HNHacker News
TopNewBestAskShowJobs

sdrinf

1,644 karma · joined June 6, 2009

Hey there, fellow HNer! Happy to chat:

Contact: sdrinf at google's email service

Web: https://sdrinf.com/

submissionscomments
sdrinf··on BitLocker Lockscreen Bypass
Heavy bitlocker user here, and up until now assumed the first approach is what's going on; how do I verify which system is used, and switch to the former in a few words?

Thanks for the heads-up!

sdrinf··on Ask HN: Should We Move Again?
Originally from Hungary, lived in Budapest between 2002-2008, currently in San Francisco, have been visiting the country since 2008 every year for 2 weeks. It's hard for me to overstate how bad of a choice Hungary is for anything remotely related to tech/business/trading. Hungarian law is convoluted, and generally made by & for large corps; taxation (outside of the small business sector which you don't qualify for) is high, corruption is high, people are low and hopeless. Hungary also went through consequent phases of massive brain drain (2003, 2008, 2011). For the remaining people, Hungary's USP is "you can have sex here", which won't be applicable to you. For anyone else, the lack of compelling things to do, intelligence to work together with, and a proper functional system that isn't adversarial to entrepreneural action makes it an unlivably hostile system. Strongly recommend leaving as soon as feasible.
sdrinf··on The Toxoplasma of Rage (2014)
Your attention is a scarce resource. A basic point here, is that rage eats your attention for breakfast, and by cost of opportunity, bubbles you into your tribe. By cutting out rage & related weeds, you can actually expose yourself to a significantly larger, and more diverse set of viewpoints.

Conflict as a regulation tool might have worked for our evolutionary ancestors, where resolution can be swiftly found and incentives re-aligned; however, if you reward conflict, the modern machine can generate an endless supply of it, on the tap. The correct solution is to shift the incentives, and reward with your attention the kind of stuff you want to see growing.

sdrinf··on The Toxoplasma of Rage (2014)
| Under Moloch, everyone is irresistibly incentivized to ignore the things that unite us in favor of forever picking at the things that divide us in exactly the way that is most likely to make them more divisive.

In social networks the leverage point in eliminating toxoplasma from your life are the bridge people: people who are being rewarded for taking offense in your in-group, and therefore select for the worst possible behavior of the outgroup. These people act as stressors, specifically triggering ideations of worst-case-scenarios. The fix here is removing these people from your feeds/circles of influence.

I wrote more of efficient defense systems in the age of attention at https://sdrinf.com/age-of-attention .

sdrinf··on Let's guess what Google requires in 14 days or they kill our extension
Except chrome isn't really a "property app" so much as a "proprietary OS"; it's the platform in which ~70% of desktop users spend >10 hours a day. This is different from eg Facebook, in that FB's valueprop is being "full stack" (content + controls + ads); while Chrome's design is open-ended -running other people's websites, with other people's extensions.

The other side of the issue is tough, though: Chrome extensions are regularly purchased & have ads embedded into them ( https://superuser.com/questions/1551266/how-to-track-down-wh... ), so Google's chrome extension team (couple of ~hundred person?) is essentially held accountable by ~1 billion users to the behavior of ~10s of thousands of extensions.

sdrinf··on Suggest HN: No April Fools this year
Good rule of thumb, is April fools is funny, only if the recipient laughs with you afterwards.

Spreading misinformation is not funny. Making others miserable is not funny. Schadenfraude is not funny.

We need levity and laughter more than ever. Doing it well is where the dividing line is. I'd suggest do it well, or don't do it at all.

sdrinf··on Downsides to working at a tech giant
I agree with all of the points raised, and share the same experiences. But this one:

> I might as well become a founder and start my own at that point

Great! So, how would you recruit your first 10 employees?

sdrinf··on The Information Apocalypse (2018)
The idea of a reliability-indicator has been floating around for some time for few-to-no viable results. A much more broad-spectrum immunity-system building exercise is Crash Course's Navigating Digital Information ( https://www.youtube.com/watch?v=M5YKW6fhlss&list=PL8dPuuaLjX... ), which is excellent, and the ep linked is strongly recommended for everyone.
sdrinf··on Ask HN: What are your biggest pain points working with Kubernetes?
Minor (but biggest for us) painpoint: CI pipeline tooling in a microservice environment. This breaks down into a few parts:

* CI tooling (ie for git push master to be automatically deployed to kubernetes) requires eg git + travis which is somewhat expensive for eg personal development, or manual devops work, which is somewhat expensive work-hours wise

* setup time for each microservice is just on the boundary where it happens infrequently enough to not get scripted, but each new one takes an hour to set up manually

* CI deployment time for eg docker builds on Travis can take 3-5 minutes, which is not great if prod breaks

sdrinf··on Attorney General William P. Barr Delivers Address Conference on Cyber Security
The cost-benefit analysis is interesting:

> If one already has an effective level of security — say, by way of illustration, one that protects against 99 percent of foreseeable threats — is it reasonable to incur massive further costs to move slightly closer to optimality and attain a 99.5 percent level of protection even where the risk addressed is extremely remote?

> if the choice is between a world where we can achieve a 99 percent assurance against cyber threats to consumers, while still providing law enforcement 80 percent of the access it might seek; or a world, where we have boosted our cybersecurity to 99.5 percent but at a cost reducing law enforcements access to zero percent — the choice for society is clear.

One issue with all proposals around this, is risk = probability X impact. While the above speaks to the risk, the impact of malicious actors having their hands on masterkeys would be insta-access to any & all gov-mandated communication channels, to the exact same access level as warrants would afford.

While the attorney is right, that so far most corp master certificates have not been compromised, none of those had this pricetag attached to it. And the impact of this would be retroactively applicable -ie for any present-day communication, we'll be taking on faith that no future masterkeys will be leaked, ever.

I would not take that bet; and so far, neither did insurance companies.

sdrinf··on DeleteFB: Selenium script to delete all of your Facebook wall posts
I did this a year ago, and it considerably improved my Fb feed’s signal/noise ratio.

Specific procedure I’d recommend is to make this a regular process: open fb feed, read until you find a thing which does not improves your life, click on owner (author / group) -click “friend” -> unfollow. Iterate until sanity is restored.

And one moral of this story (hi Facebook, please understand this) is that people are multidimensional. Just because you know someone once, in one context in real life, does not, actually, imply positive relationship on informational ecologies for all time in the future. “Authentic self” as defined by Facebook as a single coherent identity is a lie.

sdrinf··on TLDR Stock Options
Relatedly, the valley still does not have a good story for first employees. Given the economics of stock options, there is currently no good economical reason to go working for a startup when the option of working for an already IPOd & liquid Corp exists.
sdrinf··on The US spends more on healthcare for no gain says new report from Johns Hopkins
List prices, like chargemaster. Yes, on one hand, insurance negotiates %x0 discount on it (but eg in the above case, my insurer, Anthem was -ostensibly- charged full price on it) . OTOH, see example above, whereby simple intervention of designating what specific service I will be taking upfront makes a 10x difference in prices. So, regardless of insurance, this transparency gives a serious lever for informed decision-making (whenever that's possible), and can be used additionally to price negotiation.
sdrinf··on The US spends more on healthcare for no gain says new report from Johns Hopkins
PSA: As of 2019, federal law requires all hospital & doctors to post prices in a machine-readable format.

The results are pretty striking, esp here in the Bay: eg UCSF ( https://www.ucsfhealth.org/about/pricing-transparency/ ) charges $2600 for 1-way and 2-way chest X-rays, but charges $220 (that’s two _hundred_) for 3-way chest X-ray. The difference? How many angles they take of your body -ie, a 3-way includes the 2 & 1-way; and, more notably, the 3-way was used as a chargemaster item used in pricing estimators. So eg when I went in for a routine chest x-ray, I've expected a $300-ish bill, and got charged with a $2600 one. Knowing these prices now allows me to ask specifically from my doctor to select the diagnosis&intervention with the highest benefit/cost ratio.

I’m really curious seeing consumer reactions to this, because current medical billing practices must die.

sdrinf··on How to Keep Your Job as Your Company Grows
The fundamental principle-agent issue here, is that startup-y people, who thrive on small teams getting stuff done, are essential for getting a startup up the ground; however it is exactly the point where startups hold the least cash to compensate with.

This generally leads to stock-option based compensation; which, in turn, expires 30 days after employee leaves.

This economics -as practiced presently- strongly implies for savvy startupy people to work only on startups of their own; which in turn makes early hiring extremely difficult.

There are 2 points of equilibrium here:

* The current one is people leading less savvy people on. This leads to a lot of resentment; see rest of HN for that.

* a much less wrong solution would be to have secondary markets set up significantly earlier in the game (post series a); which would make stock & options immediate liquid. Despite sales difficulties(for finding counter parties for that), this can be a huge advantage during hiring, as employees don’t have to take on lottery tickets; and allow early employees to resign with much less resentment.

sdrinf··on Strap on the Fitbit: John Hancock to sell only interactive life insurance
For future reference: this article, and specifically it's title is deliberately misleading to form the general impression of "mandatory tracking", so that they get clickthroughs.

From the horse's mouth:

| John Hancock Vitality Life Insurance now offers new and existing* customers two options to support and incentivize healthier choices, wherever they are in their wellness journey:

| Vitality GO: Vitality GO will be offered on all life insurance policies, at no additional cost. With this basic 'be healthy' version of the program, consumers will have access to expert fitness and nutritional resources and personalized health goals through an easy-to-use app and website. And as they reach key milestones, their healthy activities will be rewarded with discounts at major brand outlets.

| Vitality PLUS: For $2.00 a month 5, customers will receive all the benefits of the John Hancock Vitality Program, including savings of up to 15 percent on annual premiums and valuable rewards for the everyday things they do to stay healthy, like exercising, eating well and getting regular checkups.

https://www.johnhancock.com/news/insurance/2018/09/john-hanc...

Correct article title is here: https://news.ycombinator.com/item?id=18027323 "John Hancock will include fitness tracking in all life insurance policies".

And with that, reuters.com enters into my HN blacklist.

sdrinf··on Ask HN: What Would It Take to Make an Open Source Google?
I posted this a few years back, problem has since become only more difficult: https://news.ycombinator.com/item?id=11626999

Writing an open, and distributed web crawler / indexer is a nice programming exercise. Writing an "objective" ranking function (for any values of "objective") in an open, and distributed manner is structurally not favoured by humanity's current incentive structure. As in:

* a dev team have to agree on signals, and weights: "SERP quality" has dedicated teams of people assigned for specific verticals @ Google; replicating this in a distributed manner will be played politically

* Assuming any significant usage, the second you submit ranking code to public github repo, the algo will be played by thousand SEO scammers to their advantage

* Executing custom ranking function on other people's computer not only introduces security risks, but will have scammers setting up honeypots for collecting other people's ranking signals, and playing accordingly.

sdrinf··on Some Facebook Employees Unite to Challenge Its ‘Intolerant’ Liberal Culture
> please tell me if you think I left out something important.

You did: the position of neutrality. The position of not taking a stance either way. The position of actually doing stuff, like, in the real world, orthogonal to that of politics. The area outside of politics.

I observe, based on your comment 3 above, that you consider politics as all-encompassing. I reply: politics, as practiced currently, is a virus, which attempts to stick itself to everything, every act, every stuff; and until nuance, tolerance, and understanding re-enters the picture, I will not take any part of it.

sdrinf··on Some Facebook Employees Unite to Challenge Its ‘Intolerant’ Liberal Culture
This line of reasoning is implicitely making the false equalence of "everyone who isn't with me is, by default, against me". Going down this route, you are forcing me to take a position on issues I don't nearly feel having sufficient amount of data, or nuance; nor motivated to acquire them, because giving a shit is a rapidly depletable resource, and I have my own life, and my own stuff to take care of.

Please do not take the position of neutrality away from me. Anyone who forces me using the reasoning above, is, by default, an enemy of mine, regardless of coincidence of wants.

sdrinf··on Should computer science researchers disclose negative social consequences?
These are two different set of people: computer scientists develop algos / ml / etc, and want to publish them. UX designers , entrepreneurs, and other customer-focused people in the industry observe human behavior, and (amongst other activities) design traps around them.

It is not useful to expect good predictions from the former group, and the later group isn't really interested in publishing in CS.

sdrinf··on Ask HN: Unicorn job offer after years of freelancing, need advice
CA Labour code section 2870-2872

> "2870. (a) Any provision in an employment agreement which provides that an employee shall assign, or offer to assign, any of his or her rights in an invention to his or her employer shall not apply to an invention that the employee developed entirely on his or her own time without using the employer's equipment, supplies, facilities, or trade secret information"

https://web.archive.org/web/20160516081153/http://www.leginf...

They can be as unflexible about this as they want. Stuff you built outside the scope of the company, AND outside working hours, AND not using company resources, is yours.

> "(b) To the extent a provision in an employment agreement purports to require an employee to assign an invention otherwise excluded from being required to be assigned under subdivision (a), the provision is against the public policy of this state and is unenforceable. "

The reason why you want to cross out that section isn't so much as to signal non-compliance as to communicate, that that part of the contract is illegal by California law.

If the contract does not have a special clause about illegality, leaving that paragraph in might make the entire contract void.

sdrinf··on NPR Retracts Story 'The Man Who Spent $100K To Remove A Lie From Google'
While I do agree on the social harm of censorship, unfortunately your approach is susceptible to asymmetric info-attacks under adversarial conditions.

Specifically, under the condition where the debate actually matters, your compulsion can be exploited by putting out any number of variedly wrong ideas, for which you pay an asymmetrically higher cost to refute, and an opportunity cost of not being able to present ideas of your own.

The debate can this way be framed to either never reach "consensus", or to do so at the counterparty's favored position.

The widespread use of this strategy is a reason why society is falling back on censorship as opposed to reason.

sdrinf··on Let's Encrypt ACMEv2 and Wildcard Launch Delay
> non-pki protocols are in the works.

Could you kindly link to relevant threads / RFCs / orgs / undertakings currently working on that, please?

sdrinf··on Let's Encrypt ACMEv2 and Wildcard Launch Delay
While HTTPS is being burned into the architecture of the Web, I have a humble question to ask: what is the dear HN community's next-best-option in a scenario if letsencrypt dies/gets sued/goes under/servers not accessible anymore?

I ponder on this question seeing how Google is planning to increasingly depreciate HTTP. While in general, I welcome the security upgrade, the lack of next-best-free-options makes me vary of this config change locking us into a $$$paid-only web publishing system.

sdrinf··on A British couple who took on Google and cost it £2.1B
| Sure. But if my little businesses, with only a few people and a modest budget available to do literally everything, can manage to treat our customers with more attention and respect than one of the richest and most powerful businesses in the world, something is wrong.

2.2 Billion users. 74,000 employees. That's 300,000 users per employee. Converting Google's entire current operation into customer support, and assuming 1 ticket per year per customer, would require every Google employee to solve 1.7 tickets per minute (365/8) to keep up. Assuming a 5 minute ticket resolution (and still 1 ticket per year per user) would require 500,000 trained customer support personal to support that; assuming $20K per year, that equals to ~$10B. Google's profit was ~20B last year. This is not very likely to happen; and conditional it does, it would kill very large parts of the IT sector.

Can we kindly attempt to actually get to a solution that is actually mutually acceptable by all parties for this?

sdrinf··on A British couple who took on Google and cost it £2.1B
Under adversarial conditions (basically, any large-scale ops), this becomes the highest-leverage way for adversaries to aggressively DDoS the weakest point of such support queue.

Also, consider the conditions:

* You are a scammer

* You pay $10 to Google to "fix getting back into your account"

* Google knows that account does not, actually belongs to you, but now are in a position, where they either: eat the $10 with a WONTFIX, and pave the way to a mass lawsuit or refund the $10, and have a free way for scammers to exploit.

sdrinf··on Patreon’s new service fee spurs concern that creators will lose patrons
A bootstrapped company somewhere in the Midwest takes about 3-5 years of bootstrapping to be heard about on the east coast. A capitalized startup can hit the PR drum immediately. As put earler at https://news.ycombinator.com/item?id=15658756

> In consumer (markets), even a great product will often get blown out of the water if a competitor with a worse but good enough product has a deep, deep marketing war chest. If you space has a VC backed competitor, you have no choice but to also raise money and fight a war of attrition

sdrinf··on Finance Pros Say You’ll Have to Pry Excel Out of Their Cold, Dead Hands
This sounds an incredibly useful capability to have. May I ask which data connector did you used to pull data, and how did you made it available in that format from the app side?
sdrinf··on Trump Is President. Now Encrypt Your Email
If you're using chrome, a strong recommendation for CryptUp: https://cryptup.org/ <- which does seamless gmail integration for pgp, compatible with all major external keyservers & other email encryption apps; without disclosing your keys to Google (or any third-party), or breaking your workflow.
sdrinf··on Bash and Windows Subsystem for Linux Demo [video]
* Yes, these are native, ELF binaries. Yes, you can compile it on your linux server, cp it across to windows, and run it.

* No, it is not an emulation. The win10 kernel + compatibility layer just happens to be able to also run ELF binaries. Yes, these show up as standard processes, and can be interacted with using normal windows tools (eg taskmgr).

← PreviousPage 4 of 10Next →