

    for ( auto i : results )

Is it really 100% Go? It does not seem that the UI bits are written in Go -- they likely just pull in the Ivy bits via JNI (e.g., via [1]) and implement the rest of the application in Java. The language on the page also seems to indicate this[2]. I'm much more interested to see Go/Android interop include support for interacting with the native UI within an entirely Go application without having to jump through the JNI hoops myself (though the benefits to this are admittedly tenuous at best).

--

[1] https://godoc.org/golang.org/x/mobile/app

[2] "A more complete description of the underlying engine is available at http://godoc.org/robpike.io/ivy."

> Is thst possible, in general?

(Deterministic|reproducible) (compilation|builds) are a fairly recent endeavor; though they're not yet common they are technically feasible. The two efforts I'm aware of are Debian[1] and Chromium[2], though I'm not sure what state they're currently in. From their site, Chromium appears to include Android builds.

There may be Android-specific concerts w.r.t the JVM's JIT, but if you can't trust the onboard runtime, you've already lost IMO.

--

[1] https://wiki.debian.org/ReproducibleBuilds

[2] https://www.chromium.org/developers/testing/isolated-testing...

It's a C99 feature (I think?) -- designated literals. They're absolutely wonderful.

> it is not by default vulnerable to malicious CAs

Well, in this particular case, they're using

  ssh [..] -o 'StrictHostKeyChecking no' -o 'UserKnownHostsFile /dev/null' [..]

So the remote authentication bits are already out the window. It would be nicer if they included the host's public key in the installation package rather than eschewing it completely.

> "using ssh as a transport mechanism for a web service is one of the worst practices you can use. SSL vulnerabilities are being spotted more frequently than ever now"

Just wanted to note that SSH doesn't really have anything to do with SSL (e.g., it doesn't operate over an SSL transport). Might just be a typo though. Still seems really sketchy that they're using a reverse bind to (presumably) punch through NAT rather than something sane like just using UPnP or simply requiring correct network configuration.

The article calls out <noscript> messages as a bad practice, but as someone who routinely runs without javascript enabled, I much prefer webpages to explicitly point out that the issue is on my end, not theirs (rather than, e.g., a white screen of death).

> Cannot call abort() because some systems have unsafe corefiles.

Huh, FreeBSD has MAP_NOCORE which allows the program to map pages that will explicitly not be included in the core file. I never realized that this was FreeBSD-specific extension (added in 2007?).

I'm really surprised other platforms haven't adopted it, though I surmise there's a good technical reason or two. (EDIT: or maybe there's similar functionality via another API? I haven't been able to turn up anything).

> Previously, all pointers to incomplete struct types translated to the Go type *[0]byte

This makes me really happy. I end up writing a lot of bindings to C libraries (libjpeg, libpng, etc), some of which use incomplete types to hide the contents of their internal structs. With this fix I'll finally be able to work within the constraints of the typesystem and stop hacking around it with casts to/from unsafe.Pointer.

Not only that, but there appear to be potential buffer overflows which involve the data pulled from the wiki page[1]. I'm not sure why asprintf wasn't used here (and in other places). The partial re-implementation of libc[2, 3] is also somewhat frightening. As are potential unchecked integer overflows when calculating a size to pass to malloc[4].

C is hard.

--

[1] https://github.com/clibs/clib/blob/master/src/clib-install.c...

[2] https://github.com/clibs/clib/blob/master/deps/fs/fs.c

[3] https://github.com/clibs/clib/blob/master/deps/str-copy/str-...

[4] https://github.com/clibs/clib/blob/master/deps/http-get/http...

> should Comcast now give my and my hoster free access

If your hosting company has paid Comcast for 100Mbps transit, then Comcast should honor that agreement with your hosting company. Your uplink to your hosting provider is completely irrelevant as far as Comcast is concerned.

If you're using a different transit provider (e.g., Cogent), then Cogent and Comcast will have a mutual peering agreement that accounts for imbalances in transfer. These details are very complicated, proprietary, and you should never need to care about them. That's the whole point of the internet; you connect to "the internet" and can treat it as a homogeneous network, whereas in reality it is actually a bunch of mutually-peered subnetworks.

In an <img> context, your browser should send an appropriate Accept header[1]; this can be switched upon in the backend to select the appropriate representation (e.g., to serve an image rather than HTML). So hotlinked images should continue to work, while normal links will redirect to the HTML wrapper.

--

[1] Though, rather unfortunately, most browsers do not seem to send reasonable Accept headers. See https://developer.mozilla.org/en-US/docs/HTTP/Content_negoti..., "Default Values" and "Values for an image".

Given the plethora of AWS services, the author may have been referring to S3 or RDS. The whole piece read like fire and brimstone, so I wouldn't necessarily give it the benefit of the doubt. There's plenty of other hyperbole in there, gems like:

> [Amazon lets] you use [EC2] for pennies per hour.

The author's probably referring to micro instances; everything else costs upwards of a dime. For large scale deployments, EC2 is everything except cheap.

> You can upload any application from Mainframe2 in 10 minutes. With Citrix or VMWare, it takes at least four months to do the same thing.[1]

Four months? I am at a loss for words.

--

[1] http://www.mainframe2.com/infographic

I hear a lot of people talking about the need to shift decimal points, but never really understood -- what's the benefit of this over just using SI prefixes? To me, it's clear how 1mBTC relates to 1BTC and 1µBTC.

I think people underestimate consumers. Before Decimal Day (1971), 1 British pound was worth 20 shillings, and 1 shilling was 12 pence[1]. As confusing as it seems to me, apparently that worked for awhile. Likewise, I think consumers could deal with SI prefixes in a decimal system (rather than needing to redefine how much 1 BTC is).

--

[1] http://en.wikipedia.org/wiki/Decimal_Day

On many sites, an unauthenticated user gets content faster since it's much easier to very aggressively cache unauthenticated content -- since there is usually no user-specific page customization (e.g., so the entire response can be easily cached via varnish). Additionally, if the user cannot modify state, the cache can be made more incoherent without loss (e.g., such that the cache is only flushed every few minutes; unauthenticated users don't often notice the stale data).

In some situations under high load, the same response from Varnish (which may only available to unauthenticated users) may be an order of magnitude faster than the application server, even if they're co-located on the same physical machine.

Looking further into it, it seems pretty much any forex in the UK is subject to VAT[1]. Even though Bitcoin is classified as a single-purpose voucher, I suspect it comes out to being the same amount of taxes (from the perspective of running an exchange). (EDIT: completely wrong, heh)

--

[1] http://www.hmrc.gov.uk/manuals/vatfinmanual/vatfin2740.htm

I wouldn't say InfluxDB (or Graphite, or whatever) is something you'd develop a side project around (though you could probably implement some novel data visualization), but rather, they provide a backend for your side projects to collectively aggregate metrics.

Cloudcrack has a 40-core FPGA solution that allegedly can break MS-CHAPv2 in a day[1]. Looks like they charge $100/lookup[2].

--

[1] https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-cha...

[2] https://www.cloudcracker.com/dictionaries.html (in the mouseover text in the graph for brute-forcing DES keys).

Presumably that's atypical behavior for a BIOS, so an analysis of the dumped firmware should turn up where it's getting the location of and method to decode the data. That would give you enough to keep digging.