seandougall

> I also want a programmable bedroom light that can slowly dim on at morning.

FWIW, a lot of cheap CFL bulbs do this on their own. It's one of the reasons I hate CFLs for most uses, but I've come to appreciate that the light in my kids' room starts at about half (perceived) brightness and takes a minute or two to warm up.

"Class/type similarity" means that twins are likely to, say, both have whorls on their right index fingers, but doesn't mean they'll have the same pattern of ridges. So for the sake of biometrics, that doesn't make them more similar than two random people.

Passcodes are at least easier to rotate than fingerprints. You get 100,000,000 possibilities with 8 digits, compared to 10 possibilities with 10 digits.

Indeed, Apple had already implemented something similar with Target Display Mode on the iMac back in 2009, so it's hardly a stretch to figure they've been planning something like this for essentially as long as iPads have been around.

Mathematically we can be reasonably certain it works, but afaik it’s not formally proven that, say, there isn’t an efficient algorithm for prime factorization. It just seems unlikely that the U.S. government would know of one that nobody else has managed to figure out.

Plus, flawed implementations can open up side channels; this seems like an endorsement of Facebook’s implementation in that sense.

Ah, yes, the fabled "biological pronoun".

Pronouns are not biological constructs. They don't have chromosomes, genitals, or secondary sex characteristics. They are, by definition, tied to gender.

How would life work if pronouns were determined biologically? For example, how would you figure out what pronouns to use to describe me, if we met in person?

You'd have to ask me to drop trou immediately after we met, which would generally be considered socially unacceptable, or at least a bit forward. But if I did it anyway, how would you know my genitalia hadn't been surgically altered? You could try to cross-reference my secondary sex characteristics, but even those could have been modified hormonally. Really, you'd have to ask for a DNA sample to determine which chromosomes I have, and even that might turn out not to align with the sex I was assigned at birth, much less the one I present today. And what pronouns do you choose if it turns out I have a combination other than XX or XY? It all seems like a lot of trouble and expense for pronouns anyway.

What I'm getting at is that people who make that sort of argument aren't actually saying, "the pronouns I'm using for you are based on your biology". That's just disingenuous, or at the very least shows that they haven't given it any actual thought. What they're really saying is, "the pronouns I'm using for you are what I think you look like, even if it's the opposite of what you tell me you are". I don't see how there's a well-intentioned way to interpret that.

It's so much safer (and easier!) just to take people at their word when they tell you their pronouns, just as you would when they tell you their name.

Given how hidden opt-out settings tend to be, yes. If the user has to opt in explicitly, it’s much less likely they’ll consent unintentionally.

A bus would likely have to stay in the right lane, which is still pretty torn up by truck traffic in big stretches.

Don't underestimate that hassle when comparing durations. I once dropped my spouse off at OAK, drove down the 5, and picked her up at BUR. She had time to eat dinner at the airport, but otherwise she really didn't get there much before me.

Flax seed oil polymerizes to a very slick surface, but it’s relatively brittle, and there are reports of it flaking off of cast iron.

Really the best thing you can do is get a hundred year old skillet, because they literally don’t make ‘em Like they used to.

Easy solution: just leave it off entirely!

https://www.reddit.com/r/MapsWithoutNZ/

Yup. A few years ago I tried to reduce my dependence on the computer by writing more things down by hand, only to discover my left hand had developed a nervous tic that resulted in me attempting to hit command-S on the paper.

But TFA is not using "particles" to mean "molecules". It means "pieces of plastic below 5mm in size". Compared to molecules, these are macro-scale objects, and if you mix 10^24 of them into the oceans, that becomes a lot more noticeable than a liter of pharaoh water.

There are issues of scale that make that a poor analogy. You can't leverage a botnet to automate attempts to pick the locks of every home in the country. Nor can you pick a normal lock from thousands of miles away. Even if you get inside, you can't duplicate the entire contents of a house in a matter of seconds to rifle through later, and it's darn near impossible to break in and rummage around without being detected.

Yeah, they don't seem to include the cigarette lighters themselves anymore (the plug with the nichrome coil or whatever it is that heats up when pushed in), but the outlets are still there on my most recent car, and every rental car I've driven recently.

I've only ever seen that spelled as "yak", so it took me a while to make that connection.

> a scammer may need to get certs for a large number of domains.

Why? In the m1cros0ft.com example, you just need one domain, and you can send a phishing link out to millions of addresses.

> And unfortunately, a whole generation of computer illiterate users believe that lock means the site is legit.

That's exactly why EV doesn't help, because those users _also_ don't know that the absence of green is supposed to carry semantic meaning. In fact, those users largely don't know or care what a URL is in the first place.

HTTPS everywhere is unequivocally a good thing. I can (and do) personally run websites that have active user accounts precisely because of LetsEncrypt; it would be a terrible idea to train my users that they should type a password into a form that's submitted over HTTP. But I don't have a budget to pay rent-seeking CAs for certificates whose value is based on artificial scarcity.

Yeah, but "-37.80467681 144.9659498" has no meaning colloquially to almost anybody, because normal humans don't think in latitude and longitude in the first place. To me, those are just values to copy and paste into a maps app to see where something is, and if it's pointing to more or less the right location, I'm happy.

They're like the physical-world equivalent of a URL; I don't honestly care if there's an unused query string parameter tacked onto the end of it or if it redirects to https or something; all I care about is that the link I clicked on gets me to the correct cat video.

That's certainly true in a scientific paper, where the concept of significant digits is relevant and widely recognized. In a "please remove dead animal" web request, the value is only wrong if it points to the wrong location (i.e. a location that does not contain a dead animal).

Thanks for taking the time to reply! Like many here, I've been a critic of Electron, but I think it also does some amazing stuff, and I'm sorry you have to go into PR maintenance mode over such a weaksauce article.

I was coming back to follow up and say that that's exactly what I found -- running `codesign --verify` does show the modification. It makes sense that Gatekeeper wouldn't re-verify a 185 MB bundle on every launch, which makes me wonder if there's something else macOS could be doing at the FS level to see if any files have been modified and trigger a new check.

At any rate, while I don't quite take back what I said about application code in Resources/, I do take back the implication that it had anything to do with this; I suppose there doesn't seem to be anything Electron-specific about TFA, other than that exposing raw JS lowers the bar for who can write the code to inject. (Assuming you can get FS access to inject code in the first place, of course.)

> For macOS for example, all resources (including ASAR files) are signed, and macOS makes it intentionally difficult to install anything that isn't signed.

I just tried this with Slack on macOS, and it launched without a single complaint about code signing. It would appear that either the ASAR files are not included in the signature, or the OS doesn't check the entire application bundle on every launch.

(Edit: That said, I needed sudo to do the mod in the first place, so I'm not about to start panicking about this as an attack vector.)

(Edit 2: As 'marshallofsound pointed out below and elsewhere, it is the latter case; the OS doesn't check the entire bundle on every launch. Which makes sense, and also means TFA is not really about Electron at all.)

"... but only if you give her sudo access"

On macOS, if my understanding of the current situation is correct, code signing normally covers all binaries in an application bundle, including binaries in all bundled frameworks. What's different about Electron is that it puts application code, which is not a binary, into the Resources/ directory, which is not signed.

I just tried this out with Slack on macOS, and it did work... almost as advertised. I had to use sudo to change the application files, which means this isn't really much of a novel attack surface, but it did bypass the code signing checks quite handily.

So, is this a "vulnerability"? That may be a stretch, as far as I can see, but putting application code in Resources/ definitely counts as a "smell" in my book.

Yeah, one could just as easily claim that Joyful Noise ripped that motive off from Red Hot Chili Peppers' Snow (Hey Oh).

Yup, that's because it's about averages.

To take a contrived and simplified example, imagine a hypothetical world in which everybody dies on their 90th birthday by default, but a handful of diseases cause 25% of the population to die on their 30th birthday instead. That brings the average life expectancy to 73.75y.

Now imagine a bunch of medical breakthroughs bring the 30-year-old mortality rate down from 25% to 7%. That enormous difference brings the average life expectancy to 85.45y.

That's in increase in life expectancy just shy of 16%, despite the fact that it comes from a 72% reduction in 30-year-old mortality rates.

That's obviously a massive oversimplification, and real distributions look different, but it illustrates the problem with just looking at average life expectancies; it makes it look like everyone's life span has just been scaled up by 16%, which is not the case. If you look at it from the perspective of, "what are the chances my life will be cut short by some preventable disease?", the magnitude of the change is much greater. Some of that change is due to very cheap innovations like bread-mold-as-antibiotic, and some of it is due to very expensive innovations like organ transplants. Either way, I for one am glad those days are over, despite the appealing economic simplicity.

Even though they don’t charge for the library, they have a lot riding on the perception of the quality of their protocol. If they allow third party implementations and some of them suck, it might tarnish NDI’s image (and indirectly hurt them via the money they make on hardware).

Edit: I’m certainly not arguing that any particular implementation does suck, just saying that I can see why they might want to protect IP they don’t make money from directly.

That seems to indicate a 16% increase in life expectancy between the last pre-WW2 data point and the most recent data point. That's pretty huge, especially when you consider that those are averages, meaning that the disparity is made up not so much of old people dying older, but more of young people not dying from illnesses that are now preventable.

As a specific and personal data point, I have chronic kidney disease, which developed rapidly when I was 25. With pre-WW2 medicine (no transplants, no dialysis), I might have lived to 26, maaaaybe, and even then only if I'd been able to control my blood pressure long enough for renal failure to set in instead of a stroke or heart attack.

Thanks to modern medicine, I'm now nearing 40 with a good prognosis; there's no reason to believe it will impact my life expectancy, and the impact on my quality of life is relatively minimal. Compared to dying in my mid-20s, that's a vast world of difference. I will not willingly go back to pre-WW2 medicine, thank you very much.

You can do all that in Metal -- though as GP said, it doesn't matter, because there's fixed latency at the camera input.

This is as much as possible what the Camera cue in QLab[1] does (I'm the lead video developer), and there most definitely is perceived latency. It's better than it used to be, when webcams were DV over Firewire, but it's still enough that webcams are generally a poor choice for latency-sensitive situations like live performance.

The alternative that usually gets used in productions with a moderate budget is a hardware camera with HDMI or SDI output into a Blackmagic capture device. There's still some latency, but it's better than a webcam. It's pretty much down to the minimum of what you can do with a computer -- the capture device still has to buffer a frame, transmit it to the computer, which copies it into RAM, then blits it to video RAM, where it waits for the next vertical refresh.

All that said, the human finger doesn't travel all that fast, so for a HID application like this, you could probably get the latency way down by extrapolating the near-future position of the finger, much like iPadOS does with Pencil.

[1] https://figure53.com/qlab

Same. At least they fixed the issue (years ago, to be fair) where you could log into your Citibank account and tweak the URL to see other customers' data...