rainforest

Move fast and break things has its downsides: work that influenced public policy/political debate was retracted after an error in the model was discovered [1], errors have been found in widely cited databases [2]. These are things that should be avoided I'm sure you'll agree.

Science has this additional problem that its memory is short - mistakes seem to be discovered when work is in the long tail of the citation curve, once it's out of the news. Even if you retract a paper, there is no easy way to trace the contagion to the work that uses it. That's before you consider mistakes that might be deliberate [3].

I have no doubts that more software/data rigour would make science more accurate, but the cost would be substantial, and it would no doubt slow down discovery until the benefit of open source kicked in.

[1] : https://theconversation.com/the-reinhart-rogoff-error-or-how... [2] : https://www.the-scientist.com/news-opinion/mistaken-identiti... [3] : https://retractionwatch.com/2016/09/26/yes-power-pose-study-...

The model isn't predictive though - it's a simulator. If we'd waited until we had enough data to make predictions with it (which I doubt you could given the sheer number of parameters) it'd be too late to use any of the interventions.

How would you ethically collect training data for the interventions?

I believe this model is quite old (at least in some form) so there have been opportunities to review it. I confess I haven't looked, but I haven't heard any defects have actually been identified. If the model stood up to peer review I assume the results it produces are at least consistent with the expectations of the people who wrote the mathematical model.

Hopefully this will be a watershed moment that makes it easier to cost a research software engineer onto a grant in the future.

Good software development is missing from most academic promotion tracks. "Research Software Engineers" are a recently new thing, which is an admission that academics are not very good at software engineering and supports the notion that they can't reasonably be expected to be experts in two disciplines.

There is a large amount of software being written by non-software engineers (most of it is Excel) so I think it's probably constructive to say that the solution lies elsewhere other than expecting academics to become software engineers. If that sort of requirement is in place it would be hard to argue against software engineering being a chartered engineering discipline with liabilities and qualifications which would be very disruptive to a lot of the industry.

It is worth remembering that academic code sharing is rare in and of itself. This reaction is likely to cause other academics to shy away from publishing their code. Perhaps giving them an opportunity to make their mistakes public so that more skilled engineers could help before the credibility of their results is used to justify drastic government policies would be better?

When I was in academia I was stuck using the HPC facilities at my institution. I was lucky to get about 30 cores and my jobs took many months to run to get out of the queue (overall I used about a decade of CPU time).

I'm quite sure that 2 months of my time waiting for results (and the impact on colleagues occupying their HPC cluster) was worth the $9k or so it would have cost to rent enough VMs to get my results in about 4 hours or so instead of 2 months.

That's not counting the hours of machine and my time wasted building enough support for the awful queueing and execution environment it used which was almost impossible to mock up locally.

I wasn't aware of this, looks like it would solve some of our pain points, thanks!

I think the existence of tools like this is a succinct way to say that static/declarative languages are really hard to execute.

One use case that TF really frustrates me with is anything conditional: if I want to do blue/green the best I can do is duplicate the entire infrastructure and wrap my terraform invocations with some brittle script that repeatedly runs TF with various targets. The script only allows me to define the target state, but it is quite common that I care how that final state is reached.

Create-if-not-exists is also really poor in TF (probably by design), if you want to reuse your TF configs for different environments in the same account, you either have to ensure everything won't collide name-wise, or split your TF into immutable infrastructure and really-immutable infrastructure.

> If you feel the need to put code in your runtime config, that means your design sucks.

I would look at Terraform and beg to differ - they started with a simple stringly typed language and had to build a typed language. Still no support for conditionals, so everyone has to abuse the only bit of control flow on offer - ternary variables and counts.

CircleCI is just as bad - it's a nice yaml format until you want a conditional step in workflow that's conditional on something other than the branch name.

It's very risky to settle on a static config at design time since the users will find a need. How would you cater to that user without offering a programming interface to configure it?

It has a pre-flight script (which isn't supposed to change anything) that installs it (and its browser extensions, and a kernel extension at some point in the past) in the most widely available place the current user has privileges to (it installs in their home directory if they aren't an admin).

So yes, there is some blame to be laid at the OS for running binaries with the privileges the current user has, but it's clear that the installer doesn't behave like a regular installer would.

To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.

Zoom has a web client that "just works" but they only show it as an option after they detect that their native client didn't "just work".

> So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent.

But... why? What other software vendors look at the OS security model from a viewpoint of 'how do we bypass this as much as possible?' If it's not evil intent, what is it, incompetence?

This is an example. Why would you trust an organisation that engineers "solutions" to security measures but does so without due care and attention leading to a widespread critical security bug?

The videoconferencing industry seems to believe it's necessary to bypass regular OS protections to make the UX "better".

For example: https://www.theverge.com/2019/7/8/20687014/zoom-security-fla... By design, instead of using a URL handler, they run a HTTP server on your machine to bypass the "open with" dialog. There are good reasons not to trust the binaries they ask you to run.

Here, it turns out they offer a web client after all, which is nice and sandboxed, but they default to trying to run a binary on your machine where you have less control over what it does.

Windows Defender also had the same defect [1]

[1] https://arstechnica.com/information-technology/2017/05/windo...

I think it's too easy to be sucked in by the promise of distributed X or eventually consistent Y.

In the past I managed migration of a few services away from Hazelcast as the team started peeling away the nice abstractions they'd become used to so they could handle things they hoped it would protect them from. All of a sudden a distributed lock isn't a lock if your cluster splits.

In the end almost everything ended up back in Postgres. Resistance was surprising - there was a lot of opposition to simple things due to a fear that the database would be harmed by being used to hold a few row locks, for example.

I can see why people overlook the obvious when the complicated solutions seem more sophisticated, which is easy to mistake for "better".

I think the problem isn't the phrasing, it's asking the question at all.

It's all too easy to confuse PRs as a quick peer review with an opportunity to vicariously work on something by asking questions that you should have asked when pairing.

If you don't trust the engineer, then why let them waste their time getting to the point they're asking for feedback to telegraph your contempt for them and try to "help" them?

The "spineless chicken" Corbyn attack could also have been to muddy the "chlorinated chicken" association too.

James Mahaffey's "Atomic Accidents: A History of Nuclear Meltdowns and Disasters: From the Ozark Mountains to Fukushima" is also worth reading - the scope is broader. It covers a period where research reactors were decommissioned explosively by pushing them to supercriticality and accidents in supporting plants amongst other things.

> As Holbrook accelerates, the cyclist will push 700 watts for more than a minute to stay inside the draft pocket behind the dragster’s fairing. That’s about what a Tour de France sprinter produces in the final minute of a stage.

From https://www.wired.com/story/denise-mueller-korenek-bike-spee... - 700W over a minute is very physically demanding.

Not necessarily, but probably an age-driven assumption. The cutlery produced in large quantities was made of stainless steel and exported globally; if it was imported from the UK there's a good chance it was made in Sheffield.

Sheffield has a long heritage of making fine cutlery and tools. It's the reason we still have saw makers here (despite the fact their products cost 10x a mass produced version) and why there's a Master Cutler of the city.

A lot of that heritage has been lost but there's still a place in the market for fine hand made things.

You probably own some Sheffield cutlery somewhere.

Their Companies House filings show a charge registered for a loan late last year, presumably a last ditch attempt to keep it running. The filings from the last few years show it was barely profitable. Sounds like it was a very desperate position.

For curiosity's sake, if you're interested you can see how often mileage is reported incorrectly by looking at the MOT data set published by VOSA: https://data.gov.uk/dataset/anonymised_mot_test.

I think it depends, some employers might appreciate being showed evidence that the process they've decided on isn't suitable for reasons they were unable to see.

Coinbase can use (and runs) an exchange to get liquidity. When a user sells their coins, Coinbase goes to an exchange and sells them on, taking a cut.

It's odd but it enables a lot of useful things (e.g. magrittr's pipe operators). It's possible to write functions that change their behaviour depending on what name they were called by too.

Forgive my lack of knowledge, but what's the difference between a European sliding saw and a table saw with a sled?

Not necessarily, some of the Royal Navy's ships are islands too: https://en.wikipedia.org/wiki/Stone_frigate

In the short term at least, but it's probably safe to assume your risks at that distance are from your neighbours fighting over supplies.