rzimmerman

I was vaccinated in 2020, had a booster in 2021, and the bivalent booster in 2022. There's no way to know with a sample size of one how well I personally was protected. I was definitely exposed several times to COVID and did not catch it until now. I'm disappointed that the new booster isn't available for me yet. I was a few weeks away and there's a good chance it would have prevented this infection, or lessened the severity.

It's telling how everyone I talk to that's avoided vaccines brings it up. They're nervous about getting COVID, they're nervous about having being wrong in the past. Several people have pulled the same "See? The vaccines don't work!" line. Clearly they work. Even 20% efficacy at preventing infection is valuable. Reducing severity is clearly valuable. Reducing spread is a societal obligation, even if the efficacy wanes.

"I had a runny nose so I don't need a vaccine" is a hypothesis. Poll an expert on the matter (like a doctor) and see what they recommend. Ask them why, if you're serious.

I just had COVID for the first time. It's been two weeks and I still feel like total garbage. I'm thoroughly done being nice and pretending to be open minded about conspiracy thought at this point. If people want to "just ask questions" they need to be prepared for answers, which exist and are easy to find. The whole time I've been sick I've had to smile and nod at people trying to justify their dumb decisions two years ago. "Your body has an immune system..." and "are they just calling all respiratory infections COVID now?" is the kind of nonsense I don't want to hear when I can barely get out of bed.

It's trivially easy to find evidence in data that cases are trending up. Positivity rate is up and hospitalizations are up where I live (LA county). http://publichealth.lacounty.gov/media/Coronavirus/data/#gra... http://publichealth.lacounty.gov/media/Coronavirus/data/#gra...

This booster has been in development and testing for months. Any correlation between uptick in cases and booster availability is obviously just good planning. It's almost COVID/flu season and vaccine makers try to have a booster/shot ready in time for the predominant variant.

Everybody (at least pretty much everybody) should get a booster when it's available. COVID is awful and you don't want to get it. Feel free to "make your own choices" and "read the evidence". But if you want to go that route, be prepared to accept the answer that getting a vaccine is statistically the right choice for 99%+ of people.

It's obsolete now, but before async/await was part of JS proper I worked on a compile-to-JS language that handled this by compiling to callbacks: https://github.com/rzimmerman/kal

It included try/catch support and fancy stuff, like loops. The source may be interesting for anyone interested in compilers: https://github.com/rzimmerman/kal/blob/master/source/generat...

The Kal compiler is written in Kal, but it's supposed to be easy to read. Surprisingly the browser demo still works: http://rzimmerman.github.io/kal/demo.html

The TPM spec is a monster and I understand the urge to throw it out and create something simpler. It's also true that you're trusting proprietary firmware in the TPM to be correct. Errors and bugs in the spec are also near impossible to fix. So the idea of "just run whatever code you want" has appeal. And the reference tpm2_tools and software stack is a hot mess of C code that should definitely not be written in C at this point.

A device brewed on a RISC-V SOC in an FPGA is probably very hard to secure against hardware attacks. It's fun (in the sense that FPGAs are "fun") and it's definitely a worthy pursuit to have an open hardware + firmware device replace proprietary TPMs. But getting hardware security right is just as important here. A TPM-replacement is not useful if I can solder a JTAG connection to it and read out the memory.

Rewrapping keys when there's a firmware/code update is a real weakness here. There's probably a solid solution, like being able to provide a compound/asymmetric CDI to wrap between versions. Like "generate an ECDH key pair for the next hash". It would be a pain if every client application had to implement this themselves. The other hot use case for TPMs is boot chain attestation, where hashes of UEFI firmware, boot loaders, and kernel images are appended to create a verifiable hash. The device attests to the hash being authentic.

One major weakness of TPM 2.0 is that it's monolithic for the whole system. If you're running VMs or even just multiple processes in the OS, it's not really easy to use across domains. So lightweight code swapping would be pretty cool.

Interesting stuff nonetheless.

Absolutely. A lot of back-patting and inside jokes about 40 years of building expensive space systems that often failed. Self-aggrandizing crap about how “space is hard”. Space was hard in the 60s when you had to invent microprocessors to get off the ground. It’s well understood and should be common and cheap now (at least for Earth orbiting systems). This old boys club nonsense might feel fun but space is changing, access is becoming easy, and anyone that tries to spend 10 years and a billion dollars on a project won’t last long.

I’m fairly confident this is not a first. It’s just good behavior if you have a defunct but controlable satellite in low earth orbit. A best-effort burn to deplete fuel and aim for an ocean is an obvious choice. While it’s interesting, it is not novel and I think the reporter over-sensationalized here.

This is already (effectively) the case. All satellites launched from the US need to have a plan to safely deorbit within 25 years after they’re no longer in use. I believe this was recently lowered to 5 years. For many satellites this just means natural decay and burn up on reentry. Satellite owners need to submit an orbital debris analysis as well to prove they won’t hit anything. Other countries and the EU have similar (often more strict) regulations.

I don't know the internals, so I'm guessing, but for password sync between iCloud devices Apple might require a hardware protected key (like in a TPM). In which case it does make sense that this requires a native process running on the host. At least until that can be exposed in a meaningful way through a Web API. I doubt it's as simple as querying the iCloud servers for the plaintext password.

There's a nice blog post from Planet about their approach: https://www.planet.com/pulse/keeping-space-clean-responsible...

This article is sensationalizing pretty hard. SpaceX is doing a great job automating conjunction planning. If you run a collision model on their 1000s of satellites over a several day period, you'll find many potential collisions ("conjunctions"). But remember the probability on these is abysmally low - less than 1/100,000 or less than 10^-6. And these are conservative upper bounds. But thousands and thousands of those add up to an uncomfortably high probability over years of operation.

So SpaceX does a smart, responsible thing here. They make a course adjustment if the probability is above a small threshold (probably 10^-5). From my understanding this is all automated. It's not a "swerve" or an emergency. Their satellite simply needs to adjust its normal orbit-keeping thrust a small amount at some point in the next 12-24 hours. It's table-stakes for constellation management at this point. Planet does the same tracking with their 100-200 Dove satellites.

Additionally, SpaceX and other operators like Planet have higher fidelity tracking data than the USSF's radar data (available at https://www.space-track.org with a free account or through https://celestrak.org). They publish their tracking data for other operators (https://ephemerides.planet-labs.com). Having lower error-bounds reduces the number of potential collisions that need to be avoided and tracked.

Inflammatory language like this is frustrating because it feeds an emotional "have you heard about Kessler Syndrome!?!" gut response. Many people and VCs have been duped into spending time on exotic stuff like harpoon capture and trash collecting satellites. But the answer, to anyone who actually works on this problem and does any research, is already there. What SpaceX and Planet are doing is responsible. Debris mitigation agreements and deorbit timeline restrictions from the FCC/other bodies are enough. If someone truly does launch 10-100k satellites, there are great solutions available with defined orbital bands.

If SpaceX had done 0 of these maneuvers it's unlikely anything bad would have happened. But they're doing the right thing here. And Starlink satellites are very low and don't stick around as junk when they're not being used. Basically, the tone here should be "wow SpaceX does a great job with automating collision avoidance", not "satellites constantly swerving in space".

It is incredible to me how few people understand this. Particularly people with finance backgrounds that should know better. The June 2022 CPI showed an increase of over 1.2% (just in June!), equivalent to about 13% inflation at a yearly rate. The last few months have all been in the 0.1%-0.4% range.

Even if you just assume that June 2022 is roughly in-line with March/April/May, that means the June 2022 1.2% falls off the moving average and is replaced with something in the 0.1%-0.4% range. So of course YoY inflation decreases from 4% to 3%. It's just a moving average. Moving averages and YoY numbers make sense to cancel out seasonality and noisy monthly numbers when things are regular. But if there's say, a massive spike in inflation due to supply chain issues, well it's going to take a full year for that spike to disappear from the yearly moving average.

I'd also plug an open source radio released by Planet (similar to what's on their Dove satellites):

https://github.com/OpenLST/openlst https://github.com/OpenLST/openlst-hw https://github.com/rzimmerman/gr-openlst

Summary from what I read:

Any user can query pretty much any table in the DB using their "GQL" wrapper around SQL. Someone thought enough to restrict the "user_password" field, so instead you query another table which gives you the user's session ID. Normally a token is user session ID + signature. But it turns out the signature wasn't really being validated, so user session ID + anything worked.

I'm normally not one to jump on mistakes, but that's remarkably bad.

US power is really 240V with a neutral. It’s wired to most outlets and circuits as one 120V leg (against the neutral). But you can absolutely wire a 240V circuit using both legs and major appliances (air conditioners/heat pumps, electric driers) use 240V. My Tesla charger is on a 240V 60A circuit.

The argument is more complicated than Elon makes it out to be. "Humans can drive with vision alone => computers can drive with vision alone" implies computers can do anything the human brain can do. It's not a given, and it's certainly not true for the compute power in a Tesla. It's completely possible that all of the following are true:

* Humans can drive with vision alone

* A sufficiently advanced compute system can drive with cameras alone

* Telsa's FSD computer cannot match human performance without additional sensors

I believe there is a correction for the onboard satellite atomic clocks, which run faster than ground/ECI clocks due to a combination of special and general relativistic effects. The correction is a simple one - they just calibrate the clock with a small polynomial. IIRC nothing but the linear and constant terms are even required or used.

I hate being a critic when someone actually does something, but I have a lot of trouble justifying the effort on this one as well. It seems like the mission did a great job of checking off some ESA goals. I'm skeptical these tasks were actually useful. A lot of these things don't need to be demonstrated. Using an outdated linux kernel or OS image is going to be vulnerable if you have direct access to the machine. Security here comes in layers (encrypted links, being judicious about what changes persist through resets, good+signed firmware that won't let you break things). Saying "don't forget about the OS" doesn't need a multi-million euro endeavor.

It's also a bit frustrating because (assuming it is a useful exercise) there are plenty of private companies that could have built this for ESA much more quickly and cheaply. Planet and Spire could have dedicated or loaned out one of their satellites. Starlink certainly has spares and coverage. I suppose these companies are US-based, so it wouldn't help develop ESA capabilities. Feels a little like a handout to Thales.

It's neat that I can borrow a satellite to train a neural net, but is it useful? And if it is, do I need a demo to prove it's possible?

Kids today will never know the joy of "On Error Resume Next"

It's hard to explain how much better the Tesla charging experience is to someone that hasn't tried both. As frustrating as the company (and the leadership) can be, the car is great and the charger network is outstanding. There are superchargers everywhere. You can get anywhere in the US without having to worry about it. You type your destination into the car and it plans a route for you. It picks stops strategically to minimize charge time (charging 20%-50% can take less time than charging 20%-80% once). Range on most Teslas is 300 miles + and you're never more than 150 miles from a supercharger, even deep in the desert.

But beyond that, when you pull into a supercharger, you know it's working. If it wasn't working it would say so on the dash. You park, pick up the cable, point it at your port and the port opens. You plug it in. You walk away. Your phone gets a notification when it's time to go. And it charges your card automatically. No goofy app required, no NFC/authorization, no noodling with the charger to make it work, no effort. It's really really nice.

Chargepoint stuff works fine. Stations are often broken (and like the author said, there's no way to know without going there). You have to use an app which thankfully supports an Apple wallet card. Before I figured that out it was super fiddly. I've had stations on other networks that are unusable because they have poor cell service. Then there's a whole "reload your card" thing where you get charged in $20 increments. And adapters, chunky connectors. To be fair I've never tried DC fast charging with anything but a supercharger.

Planet once used a Dove satellite to take a series of stills (that is stitched into a video) of a rocket launch of other Dove satellites. Video here: https://www.youtube.com/watch?v=afiLd4zPoLQ.

That's really interesting - so your payments are only fixed for 10 years (and at a lower amount, since it's interest-only)? I suppose you're betting that either:

- You'll sell the house before 10 years

- Rates will go down and you can refinance

I'm in a more standard 10/1 ARM for similar reasons - the interest rate was lower and I felt it was a reasonable bet that we'd be able to refinance for a better rate (or worst case slightly worse rate) in the next 10 years.

I don’t think I’ve ever seen a mortgage that’s interest-only for a fixed time like that (but I’m not sure - I’m in the US). If you want fixed payments for 30 years the only way that works is if you pay less principal at the start. There’s more outstanding debt with the same interest rate, so the interest is larger.

I think that article is incorrect. The FHA is allowing modification of existing mortgages to 40 year terms to prevent default. Not new 40 year mortgages: https://nationalmortgageprofessional.com/news/fha-oks-modify...

It sounds like the privacy guarantees of “camera data isn’t linked to your ID” and “the interior camera data stays in the car” aren’t really useful if all the data is geotagged, given that these cars spend 70%+ of their time at the owner’s home.

I’ll save my outrage for more facts, but if employees can look at my camera feeds without a valid business purpose (and post memes made from them without getting fired immediately) that’s a real problem. If the geotag data is freely available with the video data (and not controlled for privacy) that’s also a huge problem. A company the size and age of Tesla has no excuse for lapses like that.

Reminds me of a dumb project I did that takes a person's name and returns a name that is close, but not quite right: https://github.com/rzimmerman/shitty-autoreply

The idea was to set up an auto-reply to my email that looked automated, but surely couldn't be because it messed up the sender's name. Not nearly as clever as Peter Norvig's program and even less useful.

I'd say the bias toward common American names is a bug, but given that the goal of the project is to be obnoxious it's probably a feature.

I think phrasing it as “30 minutes of light runnning” is a great way to explain it. A lot of people get turned off by “3 miles” or “5km” and it doesn’t account for slower paces.

A great way to start is to commit to 15 minutes of run/walk time 3-4x a week. When I decided to start, I did one long block where I’d run one way and walk back for 20 minutes. A few weeks later I’d run 7 minutes out (with occasional breaks at first) and 8 minutes back.

The goal is to feel good afterwards - not like crap. It’s better to do a workout at 80% of your capacity and want more than to go 105% and feel like butt. You want to develop a positive association in your brain so that you crave a run.

So number one piece of advice - go slow! If it helps, get a watch with a heart rate monitor and keep it below your 80% level. Worry about your times after the first 5k.

Also it’s not clear that the same AES key is used for all secrets. If it’s URL- or tag-derived using the master password then it’s only bad for long secrets (more than 32 bytes) that aren’t random data.

I also love my Model Y. It’s by far the best car I’ve ever owned or driven. But the software has stagnated in favor of “FSD” beta releases.

Autopilot on freeways is great. I use it all the time and it works. I wish Tesla would focus on getting that to a level 3-type system - something where I can take my hands off the wheel and just be ready to take over after 10-15 seconds. It feels close enough that it could be done. But despite the complaints about the name it’s exactly what is claimed.

Auto park is bad. It doesn’t detect the spot half the time and it’s not great at actually parking. Especially on tight spaces where it would actually be useful.

Navigate on autopilot is underwhelming. It’s often too timid to actually switch lanes if there’s traffic. I like the signal-to-lane-change.

Full self driving is a boondoggle and absolutely false advertising at this point. Put all the disclaimers on it you want, but I paid for something that (the language at the time) claimed would get me from point A to point B while I relax and don’t pay attention. Every year it’s another few months away. I doubt it’s actually possible with the hardware on the car at this point. Elon’s claim of “humans drive with eyes so a car can drive with cameras” is naive. It’s glossing over the very important bits of “with the compute power in the car” and “within the limits of moser CV/ML techniques”. I have no doubt that autonomous driving is possible - it’s actively happening in San Francisco roads with Cruise/Waymo. But I doubt my Model Y can do what I paid for, and that’s unethical.

This doesn’t need a law, it should be enforced by the FTC or by a lawsuit. It seems like someone scoring some cheap points.

This is great research and very useful (if sometimes mundane and math heavy!) work. It’s a public good and the author has made important contributions.

I kind of chuckle that many of the comments here are complaining that the article didn’t say the one “quick way” to clean up orbital debris. Is it lasers? Space tugs? Robotic deorbit devices? No! The author did answer it - it’s tracking! Knowing where all the debris objects are and calling out debris offenders/enforcing existing regulations is really enough. This kind of work - not the hundreds of millions spent on space tug demos, harpoons, and exotic nonsense - is actually useful. Everything else is an excuse for rich VCs and armchair aficionados to yell “have you heard about Kessler syndrome?!?”

> code full of #ifdefs is not portable code - it’s code that has been ported a lot

Definitely true - the more preprocessor magic you rely on, the harder it is to figure out what’s actually going into the compiler.