makmanalp

No, that is kind of the point of a salt is that it doesn't need to be hidden - it's designed for a scenario where e.g. your database is hacked and they're visible as plaintext: https://en.wikipedia.org/wiki/Salt_(cryptography)

Since the salts are random, unique to each SSN and long: a) you'll find no existing rainbow table that contains the correct plaintext for your SSN hash and b) each SSN now requires its own bruteforcing that is unhelpful for any of the other SSNs

Combine that with a very expensive hashing method like PBKDF2 (I'm sure there's something better by now) and you've made it pretty dang hard for non state actors to bruteforce a significant chunk of SSNs. There's also peppers that involve storing some more global secrets on HSMs.

I'm sure the crypto nerds have like a dozen better methods than what I can come up with but the point is this is not a feasibility issue.

> HIPAA has done net harm by delaying flow of information for critical-care patients resulting in lack of patient compliance, confusion, and treatment error.

You won't find any disagreement from me that HIPAA is very complicated. However there's a certain level of whining and foot dragging that happens in the industry that we should take with a massive grain of salt. There's so many HIPAA compliant and still convenient ways these days to have patient communications, but the industry doesn't want to invest and doesn't care about patience experience enough, and then go "sorry, HIPAA :-(((" every time.

With GDPR, after Schrems II happened and it became clearer that the EU-US Privacy Shield was no longer a valid workaround, I personally observed companies (including the one I was in) suddenly moving mountains to complete migration projects and privacy upgrades in just a few months that the industry previously deemed was technically unfeasible or impossible, cost prohibitive, business destroying, etc. And they still remained massively profitable and growing. If they had just done the right thing early on it wouldn't have been on such a tight deadline either.

That was the final straw for me in terms of being very firmly convinced that we should be telling companies to shut up and comply a lot more because they will never do the right thing on their own even if it wasn't /that/ hard. Another approach here is to start holding them liable for the personal costs of data breaches etc and let the incentives take care of themselves. In fact, why not a bit of both?

> Someone can just hash every number from 000-00-0000 to 999-99-9999 and figure out mine from that.

That's what salts are for, right? It wouldn't be too hard to issue a very large, known, public salt alongside each SSN.

> And of course none of the data brokers have much reason to make opt-outs work well, in the absence of legislation and strict enforcement - it's in their commercial interests to say they "can't stop your data reappearing"

This is the actual reason, IMHO.

As a person who's from a country with, let's say, VERY VERY contested, controversial and eventful elections, the fact that independent poll watchers from different parties and NGOs can independently observe ballot boxes, take photo evidence of countersigned and publicly posted box tallies to send them to their HQs, and then compare and contrast results amongst each other as well as with the official results is a huge boon for transparency and trust in the electoral system.

It's not perfect: more remote and less popular areas go unobserved, and what happens after an official complaint is made is anyone's guess.

But at least almost anyone can add up numbers for themselves and come to a conclusion about what to trust and not trust. And you might think no one would bother, but in my brief experience as a volunteer poll worker they surely do, and zealously so. I can't even begin to imagine what'd happen if the paper ballot was replaced with "trust us, the machine says 37 for party A" or "the magical fingerprint number you don't understand says this ballot was cast for someone else".

> I don’t even know how they thought that little old me just out of university could be left alone to successfully build applications on my own, but I think people trusted a lot more during that era

A similar feeling on my end too :-) That might be it - trust sounds like a big part of it for me. Taking a chance on someone who you might eventually end up being good, rather than interviewing and evaluating them 7 ways till sunday. I understand the impulse. I wouldn't want to be a new engineer out of college today though - seems rough.

I did get paid less then than some new grads seem to be now so that might have been a factor in taking the pressure off.

> because you can always walk up to get immediate feedback (people generally like to see you are actively working on their issue)

Oh absolutely!

> It still amuses me that IT was located together with finance, because we did reports xD

It was communications for me, because the software tool we built was free to use on the web, and websites are communications, obviously :D

As much as this stuff is nuts to think of today and there's tons to hate, I am kinda nostalgic for some aspects of my experience of working at a place where software is maybe needed and/or valued but isn't a core competency. Or maybe a time when software was a new fangled thing that hadn't fully been integrated into corporate structure yet:

- No one having any preconception of how you're /supposed to/ do things or whether you'd even be the type of person to know, so you just kinda figure it out yourself. You spend a lot of time on reading and learning skills. Version control? Wow, cool, what's git, let's try that! A new graphing library? Let's give that a shot, maybe it'll make things easier! You want XYZ? Let me go read about that for a day.

- No one having any idea what's even possible: being treated like a wizard for introducing the tiniest piece of automation or improvement that makes someone's day easier or doing something they never thought was possible. Lots of appreciation and excitement for showing and teaching people new things (... and I know this is somewhat selfish and ego driven, but who doesn't like being appreciated?)

- Similarly people having no idea how long those things should take which, tbh, can be a nightmare if you're not trusted and respected enough to be consulted but also great if people believe you when you say it's gonna take 3 months.

- Beyond the basics just being mostly kinda left alone to do your job however: no standups or tickets or the 30 other kinds of daily (micro)management that is probably necessary but ends up feeling tiresome and stifling at an individual level

- Not being part of software company "culture": no performance review driven development and promo packet madness, no weird rating and ranking systems, no OGPs or KPIs. No ladder. Your bosses think you did what was required of you, so then you're good, and if it's a good year you get a raise, and that's that. I do recognize that with a bad boss this can be a terrible and unfair spot to be in - but again, subjectively with a decent enough boss it felt like a lot less weight on my shoulders at the time.

- No hacker ninja pirate segway mini quadcopter you're the smartest people in the world and we're the best company to work for sort of b.s.

- Socializing with people who are good at and love to talk about stuff other than software

Reading over that, I'm thinking maybe I lucked out a lot and that wasn't most people's experience from that era. And there's some level of rose tinted glasses going on. And/or maybe my years in the rat race are starting to show :-)

Interesting that it didn't have a "shift" mechanism and so you end up with both upper and lower case keys, which must make typing full sentences a pain. But they maintained the "upper case" being on the top and the "lower case" being on the bottom, like from a printmaker's type box.

Underrated oncall problem that needs solving is scheduling IMHO:

- We have a weekday (2 shifts) / weekend (1 slightly longer shift including friday morning to allow people to take long weekends) oncall rotation as well as a group-combined oncall schedule which gets finnicky.

- When people join or leave the rotation, making sure nothing shifts before a certain date or swapping one person with another without changing the rest and other things are a massive pain in the butt

- Combine this with a company holiday list - usually there's different policies and expectations during those. - Allow custom shift change times for people in different timezones.

- We have "oncall training" / shadowing for newbies, automate the process of substituting them in gradually, first with a shared daytime rotation and then on their own etc.

- Make oncall trades (if you can't make your shift simpler)

Gripes with PD:

- Pagerduty keeps insisting I'm "always on call" because I'm on level N of a fallback pager chain which makes their "when oncall next" box useless - just let me pick.

- Similarly, pagerduty's google calendar export will just jam in every service you're remotely related to and won't let you pick when exporting, even though it will in their UI. So I can't just have my oncall schedule in google calendar without polluting it to all hell.

Canary releases aren't a magical bug free fix. They might be doing it, but the conditions that trigger a problem can be sneaky and can happen outside your canary period, rendering it useless. It's a best effort method.

OK, in this vein, why oh why did Lyft and Uber remove their apple watch apps? I just need an app that's a single "take me home now" button so I don't have to worry about my phone battery dying when I'm out and about. Pretty please?

Lovely answer full of helpful details, thank you!

Question - if large clusters are reporting that they're seeing gains from using RDMA networks because communication overhead is a bottleneck, how is it possible that this thing is not massively bottlenecked running over a home network?

Oh I'm sorry, I didn't mean it like that - I just meant as in feeling so excited like a child over what amounts to a manual labelmaker :-) No bad vibes at all on my end though. Very interesting about the rest though, thanks for the comment.

I feel a bit silly being excited about this, but of course there's a circa 50s office solution that requires no batteries and electronics. I don't know what I was thinking!

Because by providing a temporary monopoly, it allows one a better guarantee to recoup costs, making the investment worthwhile in the first place, thus incentivizing people to spend time and effort creating works in the first place. Then, once the work has been created and costs recouped, it reverts to the public domain where everyone can access it. At least that's how pro-copyright parties explain it, not sure that ever was actually historically accurate.

Eclipse always left me with the impression that it was more interested in architecting generically extensible platforms and protocols moreso than a nice, clean, user ready tool with all the kinks worked out. I was so scarred from Eclipse and OSGI and Equinox and xml manifest files and configurations and project import that never worked properly, that I never touched anything but vim for a whole decade, until first VSCode and then IntelliJ eventually won me back over by being /so/ incredibly polished that almost everything worked on the first try and with no configuration. Judging by the other comments here, I'm not alone in thinking that that impression hasn't gone away, and they aren't helping it now. From the article:

> Note that Eclipse Theia IDE is a separate component from the overall Theia project's related Eclipse Theia Platform, used to build IDEs and tools based on modern web technologies.

So you got the Theia project, the Eclipse Theia Platform, and the Eclipse Theia IDE, all fully separate things. "Ah" they will say, "what's so hard to understand? It's a project that works on an IDE development platform under the larger Eclipse umbrella, with which we built an IDE, but of course it has nothing to do with the original Eclipse IDE". None of which makes me want to use it or means anything to me.

When you go to https://theia-ide.org/ the big text says:

> An Open, Flexible and Extensible Platform to efficiently develop and deliver Cloud & Desktop IDEs and tools with modern web technologies.

Dear god, please put that stuff on theia-platform.org or something instead, and market the platform separately. I know you're proud of it, but stop telling me about it please, I'm not trying to develop IDEs, which is an extremely narrow niche. "It can host VS Code extensions" and "vendor-neutral" is pretty much the only notable things from my POV - which is a perfectly great selling point, mind you - and they bury those below the fold.

There's a reason you want this: the more people use Theia, the more people will choose to use it as an extension platform. Otherwise it's likelier to go the way of the original Eclipse IDE (whose homepage notably still doesn't say "blazing fast", "rock solid" and "works out of the box" but has room for a zillion other things like "preferences page for Generic Text Editor" and "jar viewer").

There's also a reason why almost every editor website starts with massive screenshots of the tool itself, because people want to be able to imagine what it would be like to use a new tool before taking the big step to actually try. This is marketing 101. I wish they'd just flat out copy a competitor's page, and bill themselves as "everything you get from VSCode, but actually extensible and actually open source. By the way, look at the cool IDEs other people built on top of this, if you want to do that too, check out theia platform".

It could be great, but I'm just seeing so much self sabotage, it makes me sad.

> If so many people were buying non-FDA approved drugs that drug-makers stopped pursuing FDA approval, I think that would be quite indicative that there are some serious issues with the FDA process. At a minimum, that would demonstrate severe system mistrust

Or, it might indicate a financial incentive to get consumers to mistrust a barrier to profit. People in the aggregate are not the most rational actors, in no small part due to information asymmetry. Self interest does not necessarily yield optimal or even good results.

For example, take the new trend of waiving inspections when purchasing homes to outcompete other buyers. This is legally allowed in some places and is getting more common in places where it's a seller's market and there's lots of potential buyers.

Now I'm not so pompous enough to think that even after reading a few articles or books that I can reliably tell structural damage from easily repairable shoddy work. At least not enough that on a million dollar home purchase, I could risk being out of a home for a while or a couple of hundred thousand dollars.

But there are some buyers for whom this is not an impediment: ones who have enough capital that a bad house or two wouldn't make a big dent in their bottom line, and ones who don't truly understand the kind of risk they're taking and think they have a decent deal on their hands.

The result is that waiving inspections to buy homes is the new standard to be able to compete as a buyer at all, meaning there is now incentive to not fix serious issues in homes or even patch over them to make them less visible. Financial incentive for selling a better product reduces because the bad ones will sell. Quality of homes on the market goes down. Meanwhile those who can compete to buy the better deals are now a smaller population, but they still need homes. Price efficiency goes down because on average people are buying worse homes for more money.

A customer base of people with profoundly serious troubles at the edge of desperation who are looking for any glimmer of hope. An industry who's incentivized to charge astronomical amounts to an untapped market to recoup costs. A drug that seems to have failed based on multiple trials and 3 separate expert review teams. Now remove the approval requirements. What could possibly go wrong?

It's easy to yell paternalism but this doesn't look like a case of paper pushers getting in the way of a promising drug to me. Also, history is littered with examples of why "buyer beware" does NOT work, and a vast literature on information asymmetry, adverse selection, "The Market for Lemons", etc etc. Also, the FDA already has mechanisms to speed up new drugs getting to patients when the benefit is clear early on, AFAIK.

I mostly agree with the first bit.

Re: advice, well, there could be, but the people who put these things in place aren't necessarily thinking in those terms. They're thinking about a statistical edge and acceptable negative outcomes on their end and no one else's. They're not maximizing what's good and helpful for you unless it helps them also, they're probably maximizing short to medium term profit seeking. Computers are an amplifier of human bad behavior.

See also, "computer says no": https://en.wikipedia.org/wiki/Computer_says_no

I don't know why but the sounds make it so much more satisfying :-) It's as fun as I remember it being as a kid.

> If people are given a chance to be lazy, they will be (I will be for sure). Quickly hacking some stuff without properly testing? Sure! Linting? Pfff, living on the edge, you'll throw the colab away in an hour anyways

To save everyone time, I think the fundamental disagreement comes down to this. A vast chunk of the audience of notebooks is people whose brain has not been drilled on the daily about best practices and maintainable code and often don't get judged on that criteria or affected by the consequences of this. If you believe that these people are irredeemable as engineers, or more charitably that the incentives driving this cannot be fixed, then you probably believe in taking away good tools from these people because they'll misuse it, and then you'll agree with these articles. If you don't, then you won't.

> I am using code autoreload and write code in modules >> Nice! I've done this for a while as well. This is a good use-case. However, this approach does not address some of the issues, e.g. data analysis scripts should be checked by another team member.

How come? When you write your code in a module, it gets committed and PR'd and linted and tested and reviewed just like any other code, which is the whole point of this approach. Which I think is the most reasonable and mature one.

The notebook then is mostly reserved for a very thin interaction layer optimized for play, on top of your vast iceberg of reviewed & tested & maintainable code. Including lots of prewritten convenience routines for plotting and munging to minimize business logic in the notebooks further, and not have paragraphs of matplotlib crud in hidden cells. You construct what's almost like a shell + DSL that's optimized for the domain and datasets you care about, and you can focus on investigating. If there's more significant code, it soon goes in a module again, without interrupting your ongoing flow and thought process.

And it's 1kg and 15cm long, and costs 1300 too. Most people will probably rather buy the non-art 28 and a 45 and carry both. But I think that's besides the point. If you're buying this I think it's because you really want exactly these bells and whistles.

The art line is like the "enterprise edition" of lenses :-)

True, but anyone who's a cheaper hire because they can "do cloud" but not homegrown also represents a sacrifice in terms of what's you get. In terms of your operational capabilities, you'll likely be paying for that with a crisis first where everyone yells at your team because of a problem in your managed provider you can't fix, and you can't get someone from the provider on the line and helpful in a way that gets you out of it faster. So then you'll tack on add a massive yearly support retainer for a response time SLA that's still bad for your business bottom line and support that's not incentivized to prioritize you. I have stories from name-brand PaaS/IaaS companies.

It's like outsourcing (I don't mean offshore, I mean any kind). It can be a reasonable thing to do if you don't pretend you're getting the same thing for less money and really actually plan around that. But people often do pretend it's the same, and the results aren't immediately apparent. And when they're finally blatantly apparent, either the guilty party has cashed out and left, or people don't have enough perspective to point to the real root cause.

I'm not saying building your own infra is generally a good idea of course. It's just that beyond a certain size, for more businesses than you'd think, reliability has to be a core competency you invest in. And homegrown is a lot easier than it used to be because the offerings in terms of tooling and platforms are way better such that you can strategically craft your level of managedness for optimum cost/benefit on multiple criteria.

> That doesn't really make sense, does it? These issues have been going on for centuries; how does that explain a rising trend?

I think basically this is just a visibility issue: the problems always existed, we just used to accept them as inevitable. We just demand more of life today, and actually pay attention, and that's a good thing.

There was a notion in the past that suffering was normal, and unusual behavior that very distressed people exhibit was just people being people. Like if you survived hunger in the great depression and a few decades later during boom times you still hid money in the seat cushion and wore rags and and went into fits when someone suggested you ought to spend the money you saved a bit more for your own good, no one thought that that was a form of suffering a doctor should help with. Not for poor people anyway. Or if you had been assaulted a woman who was assaulted by their husband and couldn't tell anyone about it, or if you were harmed by the clergy, or if you're a veteran who has a breakdown every time a loud noise happens, and all these other scenarios. Any unusual response to all that wasn't seen as a medical problem to be named and treated at a mass scale, I personally think because learning more about these things medically and making societal adjustments to prevent these things from happening required that society face some extremely uncomfortable truths, which did not happen easily or on its own.

And in fact I feel like the opposite even happened: I read, for example, about how shell shock was purposely not considered a real medical issue in WWI in the UK, to be able to return soldiers to the front as fast as possible even though more than a quarter of soldiers in the hospital were considered shell shocked. Eventually, the diagnosis was banned by the brits. Official shell shock rate at 0%. If you don't look, there's no problem, right?

So instead it was said that there's nothing wrong with you, you just need some rest. And if you had a really severe case and were not better, you were just weak or a coward, and you need to man up and get back out there. Then you get a court martial or electric shocks. It's no wonder that people pretended that they had nothing wrong with them - nothing good happened otherwise anyway. And so no wonder it took so long for society at large to accept this as a problem.

So now we finally have a more accurate pulse on these types of problems, and we see that unsurprisingly they rise as people have problems in their lives. Makes perfect sense to me.

> I'd rather assume that the lack of a framework to understand the harshness of the world is what makes people go crazy.

The framework is realism: it is very much that people do understand that the world is harsh and that hurts you, but then you now get to recognize that it hurt you and do something about it maybe.

I think the qualifiers are there because the question of who came up with the first "stored program computer" is a matter of some notorious controversy - kind of unrelated to the first computer program. Knuth would have known about this.

"Stored program computer" refers to a computer where the program would be stored within the persistent memory of the computer itself, rather than elsewhere. It seems hard today to imagine such a thing, but think about punch cards or programs you have to enter in via adjusting switches or plugboards. The point of a stored program computer is that program running on the computer could, in theory, change the program itself (yes, "code is data" predates lisp, sorry).

According to Jean Bartik[0], Mauchly and Eckert's EDVAC was already a stored program computer, and thus implying that one of them must have written the first stored program. Jeremy Norman has the actual document where this happens[1], months before Von Neumann's publication. There's some evidence that some of the ideas in Eckert's paper were from an even earlier paper from John Atanasoff, the source of another bitter fight. In any case Bartik has a very poor opinion of Von Neumann, who apparently sat in on EDVAC meetings and wrote notes on the EDVAC without crediting Mauchly and Eckert, then allowed those to be distributed widely in his name, which in turn invalidated Eckert And Mauchly's patent application and thus also their claim to the invention in the public eye.

Another interview with Eckert[2] gets into the details of these allegations: That Von Neumann's motivations were that things should became public domain was because he specifically couldn't sell those ideas at IBM (for whom he was consulting) unless they were patent free.

Both of these are from biased parties of course so take their interpretations with a grain of salt, but that Von Neumann took ideas from EDVAC and summarized them in more formal language and did not credit the others seems pretty much settled fact based on other sources too. Von Neumann was already a well recognized and brilliant researcher in his won right, but reportedly he was also wracked with self doubt, so who knows, perhaps that could have been a motivation too. All of these were very ambitious people.

Curiously that interview also has a reference to another person claiming that a lot of papers attributed solely to Von Neumann were actually coauthored. Really gross stuff, though it's just an offhand comment without substantiation, unlike the other stuff here.

In any case all this reinforces my notion to be more suspicious of modern day "first" inventions attributed to a single person. Similarly to the telephone and lightbulb, there seems to have been a very active community of inventors (all quite important and impressive) who were dancing around related ideas and another might have gotten there eventually if one didn't. There are about 7-8 early computers, some of them within months of each other, that could all be considered early stored program computers. And the parties involved were exchanging ideas with each other too, one way or another. I'm not sure it makes sense to wring hands about which one was truly first.

[0] https://news.ycombinator.com/item?id=40333159 [1] https://www.historyofinformation.com/detail.php?id=639 [2] https://conservancy.umn.edu/server/api/core/bitstreams/7de38...

Whoa, amazing, thanks!!

Very neat, thanks - probably this is just enough beyond my abilities that it'd probably be me bricking my PO rather than accomplishing anything useful :-)

Hadn't heard of it before - the fact that it has multiple compilation targets is super interesting - thanks!

Just got a PO-33 and very psyched with it, though I've had some thoughts about whether you couldn't leverage the LCD a bit better to shift it from semi-serious to fully serious. E.g. right now in the sequencer it's impossible to know which specific instrument is playing. Anyway, it would have been really cool to have the OS be open and flashable and spend a little bit of time to make little papercuts like that better. I was looking into how hard it would be to put something like csound in a tiny board and make my own, but when I look at how minimal that single header file synth is, I'm left wondering if that's too much.

Nice!

You need to get the sugar cubes and use way too many for maximum authenticity :-) I myself am partial to Çaykur's Hemşin tea, by the way.

Mehmet Efendi is good if you're walking by the shop (smells amazing) but the dirty secret is that in a post specialty coffee world, you're probably better off asking your local coffee shop to grind fresh beans for you on the "Turkish" setting or absent that, the finest possible setting they have - more than espresso. And you get to have an interesting conversation with the baristas because they're always super psyched about it for some reason. Arabica beans, dark roast, low acidity from Ethiopia, Yemen etc is traditional but you shouldn't feel limited to that.